@shivaedev/identity 0.0.0 → 0.2.0

package/dist/server/better-auth/mount.d.ts

@@ -0,0 +1,265 @@
+import { type BetterAuthOptions } from "better-auth";
+import { Config, Effect, Redacted } from "effect";
+import { Pool, type PoolConfig } from "pg";
+import type { RoleSet } from "@shivaedev/access/roleSet.ts";
+import type { GetSession } from "#server/adapters/betterAuthSessions.ts";
+import { type BearerSessionsOptions } from "#server/better-auth/bearerSessions.ts";
+import { type RevokeUnadmitted } from "#server/better-auth/revokeUnadmitted.ts";
+import { type SignInPolicy } from "#server/better-auth/signInGate.ts";
+import type { SessionShape } from "#server/session.ts";
+export interface BetterAuthMountOptions<E = never, R = never> {
+    readonly bearerSessions?: BearerSessionsOptions | undefined;
+    readonly roles?: RoleSet;
+    readonly signIn?: SignInPolicy<E, R> | undefined;
+}
+export declare const betterAuthMount: <const TOptions extends BetterAuthOptions, E = never, R = never>(options: TOptions, mount?: BetterAuthMountOptions<E, R> | undefined) => Effect.Effect<{
+    admittedSessions: <TSession extends SessionShape>(getSession: GetSession<TSession>) => GetSession<TSession>;
+    auth: import("better-auth").Auth<TOptions & {
+        advanced: {
+            disableCSRFCheck?: boolean | undefined;
+            disableOriginCheck?: boolean | undefined;
+            crossSubDomainCookies?: {
+                enabled: boolean;
+                additionalCookies?: string[];
+                domain?: string;
+            } | undefined;
+            cookies?: {
+                [key: string]: {
+                    name?: string;
+                    attributes?: import("better-auth").CookieOptions;
+                };
+            } | undefined;
+            defaultCookieAttributes?: import("better-auth").CookieOptions | undefined;
+            cookiePrefix?: string | undefined;
+            database?: {
+                defaultFindManyLimit?: number;
+                generateId?: import("better-auth").GenerateIdFn | false | "serial" | "uuid";
+                joins?: boolean;
+                validateSchema?: boolean;
+            } | undefined;
+            trustedProxyHeaders?: boolean | undefined;
+            backgroundTasks?: {
+                handler: (promise: Promise<unknown>) => void;
+            };
+            skipTrailingSlashes?: boolean;
+            useSecureCookies: boolean | undefined;
+            ipAddress: {
+                disableIpTracking?: boolean;
+                ipv6Subnet?: number;
+                ipAddressHeaders: string[];
+                trustedProxies: never[];
+            };
+        };
+        baseURL: import("better-auth").BaseURLConfig;
+        databaseHooks: {
+            user?: {
+                create?: {
+                    before?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            email?: string | undefined;
+                            emailVerified?: boolean | undefined;
+                            name?: string | undefined;
+                            image?: string | null | undefined;
+                        } & Record<string, any>;
+                    }>;
+                    after?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                update?: {
+                    before?: (user: Partial<import("better-auth").User> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            [x: string]: any;
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            email?: string | undefined;
+                            emailVerified?: boolean | undefined;
+                            name?: string | undefined;
+                            image?: string | null | undefined;
+                        };
+                    }>;
+                    after?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                delete?: {
+                    before?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                    after?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+            };
+            session?: {
+                create?: {
+                    before?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            userId?: string | undefined;
+                            expiresAt?: Date | undefined;
+                            token?: string | undefined;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        } & Record<string, any>;
+                    }>;
+                    after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                update?: {
+                    before?: (session: Partial<import("better-auth").Session> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            [x: string]: any;
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            userId?: string | undefined;
+                            expiresAt?: Date | undefined;
+                            token?: string | undefined;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    }>;
+                    after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                delete?: {
+                    before?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                    after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+            };
+            account?: {
+                create?: {
+                    before?: (account: import("better-auth").Account, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            providerId?: string | undefined;
+                            accountId?: string | undefined;
+                            userId?: string | undefined;
+                            accessToken?: string | null | undefined;
+                            refreshToken?: string | null | undefined;
+                            idToken?: string | null | undefined;
+                            accessTokenExpiresAt?: Date | null | undefined;
+                            refreshTokenExpiresAt?: Date | null | undefined;
