@silicajs/auth 0.1.0

package/README.md

@@ -0,0 +1,12 @@
+# @silicajs/auth
+
+Better Auth wrapper for Silica.
+
+Provides:
+
+- Google provider configuration from environment variables
+- stateless cookie-cache session configuration using JWE
+- OAuth callback allowlist enforcement
+- request/session helpers for generated `proxy.ts`
+
+Silica auth is optional; sites without an `auth` config remain public.

package/dist/index.d.ts

@@ -0,0 +1,61 @@
+import * as better_auth from 'better-auth';
+import { Session, User } from 'better-auth';
+import * as better_call from 'better-call';
+
+type AllowlistConfig = {
+    allowedEmails?: string[];
+    allowedDomains?: string[];
+};
+declare function isEmailAllowed(email: string | undefined | null, config: AllowlistConfig): boolean;
+declare function hasAllowlist(config: AllowlistConfig): boolean;
+
+type SilicaSession = {
+    session: Session & Record<string, unknown>;
+    user: User & Record<string, unknown>;
+    updatedAt: number;
+    version?: string;
+};
+type SilicaSessionOptions = AllowlistConfig & {
+    secret?: string;
+    strategy?: "compact" | "jwt" | "jwe";
+};
+declare function getSilicaSession(request: Request | Headers, options?: SilicaSessionOptions): Promise<SilicaSession | null>;
+declare function hasSilicaSessionCookie(request: Request | Headers): boolean;
+declare function isSilicaRequestAllowed(request: Request | Headers, options?: SilicaSessionOptions): Promise<boolean>;
+
+type SilicaAuthOptions = AllowlistConfig & {
+    baseURL?: string;
+    secret?: string;
+    googleClientId?: string;
+    googleClientSecret?: string;
+};
+declare function silicaAuth(options?: SilicaAuthOptions): better_auth.Auth<{
+    baseURL: string | undefined;
+    secret: string | undefined;
+    socialProviders: {
+        google: {
+            clientId: string;
+            clientSecret: string;
+        };
+    };
+    session: {
+        cookieCache: {
+            enabled: true;
+            maxAge: number;
+            strategy: "jwe";
+            refreshCache: true;
+        };
+    };
+    account: {
+        storeAccountCookie: true;
+        storeStateStrategy: "cookie";
+        accountLinking: {
+            enabled: false;
+        };
+    };
+    hooks: {
+        after: (inputContext: better_call.MiddlewareInputContext<better_call.MiddlewareOptions>) => Promise<void>;
+    };
+}>;
+
+export { type AllowlistConfig, type SilicaAuthOptions, type SilicaSession, type SilicaSessionOptions, getSilicaSession, hasAllowlist, hasSilicaSessionCookie, isEmailAllowed, isSilicaRequestAllowed, silicaAuth };

