@shivaedev/identity 0.1.0 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -2
- package/dist/server/better-auth/clientIp.d.ts +8 -0
- package/dist/server/better-auth/clientIp.d.ts.map +1 -0
- package/dist/server/better-auth/clientIp.js +28 -0
- package/dist/server/better-auth/clientIp.js.map +1 -0
- package/dist/server/better-auth/mount.d.ts +1 -1
- package/dist/server/better-auth/mount.d.ts.map +1 -1
- package/dist/server/better-auth/mount.js +6 -6
- package/dist/server/better-auth/mount.js.map +1 -1
- package/dist/server/better-auth/mountRoutes.d.ts +1 -0
- package/dist/server/better-auth/mountRoutes.d.ts.map +1 -1
- package/dist/server/better-auth/mountRoutes.js +4 -7
- package/dist/server/better-auth/mountRoutes.js.map +1 -1
- package/package.json +5 -5
- package/src/server/better-auth/clientIp.ts +34 -0
- package/src/server/better-auth/mount.ts +7 -6
- package/src/server/better-auth/mountRoutes.ts +5 -7
package/README.md
CHANGED
|
@@ -109,11 +109,11 @@ const authentication = Effect.gen(function* () {
|
|
|
109
109
|
|
|
110
110
|
Run this Effect in the host's scope. The pool logs idle-client errors at Debug and replaces failed connections on the next query; closing the scope disconnects its clients. A rejected auth handler returns HTTP 503 with `Authentication is temporarily unavailable`.
|
|
111
111
|
|
|
112
|
-
The mount reads `BETTER_AUTH_SECRET` unless options supply `secret`. `PUBLIC_URL` supplies the default base URL, trusted origin and HTTPS secure-cookie setting
|
|
112
|
+
The mount reads `BETTER_AUTH_SECRET` unless options supply `secret`. `PUBLIC_URL` supplies the default base URL, trusted origin and HTTPS secure-cookie setting. With it unset, `baseURL.allowedHosts` defaults to `["127.0.0.1:*", "localhost:*"]` over HTTP and `trustedOrigins` defaults to `["http://127.0.0.1:*", "http://localhost:*"]`, accepting both loopback names on any port through a development proxy. Explicit `baseURL` (including `baseURL.allowedHosts`) and `trustedOrigins` options each replace their corresponding default; their lists are not merged. RPC Origin policy remains an application choice.
|
|
113
113
|
|
|
114
114
|
`AUTH_RATE_LIMIT_ENABLED` is a Config boolean that defaults to true and takes precedence over `options.rateLimit.enabled`. Each mount owns scoped in-memory buckets when `storage` is unset or `"memory"`. Application `customStorage`, `"database"` and `"secondary-storage"` selections pass through; Better Auth chooses the rules and client-IP keys.
|
|
115
115
|
|
|
116
|
-
`TRUSTED_PROXY` supplies the same address and CIDR policy used by the host. An untrusted transport peer loses `x-forwarded-for` and the configured client-IP header before Better Auth sees the request. `AUTH_CLIENT_IP_HEADER` defaults to `x-forwarded-for`.
|
|
116
|
+
`TRUSTED_PROXY` supplies the same address and CIDR policy used by the host. An untrusted transport peer loses `x-forwarded-for` and the configured client-IP header before Better Auth sees the request. `AUTH_CLIENT_IP_HEADER` defaults to `x-forwarded-for`. Without a trusted proxy, auth rate limiting uses the connection peer address, so different peers have separate buckets and Better Auth receives a client IP without a missing-IP warning. A trusted peer's configured forwarded header takes precedence over the peer address.
|
|
117
117
|
|
|
118
118
|
For email sign-in through `appHost`, the session record's `ipAddress` follows the same rule. With a trusted peer, `AUTH_CLIENT_IP_HEADER=x-real-ip` stores `X-Real-IP` even if `X-Forwarded-For` supplies a different address; the default header selects the rightmost untrusted address in the `X-Forwarded-For` chain, ignoring trusted proxy hops on the right. With an untrusted peer, neither header can supply the stored address. Sign-in attempts from an untrusted peer share one bucket per path; with a trusted peer and `x-real-ip`, changing `X-Forwarded-For` does not change the bucket, while changing `X-Real-IP` does.