+                            scope?: string | null | undefined;
+                            password?: string | null | undefined;
+                        } & Record<string, any>;
+                    }>;
+                    after?: (account: import("better-auth").Account, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                update?: {
+                    before?: (account: Partial<import("better-auth").Account> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            [x: string]: any;
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            providerId?: string | undefined;
+                            accountId?: string | undefined;
+                            userId?: string | undefined;
+                            accessToken?: string | null | undefined;
+                            refreshToken?: string | null | undefined;
+                            idToken?: string | null | undefined;
+                            accessTokenExpiresAt?: Date | null | undefined;
+                            refreshTokenExpiresAt?: Date | null | undefined;
+                            scope?: string | null | undefined;
+                            password?: string | null | undefined;
+                        };
+                    }>;
+                    after?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                delete?: {
+                    before?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                    after?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+            };
+            verification?: {
+                create?: {
+                    before?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            value?: string | undefined;
+                            expiresAt?: Date | undefined;
+                            identifier?: string | undefined;
+                        } & Record<string, any>;
+                    }>;
+                    after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                update?: {
+                    before?: (verification: Partial<import("better-auth").Verification> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            [x: string]: any;
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            value?: string | undefined;
+                            expiresAt?: Date | undefined;
+                            identifier?: string | undefined;
+                        };
+                    }>;
+                    after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                delete?: {
+                    before?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                    after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+            };
+        } | undefined;
+        rateLimit: {
+            window?: number | undefined;
+            max?: number | undefined;
+            modelName?: "rateLimit" | import("better-auth").LiteralString;
+            fields?: Partial<Record<"count" | "key" | "lastRequest", string>>;
+            customRules?: {
+                [key: string]: import("better-auth").BetterAuthRateLimitRule | false | ((request: Request, currentRule: import("better-auth").BetterAuthRateLimitRule) => import("better-auth").Awaitable<false | import("better-auth").BetterAuthRateLimitRule>);
+            } | undefined;
+            storage?: ("memory" | "database" | "secondary-storage") | undefined;
+            customStorage?: import("better-auth").BetterAuthRateLimitStorage;
+            enabled: boolean;
+        };
+        secret: string;
+        trustedOrigins: string[] | ((request?: Request | undefined) => import("better-auth").Awaitable<(string | undefined | null)[]>);
+        user: (import("better-auth").BetterAuthDBOptions<"user", "createdAt" | "email" | "emailVerified" | "id" | "image" | "name" | "updatedAt"> & {
+            validateUserInfo?: (data: {
+                user: Partial<import("better-auth").User> & Record<string, unknown>;
+                source: import("better-auth").ValidateUserInfoSource;
+            }, context: import("better-auth").GenericEndpointContext) => import("better-auth").Awaitable<void | import("better-auth").ValidateUserInfoResult>;
+            changeEmail?: {
+                enabled: boolean;
+                sendChangeEmailConfirmation?: (data: {
+                    user: import("better-auth").User;
+                    newEmail: string;
+                    url: string;
+                    token: string;
+                }, request?: Request) => Promise<void>;
+                updateEmailWithoutVerification?: boolean;
+            };
+            deleteUser?: {
+                enabled?: boolean;
+                sendDeleteAccountVerification?: (data: {
+                    user: import("better-auth").User;
+                    url: string;
+                    token: string;
+                }, request?: Request) => Promise<void>;
+                beforeDelete?: (user: import("better-auth").User, request?: Request) => Promise<void>;
+                afterDelete?: (user: import("better-auth").User, request?: Request) => Promise<void>;
+                deleteTokenExpiresIn?: number;
+            };
+        }) | undefined;
+    }>;
+    revokeUnadmitted: RevokeUnadmitted<E>;
+    routes: import("effect/Layer").Layer<never, never, import("effect/http/HttpRouter").HttpRouter>;
+    sessions: {
+        roles?: RoleSet;
+        provider: import("#server/session.ts").SessionProvider<{
+            readonly user: {
+                readonly email: string;
+                readonly id: string;
+                readonly name: string;
+                readonly role?: string | null;
+            };
+        }>;
+    };
+}, Config.ConfigError, R | import("effect/Scope").Scope>;
+export declare const authDatabase: (url: Redacted.Redacted<string>, options?: Pick<PoolConfig, "application_name" | "max"> | undefined) => Effect.Effect<Pool, never, import("effect/Scope").Scope>;
+//# sourceMappingURL=mount.d.ts.map