package/dist/index.js

@@ -0,0 +1,95 @@
+// src/index.ts
+import { betterAuth } from "better-auth";
+import { APIError, createAuthMiddleware } from "better-auth/api";
+
+// src/allowlist.ts
+function isEmailAllowed(email, config) {
+  if (!email) return false;
+  const normalized = email.trim().toLowerCase();
+  const allowedEmails = new Set((config.allowedEmails ?? []).map((item) => item.trim().toLowerCase()));
+  if (allowedEmails.has(normalized)) return true;
+  return (config.allowedDomains ?? []).some((domain) => {
+    const normalizedDomain = domain.trim().replace(/^@/, "").toLowerCase();
+    return normalized.endsWith(`@${normalizedDomain}`);
+  });
+}
+function hasAllowlist(config) {
+  return Boolean(config.allowedEmails?.length || config.allowedDomains?.length);
+}
+
+// src/session.ts
+import { getCookieCache, getSessionCookie } from "better-auth/cookies";
+async function getSilicaSession(request, options = {}) {
+  try {
+    return await getCookieCache(request, {
+      secret: options.secret ?? process.env.BETTER_AUTH_SECRET,
+      strategy: options.strategy ?? "jwe"
+    });
+  } catch {
+    return null;
+  }
+}
+function hasSilicaSessionCookie(request) {
+  return Boolean(getSessionCookie(request));
+}
+async function isSilicaRequestAllowed(request, options = {}) {
+  const session = await getSilicaSession(request, options);
+  if (!session) return false;
+  if (!hasAllowlist(options)) return true;
+  return isEmailAllowed(session.user.email, options);
+}
+
+// src/index.ts
+function silicaAuth(options = {}) {
+  const allowlist = {
+    allowedDomains: options.allowedDomains ?? [],
+    allowedEmails: options.allowedEmails ?? []
+  };
+  return betterAuth({
+    baseURL: options.baseURL ?? process.env.BETTER_AUTH_URL,
+    secret: options.secret ?? process.env.BETTER_AUTH_SECRET,
+    socialProviders: {
+      google: {
+        clientId: options.googleClientId ?? process.env.GOOGLE_CLIENT_ID ?? "",
+        clientSecret: options.googleClientSecret ?? process.env.GOOGLE_CLIENT_SECRET ?? ""
+      }
+    },
+    session: {
+      cookieCache: {
+        enabled: true,
+        maxAge: 7 * 24 * 60 * 60,
+        strategy: "jwe",
+        refreshCache: true
+      }
+    },
+    account: {
+      storeAccountCookie: true,
+      storeStateStrategy: "cookie",
+      accountLinking: {
+        enabled: false
+      }
+    },
+    hooks: {
+      after: createAuthMiddleware(async (ctx) => {
+        if (!ctx.path.includes("/callback/")) return;
+        if (!hasAllowlist(allowlist)) return;
+        const email = ctx.context.newSession?.user.email ?? "";
+        if (!isEmailAllowed(email, allowlist)) {
+          throw new APIError("FORBIDDEN", {
+            message: "Email is not allowed to access this Silica site.",
+            redirectTo: "/not-allowed"
+          });
+        }
+      })
+    }
+  });
+}
+export {
+  getSilicaSession,
+  hasAllowlist,
+  hasSilicaSessionCookie,
+  isEmailAllowed,
+  isSilicaRequestAllowed,
+  silicaAuth
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/allowlist.ts","../src/session.ts"],"sourcesContent":["import { betterAuth } from \"better-auth\";\nimport { APIError, createAuthMiddleware } from \"better-auth/api\";\nimport type { AllowlistConfig } from \"./allowlist.js\";\nimport { hasAllowlist, isEmailAllowed } from \"./allowlist.js\";\n\nexport type SilicaAuthOptions = AllowlistConfig & {\n  baseURL?: string;\n  secret?: string;\n  googleClientId?: string;\n  googleClientSecret?: string;\n};\n\nexport function silicaAuth(options: SilicaAuthOptions = {}) {\n  const allowlist = {\n    allowedDomains: options.allowedDomains ?? [],\n    allowedEmails: options.allowedEmails ?? [],\n  };\n\n  return betterAuth({\n    baseURL: options.baseURL ?? process.env.BETTER_AUTH_URL,\n    secret: options.secret ?? process.env.BETTER_AUTH_SECRET,\n    socialProviders: {\n      google: {\n        clientId: options.googleClientId ?? process.env.GOOGLE_CLIENT_ID ?? \"\",\n        clientSecret: options.googleClientSecret ?? process.env.GOOGLE_CLIENT_SECRET ?? \"\",\n      },\n    },\n    session: {\n      cookieCache: {\n        enabled: true,\n        maxAge: 7 * 24 * 60 * 60,\n        strategy: \"jwe\",\n        refreshCache: true,\n      },\n    },\n    account: {\n      storeAccountCookie: true,\n      storeStateStrategy: \"cookie\",\n      accountLinking: {\n        enabled: false,\n      },\n    },\n    hooks: {\n      after: createAuthMiddleware(async (ctx) => {\n        if (!ctx.path.includes(\"/callback/\")) return;\n        if (!hasAllowlist(allowlist)) return;\n\n        const email = ctx.context.newSession?.user.email ?? \"\";\n        if (!isEmailAllowed(email, allowlist)) {\n          throw new APIError(\"FORBIDDEN\", {\n            message: \"Email is not allowed to access this Silica site.