|
|
119
119
|
|
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
import type { HttpServerRequest } from "effect/http";
|
|
2
|
+
export declare const PEER_IP_HEADER = "x-platform-client-ip";
|
|
3
|
+
export declare function clientIpHeaders(options: {
|
|
4
|
+
readonly clientIpHeader: string;
|
|
5
|
+
readonly ipv6Subnet?: number | undefined;
|
|
6
|
+
readonly trustedProxy?: string | undefined;
|
|
7
|
+
}): (request: HttpServerRequest.HttpServerRequest, web: Request) => void;
|
|
8
|
+
//# sourceMappingURL=clientIp.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"clientIp.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/clientIp.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGrD,eAAO,MAAM,cAAc,yBAAyB,CAAC;AAErD,wBAAgB,eAAe,CAAC,OAAO,EAAE;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C,aASiB,iBAAiB,CAAC,iBAAiB,OAAO,OAAO,UAalE"}
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
import { getIP } from "better-auth/api";
|
|
2
|
+
import { Option } from "effect";
|
|
3
|
+
import { trustedProxyPeer, trustedProxyRanges } from "#server/local.ts";
|
|
4
|
+
export const PEER_IP_HEADER = "x-platform-client-ip";
|
|
5
|
+
export function clientIpHeaders(options) {
|
|
6
|
+
const trustedPeer = trustedProxyPeer(options.trustedProxy);
|
|
7
|
+
const advanced = {
|
|
8
|
+
ipAddress: {
|
|
9
|
+
ipAddressHeaders: [options.clientIpHeader],
|
|
10
|
+
...(options.ipv6Subnet === undefined ? {} : { ipv6Subnet: options.ipv6Subnet }),
|
|
11
|
+
trustedProxies: trustedProxyRanges(options.trustedProxy),
|
|
12
|
+
},
|
|
13
|
+
};
|
|
14
|
+
return (request, web) => {
|
|
15
|
+
web.headers.delete(PEER_IP_HEADER);
|
|
16
|
+
const trusted = Option.exists(request.remoteAddress, trustedPeer);
|
|
17
|
+
const forwardedIp = trusted ? getIP(web, { advanced }) : null;
|
|
18
|
+
if (!trusted) {
|
|
19
|
+
web.headers.delete("x-forwarded-for");
|
|
20
|
+
web.headers.delete(options.clientIpHeader);
|
|
21
|
+
}
|
|
22
|
+
const address = forwardedIp ?? Option.getOrUndefined(request.remoteAddress);
|
|
23
|
+
if (address !== undefined) {
|
|
24
|
+
web.headers.set(PEER_IP_HEADER, address);
|
|
25
|
+
}
|
|
26
|
+
};
|
|
27
|
+
}
|
|
28
|
+
//# sourceMappingURL=clientIp.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"clientIp.js","sourceRoot":"","sources":["../../../src/server/better-auth/clientIp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAExE,MAAM,CAAC,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAErD,MAAM,UAAU,eAAe,CAAC,OAI/B;IACA,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG;QAChB,SAAS,EAAE;YACV,gBAAgB,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC;YAC1C,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;YAC/E,cAAc,EAAE,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC;SACxD;KACD,CAAC;IACF,OAAO,CAAC,OAA4C,EAAE,GAAY,EAAE,EAAE;QACrE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACtC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,IAAI,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;IACF,CAAC,CAAC;AACH,CAAC"}
|
|
@@ -47,7 +47,7 @@ export declare const betterAuthMount: <const TOptions extends BetterAuthOptions,
|
|
|
47
47
|
disableIpTracking?: boolean;
|
|
48
48
|
ipv6Subnet?: number;
|
|
49
49
|
ipAddressHeaders: string[];
|
|
50
|
-
trustedProxies:
|
|
50
|
+
trustedProxies: never[];
|
|
51
51
|
};
|
|
52
52
|
};
|
|
53
53
|
baseURL: import("better-auth").BaseURLConfig;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/mount.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,iBAAiB,EAAc,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAU,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAmB,KAAK,UAAU,EAAE,MAAM,IAAI,CAAC;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,KAAK,qBAAqB,EAAsC,MAAM,uCAAuC,CAAC;