package/dist/server/better-auth/mount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/mount.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,iBAAiB,EAAc,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAU,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAmB,KAAK,UAAU,EAAE,MAAM,IAAI,CAAC;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,KAAK,qBAAqB,EAAsC,MAAM,uCAAuC,CAAC;AAIvH,OAAO,EAAE,KAAK,gBAAgB,EAAoB,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAsB,KAAK,YAAY,EAAc,MAAM,mCAAmC,CAAC;AAEtG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,MAAM,WAAW,sBAAsB,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK;IAC3D,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC;CACjD;AAED,eAAO,MAAM,eAAe,SAA0D,QAAQ,SAAS,iBAAiB,EAAE,CAAC,UAAU,CAAC;uBAwD3G,QAAQ,SAAS,YAAY,cAAc,UAAU,CAAC,QAAQ,CAAC,KAAG,UAAU,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAkC/G,CAAC;AAEH,eAAO,MAAM,YAAY,kKAgCvB,CAAC"}

package/dist/server/better-auth/mount.js

@@ -0,0 +1,111 @@
+import { betterAuth } from "better-auth";
+import { Config, Effect, Option, Redacted } from "effect";
+import { Pool } from "pg";
+import { sessionHeaders, withBearerSessions } from "#server/better-auth/bearerSessions.ts";
+import { PEER_IP_HEADER } from "#server/better-auth/clientIp.ts";
+import { memoryRateLimit } from "#server/better-auth/memoryRateLimit.ts";
+import { mountRoutes } from "#server/better-auth/mountRoutes.ts";
+import { revokeUnadmitted } from "#server/better-auth/revokeUnadmitted.ts";
+import { signInGate } from "#server/better-auth/signInGate.ts";
+import { signInPolicyOptions } from "#server/better-auth/signInPolicy.ts";
+import { mountedSessions } from "./mountedSessions.js";
+export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* (options, mount = {}) {
+    const secret = options.secret ?? Redacted.value(yield* Config.Redacted("BETTER_AUTH_SECRET"));
+    const publicUrl = yield* Config.URL("PUBLIC_URL").pipe(Config.option);
+    const origin = Option.map(publicUrl, (url) => url.origin);
+    const trustedProxy = Option.getOrUndefined(yield* Config.String("TRUSTED_PROXY").pipe(Config.option));
+    const clientIpHeader = yield* Config.String("AUTH_CLIENT_IP_HEADER").pipe(Config.withDefault("x-forwarded-for"));
+    const rateLimitEnabled = yield* Config.Boolean("AUTH_RATE_LIMIT_ENABLED").pipe(Config.withDefault(true));
+    const context = yield* Effect.context();
+    const run = Effect.runPromiseWith(context);
+    const policy = mount.signIn ?? {};
+    if (policy.accounts !== undefined) {
+        yield* policy.accounts;
+    }
+    const gate = yield* signInGate(policy);
+    const gated = signInPolicyOptions(options, gate, run, () => auth.$context);
+    const rateLimit = options.rateLimit;
+    const customStorage = rateLimit?.customStorage ?? (rateLimit?.storage === undefined || rateLimit.storage === "memory" ? yield* memoryRateLimit : undefined);
+    const auth = betterAuth({
+        ...withBearerSessions(options, mount.bearerSessions !== undefined),
+        advanced: {
+            useSecureCookies: Option.isSome(publicUrl) && publicUrl.value.protocol === "https:",
+            ...options.advanced,
+            ipAddress: {
+                ...options.advanced?.ipAddress,
+                ipAddressHeaders: [PEER_IP_HEADER],
+                trustedProxies: [],
+            },
+        },
+        "baseURL": options.baseURL
+            ?? Option.getOrElse(origin, () => ({