\",\n            redirectTo: \"/not-allowed\",\n          });\n        }\n      }),\n    },\n  });\n}\n\nexport { hasAllowlist, isEmailAllowed };\nexport { getSilicaSession, hasSilicaSessionCookie, isSilicaRequestAllowed } from \"./session.js\";\nexport type { AllowlistConfig };\nexport type { SilicaSession, SilicaSessionOptions } from \"./session.js\";\n","export type AllowlistConfig = {\n  allowedEmails?: string[];\n  allowedDomains?: string[];\n};\n\nexport function isEmailAllowed(email: string | undefined | null, config: AllowlistConfig): boolean {\n  if (!email) return false;\n  const normalized = email.trim().toLowerCase();\n  const allowedEmails = new Set((config.allowedEmails ?? []).map((item) => item.trim().toLowerCase()));\n  if (allowedEmails.has(normalized)) return true;\n\n  return (config.allowedDomains ?? []).some((domain) => {\n    const normalizedDomain = domain.trim().replace(/^@/, \"\").toLowerCase();\n    return normalized.endsWith(`@${normalizedDomain}`);\n  });\n}\n\nexport function hasAllowlist(config: AllowlistConfig): boolean {\n  return Boolean(config.allowedEmails?.length || config.allowedDomains?.length);\n}\n","import { getCookieCache, getSessionCookie } from \"better-auth/cookies\";\nimport type { Session, User } from \"better-auth\";\nimport type { AllowlistConfig } from \"./allowlist.js\";\nimport { hasAllowlist, isEmailAllowed } from \"./allowlist.js\";\n\nexport type SilicaSession = {\n  session: Session & Record<string, unknown>;\n  user: User & Record<string, unknown>;\n  updatedAt: number;\n  version?: string;\n};\n\nexport type SilicaSessionOptions = AllowlistConfig & {\n  secret?: string;\n  strategy?: \"compact\" | \"jwt\" | \"jwe\";\n};\n\nexport async function getSilicaSession(request: Request | Headers, options: SilicaSessionOptions = {}): Promise<SilicaSession | null> {\n  try {\n    return await getCookieCache<SilicaSession>(request, {\n      secret: options.secret ?? process.env.BETTER_AUTH_SECRET,\n      strategy: options.strategy ?? \"jwe\",\n    });\n  } catch {\n    return null;\n  }\n}\n\nexport function hasSilicaSessionCookie(request: Request | Headers): boolean {\n  return Boolean(getSessionCookie(request));\n}\n\nexport async function isSilicaRequestAllowed(request: Request | Headers, options: SilicaSessionOptions = {}): Promise<boolean> {\n  const session = await getSilicaSession(request, options);\n  if (!session) return false;\n  if (!hasAllowlist(options)) return true;\n  return isEmailAllowed(session.user.email, options);\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,SAAS,UAAU,4BAA4B;;;ACIxC,SAAS,eAAe,OAAkC,QAAkC;AACjG,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,QAAM,gBAAgB,IAAI,KAAK,OAAO,iBAAiB,CAAC,GAAG,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,YAAY,CAAC,CAAC;AACnG,MAAI,cAAc,IAAI,UAAU,EAAG,QAAO;AAE1C,UAAQ,OAAO,kBAAkB,CAAC,GAAG,KAAK,CAAC,WAAW;AACpD,UAAM,mBAAmB,OAAO,KAAK,EAAE,QAAQ,MAAM,EAAE,EAAE,YAAY;AACrE,WAAO,WAAW,SAAS,IAAI,gBAAgB,EAAE;AAAA,EACnD,CAAC;AACH;AAEO,SAAS,aAAa,QAAkC;AAC7D,SAAO,QAAQ,OAAO,eAAe,UAAU,OAAO,gBAAgB,MAAM;AAC9E;;;ACnBA,SAAS,gBAAgB,wBAAwB;AAiBjD,eAAsB,iBAAiB,SAA4B,UAAgC,CAAC,GAAkC;AACpI,MAAI;AACF,WAAO,MAAM,eAA8B,SAAS;AAAA,MAClD,QAAQ,QAAQ,UAAU,QAAQ,IAAI;AAAA,MACtC,UAAU,QAAQ,YAAY;AAAA,IAChC,CAAC;AAAA,EACH,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,uBAAuB,SAAqC;AAC1E,SAAO,QAAQ,iBAAiB,OAAO,CAAC;AAC1C;AAEA,eAAsB,uBAAuB,SAA4B,UAAgC,CAAC,GAAqB;AAC7H,QAAM,UAAU,MAAM,iBAAiB,SAAS,OAAO;AACvD,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI,CAAC,aAAa,OAAO,EAAG,QAAO;AACnC,SAAO,eAAe,QAAQ,KAAK,OAAO,OAAO;AACnD;;;AFzBO,SAAS,WAAW,UAA6B,CAAC,GAAG;AAC1D,QAAM,YAAY;AAAA,IAChB,gBAAgB,QAAQ,kBAAkB,CAAC;AAAA,IAC3C,eAAe,QAAQ,iBAAiB,CAAC;AAAA,EAC3C;AAEA,SAAO,WAAW;AAAA,IAChB,SAAS,QAAQ,WAAW,QAAQ,IAAI;AAAA,IACxC,QAAQ,QAAQ,UAAU,QAAQ,IAAI;AAAA,IACtC,iBAAiB;AAAA,MACf,QAAQ;AAAA,QACN,UAAU,QAAQ,kBAAkB,QAAQ,IAAI,oBAAoB;AAAA,QACpE,cAAc,QAAQ,sBAAsB,QAAQ,IAAI,wBAAwB;AAAA,MAClF;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP,aAAa;AAAA,QACX,SAAS;AAAA,QACT,QAAQ,IAAI,KAAK,KAAK;AAAA,QACtB,UAAU;AAAA,QACV,cAAc;AAAA,MAChB;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP,oBAAoB;AAAA,MACpB,oBAAoB;AAAA,MACpB,gBAAgB;AAAA,QACd,SAAS;AAAA,MACX;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,OAAO,qBAAqB,OAAO,QAAQ;AACzC,YAAI,CAAC,IAAI,KAAK,SAAS,YAAY,EAAG;AACtC,YAAI,CAAC,aAAa,SAAS,EAAG;AAE9B,cAAM,QAAQ,IAAI,QAAQ,YAAY,KAAK,SAAS;AACpD,YAAI,CAAC,eAAe,OAAO,SAAS,GAAG;AACrC,gBAAM,IAAI,SAAS,aAAa;AAAA,YAC9B,SAAS;AAAA,YACT,YAAY;AAAA,UACd,CAAC;AAAA,QACH;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;","names":[]}

package/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "@silicajs/auth",
+  "version": "0.1.0",
+  "description": "Better Auth wrapper and allowlist helpers for Silica.",
+  "type": "module",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "lint": "tsc --noEmit"
+  },
+  "dependencies": {
+    "better-auth": "^1.6.11"
+  }
+}