|
|
1
|
+
{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/mount.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,iBAAiB,EAAc,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAU,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAmB,KAAK,UAAU,EAAE,MAAM,IAAI,CAAC;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,KAAK,qBAAqB,EAAsC,MAAM,uCAAuC,CAAC;AAIvH,OAAO,EAAE,KAAK,gBAAgB,EAAoB,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAsB,KAAK,YAAY,EAAc,MAAM,mCAAmC,CAAC;AAEtG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,MAAM,WAAW,sBAAsB,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK;IAC3D,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC;CACjD;AAED,eAAO,MAAM,eAAe,SAA0D,QAAQ,SAAS,iBAAiB,EAAE,CAAC,UAAU,CAAC;uBAwD3G,QAAQ,SAAS,YAAY,cAAc,UAAU,CAAC,QAAQ,CAAC,KAAG,UAAU,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAkC/G,CAAC;AAEH,eAAO,MAAM,YAAY,kKAgCvB,CAAC"}
|
|
@@ -2,12 +2,12 @@ import { betterAuth } from "better-auth";
|
|
|
2
2
|
import { Config, Effect, Option, Redacted } from "effect";
|
|
3
3
|
import { Pool } from "pg";
|
|
4
4
|
import { sessionHeaders, withBearerSessions } from "#server/better-auth/bearerSessions.ts";
|
|
5
|
+
import { PEER_IP_HEADER } from "#server/better-auth/clientIp.ts";
|
|
5
6
|
import { memoryRateLimit } from "#server/better-auth/memoryRateLimit.ts";
|
|
6
7
|
import { mountRoutes } from "#server/better-auth/mountRoutes.ts";
|
|
7
8
|
import { revokeUnadmitted } from "#server/better-auth/revokeUnadmitted.ts";
|
|
8
9
|
import { signInGate } from "#server/better-auth/signInGate.ts";
|
|
9
10
|
import { signInPolicyOptions } from "#server/better-auth/signInPolicy.ts";
|
|
10
|
-
import { trustedProxyRanges } from "#server/local.ts";
|
|
11
11
|
import { mountedSessions } from "./mountedSessions.js";
|
|
12
12
|
export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* (options, mount = {}) {
|
|
13
13
|
const secret = options.secret ?? Redacted.value(yield* Config.Redacted("BETTER_AUTH_SECRET"));
|
|
@@ -16,7 +16,6 @@ export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* (
|
|
|
16
16
|
const trustedProxy = Option.getOrUndefined(yield* Config.String("TRUSTED_PROXY").pipe(Config.option));
|
|
17
17
|
const clientIpHeader = yield* Config.String("AUTH_CLIENT_IP_HEADER").pipe(Config.withDefault("x-forwarded-for"));
|
|
18
18
|
const rateLimitEnabled = yield* Config.Boolean("AUTH_RATE_LIMIT_ENABLED").pipe(Config.withDefault(true));
|
|
19
|
-
const trustedProxies = trustedProxyRanges(trustedProxy);
|
|
20
19
|
const context = yield* Effect.context();
|
|
21
20
|
const run = Effect.runPromiseWith(context);
|
|
22
21
|
const policy = mount.signIn ?? {};
|
|
@@ -34,13 +33,13 @@ export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* (
|
|
|
34
33
|
...options.advanced,
|
|
35
34
|
ipAddress: {
|
|
36
35
|
...options.advanced?.ipAddress,
|
|
37
|
-
ipAddressHeaders:
|
|
38
|
-
trustedProxies,
|
|
36
|
+
ipAddressHeaders: [PEER_IP_HEADER],
|
|
37
|
+
trustedProxies: [],
|
|
39
38
|
},
|
|
40
39
|
},
|
|
41
40
|
"baseURL": options.baseURL
|
|
42
41
|
?? Option.getOrElse(origin, () => ({
|
|
43
|
-
allowedHosts: ["127.0.0.1:*"],
|
|
42
|
+
allowedHosts: ["127.0.0.1:*", "localhost:*"],
|
|
44
43
|
protocol: "http",
|
|
45
44
|
})),
|
|
46
45
|
databaseHooks: gate.active ? gated.databaseHooks : options.databaseHooks,
|
|
@@ -50,12 +49,13 @@ export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* (
|
|
|
50
49
|
enabled: rateLimitEnabled,
|
|
51
50
|
},
|
|
52
51
|
secret,
|
|
53
|
-
trustedOrigins: options.trustedOrigins ??