+                allowedHosts: ["127.0.0.1:*", "localhost:*"],
+                protocol: "http",
+            })),
+        databaseHooks: gate.active ? gated.databaseHooks : options.databaseHooks,
+        rateLimit: {
+            ...rateLimit,
+            ...(customStorage === undefined ? {} : { customStorage }),
+            enabled: rateLimitEnabled,
+        },
+        secret,
+        trustedOrigins: options.trustedOrigins ?? Option.match(origin, { onNone: () => ["http://127.0.0.1:*", "http://localhost:*"], onSome: (url) => [url] }),
+        user: gate.active ? gated.user : options.user,
+    });
+    const authRoutes = mountRoutes(auth, {
+        bearerSessions: mount.bearerSessions,
+        clientIpHeader,
+        ipv6Subnet: options.advanced?.ipAddress?.ipv6Subnet,
+        roles: mount.roles,
+        trustedProxy,
+    });
+    function admittedSessions(getSession) {
+        if (!gate.active && mount.bearerSessions === undefined) {
+            return getSession;
+        }
+        return (headers) => run(Effect.gen(function* () {
+            const { authCookies } = yield* Effect.promise(() => auth.$context);
+            const selected = mount.bearerSessions === undefined ? headers : sessionHeaders(headers, authCookies.sessionToken.name);
+            const session = yield* Effect.tryPromise(() => getSession(selected));
+            if (!gate.active || session === null) {
+                return session;
+            }
+            const storage = yield* Effect.tryPromise(() => auth.$context);
+            if (yield* gate.admitsUser(storage, session.user.id)) {
+                return session;
+            }
+            yield* Effect.tryPromise(() => storage.internalAdapter.deleteUserSessions(session.user.id));
+            yield* Effect.logInfo("The sign-in policy revoked a user's sessions").pipe(Effect.annotateLogs({ userId: session.user.id }));
+            return null;
+        }));
+    }
+    const revoke = Effect.provideContext(revokeUnadmitted(gate, () => auth.$context), context);
+    const lookupSession = Reflect.get(auth.api, "getSession");
+    const sessions = mountedSessions((headers) => lookupSession({ asResponse: false, headers, query: { disableCookieCache: true }, returnHeaders: false }), admittedSessions, mount.roles);
+    return { admittedSessions, auth, revokeUnadmitted: revoke, routes: authRoutes, sessions };
+});
+export const authDatabase = Effect.fn("Platform.authDatabase")(function* (url, options = {}) {
+    const clients = new Set();
+    const run = Effect.runForkWith(yield* Effect.context());
+    return yield* Effect.acquireRelease(Effect.sync(() => {
+        const pool = new Pool({
+            ...options,
+            connectionString: Redacted.value(url),
+        });
+        pool.on("connect", (client) => clients.add(client));
+        pool.on("remove", (client) => clients.delete(client));
+        pool.on("error", (error) => {
+            run(Effect.logDebug({
+                event: "auth_database_idle_client_failed",
+                message: error.message,
+            }));
+        });
+        return pool;
+    }), (pool) => Effect.promise(async () => {
+        // pg-pool resolves end before its clients finish disconnecting.
+        const disconnected = [...clients].map((client) => new Promise((resolve) => client.once("end", resolve)));
+        await pool.end();
+        await Promise.all(disconnected);
+    }));
+});
+//# sourceMappingURL=mount.js.map