|
|
52
|
+
trustedOrigins: options.trustedOrigins ?? Option.match(origin, { onNone: () => ["http://127.0.0.1:*", "http://localhost:*"], onSome: (url) => [url] }),
|
|
54
53
|
user: gate.active ? gated.user : options.user,
|
|
55
54
|
});
|
|
56
55
|
const authRoutes = mountRoutes(auth, {
|
|
57
56
|
bearerSessions: mount.bearerSessions,
|
|
58
57
|
clientIpHeader,
|
|
58
|
+
ipv6Subnet: options.advanced?.ipAddress?.ipv6Subnet,
|
|
59
59
|
roles: mount.roles,
|
|
60
60
|
trustedProxy,
|
|
61
61
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mount.js","sourceRoot":"","sources":["../../../src/server/better-auth/mount.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,UAAU,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAoC,MAAM,IAAI,CAAC;AAG5D,OAAO,EAA8B,cAAc,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AACvH,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAyB,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAyC,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACtG,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;
|
|
1
|
+
{"version":3,"file":"mount.js","sourceRoot":"","sources":["../../../src/server/better-auth/mount.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,UAAU,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAoC,MAAM,IAAI,CAAC;AAG5D,OAAO,EAA8B,cAAc,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AACvH,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAyB,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAyC,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACtG,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE1E,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAQvD,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EAC7E,OAAiB,EACjB,KAAK,GAAiC,EAAE;IAExC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACtG,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjH,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAK,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAClC,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAA2B,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,aAAa,GAClB,SAAS,EAAE,aAAa,IAAI,CAAC,SAAS,EAAE,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvI,MAAM,IAAI,GAAG,UAAU,CAAC;QACvB,GAAG,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC;QAClE,QAAQ,EAAE;YACT,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ;YACnF,GAAG,OAAO,CAAC,QAAQ;YACnB,SAAS,EAAE;gBACV,GAAG,OAAO,CAAC,QAAQ,EAAE,SAAS;gBAC9B,gBAAgB,EAAE,CAAC,cAAc,CAAC;gBAClC,cAAc,EAAE,EAAE;aAClB;SACD;QACD,SAAS,EACR,OAAO,CAAC,OAAO;eACZ,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAClC,YAAY,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC;gBAC5C,QAAQ,EAAE,MAAe;aACzB,CAAC,CAAC;QACJ,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;QACxE,SAAS,EAAE;YACV,GAAG,SAAS;YACZ,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;YACzD,OAAO,EAAE,gBAAgB;SACzB;QACD,MAAM;QACN,cAAc,EACb,OAAO,CAAC,cAAc,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACvI,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI;KAC7C,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc;QACd,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU;QACnD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,YAAY;KACZ,CAAC,CAAC;IACH,SAAS,gBAAgB,CAAgC,UAAgC;QACxF,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACxD,OAAO,UAAU,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,OAAO,EAAE,EAAE,CAClB,GAAG,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACnB,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACvH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACtC,OAAO,OAAO,CAAC;YAChB,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACtD,OAAO,OAAO,CAAC;YAChB,CAAC;YACD,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5F,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7H,OAAO,IAAI,CAAC;QACb,CAAC,CAAC,CACF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAwB,MAAM,CAAC,cAAc,CACxD,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC3C,OAAO,CACP,CAAC;IACF,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,eAAe,CAC/B,CAAC,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EACrH,gBAAgB,EAChB,KAAK,CAAC,KAAK,CACX,CAAC;IACF,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EACvE,GAA8B,EAC9B,OAAO,GAAiD,EAAE;IAE1D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAc,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAClC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QAChB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;YACrB,GAAG,OAAO;YACV,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,GAAG,CACF,MAAM,CAAC,QAAQ,CAAC;gBACf,KAAK,EAAE,kCAAkC;gBACzC,OAAO,EAAE,KAAK,CAAC,OAAO;aACtB,CAAC,CACF,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,EACF,CAAC,IAAI,EAAE,EAAE,CACR,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;QACzB,gEAAgE;QAChE,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/G,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC,CAAC,CACH,CAAC;AACH,CAAC,CAAC,CAAC"}
|
|
@@ -14,6 +14,7 @@ interface MountedAuth {
|
|
|
14
14
|
interface MountRouteOptions {
|
|
15
15
|
readonly bearerSessions?: BearerSessionsOptions | undefined;
|
|
16
16
|
readonly clientIpHeader: string;
|
|
17
|
+
readonly ipv6Subnet?: number | undefined;
|
|
17
18
|
readonly roles?: RoleSet | undefined;
|
|
18
19
|
readonly trustedProxy?: string | undefined;
|
|
19
20
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mountRoutes.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/mountRoutes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAyC,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAE5D,OAAO,EAAE,KAAK,qBAAqB,EAA2D,MAAM,uCAAuC,CAAC;AAI5I,UAAU,WAAW;IACpB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAAE,QAAQ,CAAC,WAAW,EAAE;YAAE,QAAQ,CAAC,YAAY,EAAE;gBAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IAC3G,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC1D;AACD,UAAU,iBAAiB;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAuCD,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,
|
|
1
|
+
{"version":3,"file":"mountRoutes.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/mountRoutes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAyC,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAE5D,OAAO,EAAE,KAAK,qBAAqB,EAA2D,MAAM,uCAAuC,CAAC;AAI5I,UAAU,WAAW;IACpB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAAE,QAAQ,CAAC,WAAW,EAAE;YAAE,QAAQ,CAAC,YAAY,EAAE;gBAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IAC3G,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC1D;AACD,UAAU,iBAAiB;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAuCD,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,qEAexE"}
|
|
@@ -1,8 +1,8 @@
|
|
|
1
|
-
import { Effect
|
|
1
|
+
import { Effect } from "effect";
|
|
2
2
|
import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
|
|
3
3
|
import { redact } from "@shivaedev/errors/redact.ts";
|
|
4
4
|
import { cookieSessionResponse, hasSessionCookie, sessionHeaders } from "#server/better-auth/bearerSessions.ts";
|
|
5
|
-
import {
|
|
5
|
+
import { clientIpHeaders } from "./clientIp.js";
|
|
6
6
|
import { sessionPermissions } from "./sessionPermissions.js";
|
|
7
7
|
function replacesSession(request, response, native) {
|
|
8
8
|
return (native
|
|
@@ -41,13 +41,10 @@ async function authResponse(auth, web, options) {