package/dist/server/better-auth/mount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount.js","sourceRoot":"","sources":["../../../src/server/better-auth/mount.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,UAAU,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAoC,MAAM,IAAI,CAAC;AAG5D,OAAO,EAA8B,cAAc,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AACvH,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAyB,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAyC,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACtG,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE1E,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAQvD,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EAC7E,OAAiB,EACjB,KAAK,GAAiC,EAAE;IAExC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACtG,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjH,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAK,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAClC,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAA2B,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,aAAa,GAClB,SAAS,EAAE,aAAa,IAAI,CAAC,SAAS,EAAE,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvI,MAAM,IAAI,GAAG,UAAU,CAAC;QACvB,GAAG,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC;QAClE,QAAQ,EAAE;YACT,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ;YACnF,GAAG,OAAO,CAAC,QAAQ;YACnB,SAAS,EAAE;gBACV,GAAG,OAAO,CAAC,QAAQ,EAAE,SAAS;gBAC9B,gBAAgB,EAAE,CAAC,cAAc,CAAC;gBAClC,cAAc,EAAE,EAAE;aAClB;SACD;QACD,SAAS,EACR,OAAO,CAAC,OAAO;eACZ,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAClC,YAAY,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC;gBAC5C,QAAQ,EAAE,MAAe;aACzB,CAAC,CAAC;QACJ,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;QACxE,SAAS,EAAE;YACV,GAAG,SAAS;YACZ,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;YACzD,OAAO,EAAE,gBAAgB;SACzB;QACD,MAAM;QACN,cAAc,EACb,OAAO,CAAC,cAAc,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACvI,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI;KAC7C,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc;QACd,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU;QACnD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,YAAY;KACZ,CAAC,CAAC;IACH,SAAS,gBAAgB,CAAgC,UAAgC;QACxF,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACxD,OAAO,UAAU,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,OAAO,EAAE,EAAE,CAClB,GAAG,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACnB,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACvH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACtC,OAAO,OAAO,CAAC;YAChB,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACtD,OAAO,OAAO,CAAC;YAChB,CAAC;YACD,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5F,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7H,OAAO,IAAI,CAAC;QACb,CAAC,CAAC,CACF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAwB,MAAM,CAAC,cAAc,CACxD,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC3C,OAAO,CACP,CAAC;IACF,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,eAAe,CAC/B,CAAC,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EACrH,gBAAgB,EAChB,KAAK,CAAC,KAAK,CACX,CAAC;IACF,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EACvE,GAA8B,EAC9B,OAAO,GAAiD,EAAE;IAE1D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAc,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAClC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QAChB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;YACrB,GAAG,OAAO;YACV,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,GAAG,CACF,MAAM,CAAC,QAAQ,CAAC;gBACf,KAAK,EAAE,kCAAkC;gBACzC,OAAO,EAAE,KAAK,CAAC,OAAO;aACtB,CAAC,CACF,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,EACF,CAAC,IAAI,EAAE,EAAE,CACR,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;QACzB,gEAAgE;QAChE,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/G,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC,CAAC,CACH,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/server/better-auth/mountRoutes.d.ts

@@ -0,0 +1,23 @@
+import { HttpRouter } from "effect/http";
+import type { RoleSet } from "@shivaedev/access/roleSet.ts";
+import { type BearerSessionsOptions } from "#server/better-auth/bearerSessions.ts";
+interface MountedAuth {
+    readonly $context: Promise<{
+        readonly authCookies: {
+            readonly sessionToken: {
+                readonly name: string;
+            };
+        };
+    }>;
+    readonly handler: (request: Request) => Promise<Response>;
+}
+interface MountRouteOptions {
+    readonly bearerSessions?: BearerSessionsOptions | undefined;
+    readonly clientIpHeader: string;
+    readonly ipv6Subnet?: number | undefined;
+    readonly roles?: RoleSet | undefined;
+    readonly trustedProxy?: string | undefined;
+}
+export declare function mountRoutes(auth: MountedAuth, options: MountRouteOptions): import("effect/Layer").Layer<never, never, HttpRouter.HttpRouter>;
+export {};
+//# sourceMappingURL=mountRoutes.d.ts.map

package/dist/server/better-auth/mountRoutes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mountRoutes.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/mountRoutes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAyC,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAE5D,OAAO,EAAE,KAAK,qBAAqB,EAA2D,MAAM,uCAAuC,CAAC;AAI5I,UAAU,WAAW;IACpB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAAE,QAAQ,CAAC,WAAW,EAAE;YAAE,QAAQ,CAAC,YAAY,EAAE;gBAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IAC3G,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC1D;AACD,UAAU,iBAAiB;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAuCD,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,qEAexE"}

package/dist/server/better-auth/mountRoutes.js

@@ -0,0 +1,51 @@
+import { Effect } from "effect";
+import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { cookieSessionResponse, hasSessionCookie, sessionHeaders } from "#server/better-auth/bearerSessions.ts";
+import { clientIpHeaders } from "./clientIp.js";
+import { sessionPermissions } from "./sessionPermissions.js";
+function replacesSession(request, response, native) {
+    return (native
+        && response.ok
+        && response.headers.has("set-auth-token")
+        && request.headers.has("authorization")
+        && new URL(request.url).pathname.startsWith("/api/auth/sign-in/"));
+}
+async function providerResponse(auth, web, options) {
+    if (options.bearerSessions === undefined) {
+        return auth.handler(web);
+    }
+    const { authCookies } = await auth.$context;
+    const cookieName = authCookies.sessionToken.name;
+    const headers = sessionHeaders(web.headers, cookieName);
+    const native = options.bearerSessions.origins.includes(web.headers.get("origin") ?? "") && !hasSessionCookie(web.headers, cookieName);
+    const request = new Request(web, { headers });
+    const response = await auth.handler(request);
+    if (replacesSession(request, response, native)) {
+        const revoked = await auth.handler(new Request(new URL("/api/auth/sign-out", web.url), { body: "{}", headers, method: "POST" }));
+        await revoked.body?.cancel();
+        if (!revoked.ok) {
+            throw new Error("Session replacement failed");
+        }
+    }
+    return native ? response : cookieSessionResponse(response);
+}
+async function authResponse(auth, web, options) {
+    const sessionRequest = options.roles !== undefined && new URL(web.url).pathname === "/api/auth/get-session";
+    const url = new URL(web.url);
+    if (sessionRequest) {
+        url.searchParams.set("disableCookieCache", "true");
+    }
+    const request = sessionRequest ? new Request(url, web) : web;
+    const response = await providerResponse(auth, request, options);
+    return sessionRequest && response.ok && options.roles !== undefined ? sessionPermissions(response, options.roles) : response;
+}
+export function mountRoutes(auth, options) {
+    const setClientIp = clientIpHeaders(options);
+    return HttpRouter.use((router) => router.add("*", "/api/auth/*", (request) => Effect.gen(function* () {
+        const web = yield* HttpServerRequest.toWeb(request);
+        setClientIp(request, web);
+        return HttpServerResponse.fromWeb(yield* Effect.tryPromise(() => authResponse(auth, web, options)).pipe(Effect.tapError((error) => Effect.logError("Authentication provider failed", redact(error.cause)))));
+    }).pipe(Effect.catch(() => Effect.succeed(HttpServerResponse.text("Authentication is temporarily unavailable", { status: 503 }))))));
+}
+//# sourceMappingURL=mountRoutes.js.map

package/dist/server/better-auth/mountRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mountRoutes.js","sourceRoot":"","sources":["../../../src/server/better-auth/mountRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAA8B,qBAAqB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5I,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAa7D,SAAS,eAAe,CAAC,OAAgB,EAAE,QAAkB,EAAE,MAAe;IAC7E,OAAO,CACN,MAAM;WACH,QAAQ,CAAC,EAAE;WACX,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;WACtC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;WACpC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC,CACjE,CAAC;AACH,CAAC;AACD,KAAK,UAAU,gBAAgB,CAAC,IAAiB,EAAE,GAAY,EAAE,OAA0B;IAC1F,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;IAC5C,MAAM,UAAU,GAAG,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC;IACjD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACtI,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACjI,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;AAC5D,CAAC;AACD,KAAK,UAAU,YAAY,CAAC,IAAiB,EAAE,GAAY,EAAE,OAA0B;IACtF,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,uBAAuB,CAAC;IAC5G,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,cAAc,EAAE,CAAC;QACpB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7D,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO,cAAc,IAAI,QAAQ,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9H,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,IAAiB,EAAE,OAA0B;IACxE,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAChC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1B,OAAO,kBAAkB,CAAC,OAAO,CAChC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CACpE,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,gCAAgC,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAClG,CACD,CAAC;IACH,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,2CAA2C,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAClI,CACD,CAAC;AACH,CAAC"}