|
|
|
41
41
|
return sessionRequest && response.ok && options.roles !== undefined ? sessionPermissions(response, options.roles) : response;
|
|
42
42
|
}
|
|
43
43
|
export function mountRoutes(auth, options) {
|
|
44
|
-
const
|
|
44
|
+
const setClientIp = clientIpHeaders(options);
|
|
45
45
|
return HttpRouter.use((router) => router.add("*", "/api/auth/*", (request) => Effect.gen(function* () {
|
|
46
46
|
const web = yield* HttpServerRequest.toWeb(request);
|
|
47
|
-
|
|
48
|
-
web.headers.delete("x-forwarded-for");
|
|
49
|
-
web.headers.delete(options.clientIpHeader);
|
|
50
|
-
}
|
|
47
|
+
setClientIp(request, web);
|
|
51
48
|
return HttpServerResponse.fromWeb(yield* Effect.tryPromise(() => authResponse(auth, web, options)).pipe(Effect.tapError((error) => Effect.logError("Authentication provider failed", redact(error.cause)))));
|
|
52
49
|
}).pipe(Effect.catch(() => Effect.succeed(HttpServerResponse.text("Authentication is temporarily unavailable", { status: 503 }))))));
|
|
53
50
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mountRoutes.js","sourceRoot":"","sources":["../../../src/server/better-auth/mountRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"mountRoutes.js","sourceRoot":"","sources":["../../../src/server/better-auth/mountRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAA8B,qBAAqB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5I,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAa7D,SAAS,eAAe,CAAC,OAAgB,EAAE,QAAkB,EAAE,MAAe;IAC7E,OAAO,CACN,MAAM;WACH,QAAQ,CAAC,EAAE;WACX,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;WACtC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;WACpC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC,CACjE,CAAC;AACH,CAAC;AACD,KAAK,UAAU,gBAAgB,CAAC,IAAiB,EAAE,GAAY,EAAE,OAA0B;IAC1F,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;IAC5C,MAAM,UAAU,GAAG,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC;IACjD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACtI,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACjI,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;AAC5D,CAAC;AACD,KAAK,UAAU,YAAY,CAAC,IAAiB,EAAE,GAAY,EAAE,OAA0B;IACtF,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,uBAAuB,CAAC;IAC5G,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,cAAc,EAAE,CAAC;QACpB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7D,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO,cAAc,IAAI,QAAQ,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9H,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,IAAiB,EAAE,OAA0B;IACxE,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAChC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1B,OAAO,kBAAkB,CAAC,OAAO,CAChC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CACpE,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,gCAAgC,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAClG,CACD,CAAC;IACH,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,2CAA2C,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAClI,CACD,CAAC;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@shivaedev/identity",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.2.0",
|
|
4
4
|
"description": "Request identity, sessions, transport trust and permission enforcement for Effect RPC servers",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"effect"
|
|
@@ -45,16 +45,16 @@
|
|
|
45
45
|
],
|
|
46
46
|
"dependencies": {
|
|
47
47
|
"@shivaedev/access": "0.1.1",
|
|
48
|
-
"@shivaedev/contract": "0.
|
|
48
|
+
"@shivaedev/contract": "0.18.0",
|
|
49
49
|
"@shivaedev/errors": "0.1.0",
|
|
50
|
-
"@shivaedev/sql": "0.
|
|
50
|
+
"@shivaedev/sql": "0.23.0"
|
|
51
51
|
},
|
|
52
52
|
"devDependencies": {
|
|
53
53
|
"@effect/platform-node": "4.0.5",
|
|
54
54
|
"@effect/sql-pg": "4.0.5",
|
|
55
55
|
"@shivaedev/quality": "0.42.0",
|
|
56
|
-
"@shivaedev/test-sql": "0.10.
|
|
57
|
-
"@shivaedev/test-story": "0.21.
|
|
56
|
+
"@shivaedev/test-sql": "0.10.1",
|
|
57
|
+
"@shivaedev/test-story": "0.21.1",
|
|
58
58
|
"@types/node": "24.19.2",
|
|
59
59
|
"@types/pg": "8.20.0",
|
|
60
60
|
"better-auth": "1.7.11",
|
|
@@ -0,0 +1,34 @@
|
|
|
1
|
+
import { getIP } from "better-auth/api";
|
|
2
|
+
import { Option } from "effect";
|
|
3
|
+
import type { HttpServerRequest } from "effect/http";
|
|
4
|
+
import { trustedProxyPeer, trustedProxyRanges } from "#server/local.ts";
|
|
5
|
+
|
|
6
|
+
export const PEER_IP_HEADER = "x-platform-client-ip";
|
|
7
|
+
|
|
8
|
+
export function clientIpHeaders(options: {
|
|
9
|
+
readonly clientIpHeader: string;
|
|
10
|
+
readonly ipv6Subnet?: number | undefined;
|
|
11
|
+
readonly trustedProxy?: string | undefined;
|
|
12
|
+
}) {
|
|
13
|
+
const trustedPeer = trustedProxyPeer(options.trustedProxy);
|
|
14
|
+
const advanced = {
|
|
15
|
+
ipAddress: {
|
|
16
|
+
ipAddressHeaders: [options.clientIpHeader],
|
|
17
|
+
...(options.ipv6Subnet === undefined ? {} : { ipv6Subnet: options.ipv6Subnet }),
|
|
18
|
+
trustedProxies: trustedProxyRanges(options.trustedProxy),
|
|
19
|
+
},
|
|
20
|
+
};
|
|
21
|
+
return (request: HttpServerRequest.HttpServerRequest, web: Request) => {
|
|
22
|
+
web.headers.delete(PEER_IP_HEADER);
|
|
23
|
+
const trusted = Option.exists(request.remoteAddress, trustedPeer);
|
|
24
|
+
const forwardedIp = trusted ? getIP(web, { advanced }) : null;
|
|
25
|
+
if (!trusted) {
|
|
26
|
+
web.headers.delete("x-forwarded-for");
|
|
27
|
+
web.headers.delete(options.clientIpHeader);
|
|
28
|
+
}
|
|
29
|
+
const address = forwardedIp ?? Option.getOrUndefined(request.remoteAddress);
|
|
30
|
+
if (address !== undefined) {
|
|
31
|
+
web.headers.set(PEER_IP_HEADER, address);
|
|
32
|
+
}
|
|
33
|
+
};
|
|
34
|
+
}
|
|
@@ -4,12 +4,12 @@ import { Pool, type PoolClient, type PoolConfig } from "pg";
|
|
|
4
4
|
import type { RoleSet } from "@shivaedev/access/roleSet.ts";
|
|
5
5
|
import type { GetSession } from "#server/adapters/betterAuthSessions.ts";
|
|
6
6
|
import { type BearerSessionsOptions, sessionHeaders, withBearerSessions } from "#server/better-auth/bearerSessions.ts";
|
|
7
|
+
import { PEER_IP_HEADER } from "#server/better-auth/clientIp.ts";
|
|
7
8
|
import { memoryRateLimit } from "#server/better-auth/memoryRateLimit.ts";
|
|
8
9
|
import { mountRoutes } from "#server/better-auth/mountRoutes.ts";
|
|
9
10
|
import { type RevokeUnadmitted, revokeUnadmitted } from "#server/better-auth/revokeUnadmitted.ts";
|
|
10
11
|
import { type PolicyStorage, type SignInPolicy, signInGate } from "#server/better-auth/signInGate.ts";
|
|
11
12
|
import { signInPolicyOptions } from "#server/better-auth/signInPolicy.ts";
|
|
12
|
-
import { trustedProxyRanges } from "#server/local.ts";
|
|
13
13
|
import type { SessionShape } from "#server/session.ts";
|
|
14
14
|
import { mountedSessions } from "./mountedSessions.ts";
|
|
15
15
|
|
|
@@ -29,7 +29,6 @@ export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* <
|
|
|
29
29
|
const trustedProxy = Option.getOrUndefined(yield* Config.String("TRUSTED_PROXY").pipe(Config.option));
|
|
30
30
|
const clientIpHeader = yield* Config.String("AUTH_CLIENT_IP_HEADER").pipe(Config.withDefault("x-forwarded-for"));
|
|
31
31
|
const rateLimitEnabled = yield* Config.Boolean("AUTH_RATE_LIMIT_ENABLED").pipe(Config.withDefault(true));
|
|
32
|
-