package/dist/server/better-auth/mountedSessions.d.ts

@@ -0,0 +1,15 @@
+import type { RoleSet } from "@shivaedev/access/roleSet.ts";
+import { type GetSession } from "#server/adapters/betterAuthSessions.ts";
+import type { SessionShape } from "#server/session.ts";
+export declare function mountedSessions(lookup: (headers: Headers) => Promise<unknown>, admit: <TSession extends SessionShape>(getSession: GetSession<TSession>) => GetSession<TSession>, roles?: RoleSet): {
+    roles?: RoleSet;
+    provider: import("#server/session.ts").SessionProvider<{
+        readonly user: {
+            readonly email: string;
+            readonly id: string;
+            readonly name: string;
+            readonly role?: string | null;
+        };
+    }>;
+};
+//# sourceMappingURL=mountedSessions.d.ts.map

package/dist/server/better-auth/mountedSessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mountedSessions.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/mountedSessions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAsB,KAAK,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAC7F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAQvD,wBAAgB,eAAe,CAC9B,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,EAC9C,KAAK,EAAE,CAAC,QAAQ,SAAS,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,QAAQ,CAAC,EAChG,KAAK,CAAC,EAAE,OAAO;;;;;;;;;;EAMf"}

package/dist/server/better-auth/mountedSessions.js

@@ -0,0 +1,12 @@
+import { Schema } from "effect";
+import { betterAuthSessions } from "#server/adapters/betterAuthSessions.ts";
+const AuthSession = Schema.NullOr(Schema.Struct({
+    user: Schema.Struct({ email: Schema.String, id: Schema.String, name: Schema.String, role: Schema.optionalKey(Schema.NullOr(Schema.String)) }),
+}));
+export function mountedSessions(lookup, admit, roles) {
+    return {
+        ...(roles === undefined ? {} : { roles }),
+        provider: betterAuthSessions(admit(async (headers) => Schema.decodeUnknownSync(AuthSession)(await lookup(headers)))),
+    };
+}
+//# sourceMappingURL=mountedSessions.js.map

package/dist/server/better-auth/mountedSessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mountedSessions.js","sourceRoot":"","sources":["../../../src/server/better-auth/mountedSessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,EAAE,kBAAkB,EAAmB,MAAM,wCAAwC,CAAC;AAG7F,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAChC,MAAM,CAAC,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;CAC7I,CAAC,CACF,CAAC;AAEF,MAAM,UAAU,eAAe,CAC9B,MAA8C,EAC9C,KAAgG,EAChG,KAAe;IAEf,OAAO;QACN,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;KACpH,CAAC;AACH,CAAC"}

package/dist/server/better-auth/revokeUnadmitted.d.ts

@@ -0,0 +1,10 @@
+import { type Config, Effect } from "effect";
+import type { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
+import { type PolicyStorage, type SignInGate } from "#server/better-auth/signInGate.ts";
+export interface RevokedSessions {
+    readonly sessions: number;
+    readonly users: number;
+}
+export type RevokeUnadmitted<E> = Effect.Effect<RevokedSessions, E | Config.ConfigError | AuthUnavailable>;
+export declare const revokeUnadmitted: <E>(gate: SignInGate<E>, storage: () => Promise<PolicyStorage>) => Effect.Effect<RevokedSessions, E | AuthUnavailable | Config.ConfigError, never>;
+//# sourceMappingURL=revokeUnadmitted.d.ts.map

package/dist/server/better-auth/revokeUnadmitted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revokeUnadmitted.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/revokeUnadmitted.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAe,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAErG,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,GAAG,eAAe,CAAC,CAAC;AAI3G,eAAO,MAAM,gBAAgB,GAAgC,CAAC,sCAE9C,OAAO,CAAC,aAAa,CAAC,oFAyBpC,CAAC"}