const trustedProxies = trustedProxyRanges(trustedProxy);
|
|
33
32
|
const context = yield* Effect.context<R>();
|
|
34
33
|
const run = Effect.runPromiseWith(context);
|
|
35
34
|
const policy = mount.signIn ?? {};
|
|
@@ -48,14 +47,14 @@ export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* <
|
|
|
48
47
|
...options.advanced,
|
|
49
48
|
ipAddress: {
|
|
50
49
|
...options.advanced?.ipAddress,
|
|
51
|
-
ipAddressHeaders:
|
|
52
|
-
trustedProxies,
|
|
50
|
+
ipAddressHeaders: [PEER_IP_HEADER],
|
|
51
|
+
trustedProxies: [],
|
|
53
52
|
},
|
|
54
53
|
},
|
|
55
54
|
"baseURL":
|
|
56
55
|
options.baseURL
|
|
57
56
|
?? Option.getOrElse(origin, () => ({
|
|
58
|
-
allowedHosts: ["127.0.0.1:*"],
|
|
57
|
+
allowedHosts: ["127.0.0.1:*", "localhost:*"],
|
|
59
58
|
protocol: "http" as const,
|
|
60
59
|
})),
|
|
61
60
|
databaseHooks: gate.active ? gated.databaseHooks : options.databaseHooks,
|
|
@@ -65,12 +64,14 @@ export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* <
|
|
|
65
64
|
enabled: rateLimitEnabled,
|
|
66
65
|
},
|
|
67
66
|
secret,
|
|
68
|
-
trustedOrigins:
|
|
67
|
+
trustedOrigins:
|
|
68
|
+
options.trustedOrigins ?? Option.match(origin, { onNone: () => ["http://127.0.0.1:*", "http://localhost:*"], onSome: (url) => [url] }),
|
|
69
69
|
user: gate.active ? gated.user : options.user,
|
|
70
70
|
});
|
|
71
71
|
const authRoutes = mountRoutes(auth, {
|
|
72
72
|
bearerSessions: mount.bearerSessions,
|
|
73
73
|
clientIpHeader,
|
|
74
|
+
ipv6Subnet: options.advanced?.ipAddress?.ipv6Subnet,
|
|
74
75
|
roles: mount.roles,
|
|
75
76
|
trustedProxy,
|
|
76
77
|
});
|
|
@@ -1,9 +1,9 @@
|
|
|
1
|
-
import { Effect
|
|
1
|
+
import { Effect } from "effect";
|
|
2
2
|
import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
|
|
3
3
|
import type { RoleSet } from "@shivaedev/access/roleSet.ts";
|
|
4
4
|
import { redact } from "@shivaedev/errors/redact.ts";
|
|
5
5
|
import { type BearerSessionsOptions, cookieSessionResponse, hasSessionCookie, sessionHeaders } from "#server/better-auth/bearerSessions.ts";
|
|
6
|
-
import {
|
|
6
|
+
import { clientIpHeaders } from "./clientIp.ts";
|
|
7
7
|
import { sessionPermissions } from "./sessionPermissions.ts";
|
|
8
8
|
|
|
9
9
|
interface MountedAuth {
|
|
@@ -13,6 +13,7 @@ interface MountedAuth {
|
|
|
13
13
|
interface MountRouteOptions {
|
|
14
14
|
readonly bearerSessions?: BearerSessionsOptions | undefined;
|
|
15
15
|
readonly clientIpHeader: string;
|
|
16
|
+
readonly ipv6Subnet?: number | undefined;
|
|
16
17
|
readonly roles?: RoleSet | undefined;
|
|
17
18
|
readonly trustedProxy?: string | undefined;
|
|
18
19
|
}
|
|
@@ -55,15 +56,12 @@ async function authResponse(auth: MountedAuth, web: Request, options: MountRoute
|
|
|
55
56
|
return sessionRequest && response.ok && options.roles !== undefined ? sessionPermissions(response, options.roles) : response;
|
|
56
57
|
}
|
|
57
58
|
export function mountRoutes(auth: MountedAuth, options: MountRouteOptions) {
|
|
58
|
-
const
|
|
59
|
+
const setClientIp = clientIpHeaders(options);
|
|
59
60
|
return HttpRouter.use((router) =>
|
|
60
61
|
router.add("*", "/api/auth/*", (request) =>
|
|
61
62
|
Effect.gen(function* () {
|
|
62
63
|
const web = yield* HttpServerRequest.toWeb(request);
|
|
63
|
-
|
|
64
|
-
web.headers.delete("x-forwarded-for");
|
|
65
|
-
web.headers.delete(options.clientIpHeader);
|
|
66
|
-
}
|
|
64
|
+
setClientIp(request, web);
|
|
67
65
|
return HttpServerResponse.fromWeb(
|
|
68
66
|
yield* Effect.tryPromise(() => authResponse(auth, web, options)).pipe(
|
|
69
67
|
Effect.tapError((error) => Effect.logError("Authentication provider failed", redact(error.cause))),
|