package/dist/server/better-auth/revokeUnadmitted.js

@@ -0,0 +1,29 @@
+import { Effect } from "effect";
+import { fromStorage } from "#server/better-auth/signInGate.ts";
+const PAGE_SIZE = 100;
+export const revokeUnadmitted = Effect.fnUntraced(function* (gate, storage) {
+    if (!gate.active) {
+        return { sessions: 0, users: 0 };
+    }
+    const auth = yield* fromStorage(storage);
+    const revoked = [];
+    for (let offset = 0;; offset += PAGE_SIZE) {
+        const users = yield* fromStorage(() => auth.internalAdapter.listUsers(PAGE_SIZE, offset, { direction: "asc", field: "id" }));
+        for (const { id } of users) {
+            if (!(yield* gate.admitsUser(auth, id))) {
+                const sessions = Number(yield* fromStorage(() => auth.adapter.count({ model: "session", where: [{ field: "userId", value: id }] })));
+                if (sessions > 0) {
+                    revoked.push({ sessions, userId: id });
+                }
+            }
+        }
+        if (users.length < PAGE_SIZE) {
+            break;
+        }
+    }
+    for (const { userId } of revoked) {
+        yield* fromStorage(() => auth.internalAdapter.deleteUserSessions(userId));
+    }
+    return { sessions: revoked.reduce((total, user) => total + user.sessions, 0), users: revoked.length };
+});
+//# sourceMappingURL=revokeUnadmitted.js.map

package/dist/server/better-auth/revokeUnadmitted.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revokeUnadmitted.js","sourceRoot":"","sources":["../../../src/server/better-auth/revokeUnadmitted.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAuC,MAAM,mCAAmC,CAAC;AASrG,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAC1D,IAAmB,EACnB,OAAqC;IAErC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAA4B,CAAC;IAC5D,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,OAAO,GAAkE,EAAE,CAAC;IAClF,KAAK,IAAI,MAAM,GAAG,CAAC,GAAI,MAAM,IAAI,SAAS,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7H,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrI,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;oBAClB,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;gBACxC,CAAC;YACF,CAAC;QACF,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YAC9B,MAAM;QACP,CAAC;IACF,CAAC;IACD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QAClC,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAA4B,CAAC;AACjI,CAAC,CAAC,CAAC"}

package/dist/server/better-auth/sessionPermissions.d.ts

@@ -0,0 +1,3 @@
+import type { RoleSet } from "@shivaedev/access/roleSet.ts";
+export declare function sessionPermissions(response: Response, roles: RoleSet): Promise<Response>;
+//# sourceMappingURL=sessionPermissions.d.ts.map

package/dist/server/better-auth/sessionPermissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionPermissions.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/sessionPermissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAM5D,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAU9F"}

package/dist/server/better-auth/sessionPermissions.js

@@ -0,0 +1,16 @@
+import { Effect, Schema } from "effect";
+import { resolveRole } from "#server/resolveRole.ts";
+const Fields = Schema.Record(Schema.String, Schema.Unknown);
+const SessionPayload = Schema.NullOr(Schema.StructWithRest(Schema.Struct({ user: Fields }), [Fields]));
+export async function sessionPermissions(response, roles) {
+    const payload = Schema.decodeUnknownSync(SessionPayload)(await response.json());
+    if (payload === null) {
+        return Response.json(null, response);
+    }
+    const access = await Effect.runPromise(resolveRole(roles, payload.user.role));
+    const headers = new Headers(response.headers);
+    headers.delete("content-length");
+    headers.set("cache-control", "private, no-store");
+    return Response.json({ ...payload, user: { ...payload.user, ...access } }, { headers, status: response.status });
+}
+//# sourceMappingURL=sessionPermissions.js.map

package/dist/server/better-auth/sessionPermissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionPermissions.js","sourceRoot":"","sources":["../../../src/server/better-auth/sessionPermissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;AAC5D,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAEvG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAkB,EAAE,KAAc;IAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;AAClH,CAAC"}