@stjoseph/prumo 0.1.1 → 0.3.0

package/templates/workspace/README.md

@@ -2,7 +2,7 @@
 
 ## Requirements
 
-Node 22.17 or later and pnpm. For the API, Docker Desktop running: its database and tests run in it.
+Node 22.18 or later and pnpm 10.26 or later. For the API, Docker Desktop running: its database and tests run in it.
 
 ## Layout
 

package/templates/workspace/package.json

@@ -12,6 +12,6 @@
     "@biomejs/biome": "catalog:"
   },
   "engines": {
-    "node": ">=22.17.0"
+    "node": ">=22.18.0"
   }
 }

package/templates/workspace/scripts/ports.mjs

@@ -25,7 +25,7 @@ const APPS = {
 // A port that moves takes these with it: the key to write, in which app, from which app's port.
 const FOLLOWERS = {
   api: [
-    { app: 'api', key: 'BETTER_AUTH_URL' },
+    { app: 'api', key: 'API_URL' },
     { app: 'web', key: 'VITE_API_URL' },
     { app: 'mobile', key: 'EXPO_PUBLIC_API_URL' },
   ],

package/templates/api/docker/init/01-auth-schema.sql

@@ -1 +0,0 @@
-CREATE SCHEMA IF NOT EXISTS auth;

package/templates/api/migrations/Migration20260914123239_create_profile.ts

@@ -1,13 +0,0 @@
-import { Migration } from '@mikro-orm/migrations';
-
-export class Migration20260914123239_create_profile extends Migration {
-
-  override name = 'Migration20260914123239_create_profile';
-
-  override up(): void | Promise<void> {
-    this.addSql(`create table "profile" ("id" uuid not null default uuidv7(), "user_id" uuid not null, "display_name" text not null, "locale" text not null default 'en', "timezone" text not null default 'UTC', "created_at" timestamptz not null default now(), "updated_at" timestamptz not null default now(), primary key ("id"));`);
-    this.addSql(`alter table "profile" add constraint "profile_user_id_unique" unique ("user_id");`);
-    this.addSql(`alter table "profile" add constraint "profile_user_id_foreign" foreign key ("user_id") references "auth"."user" ("id") on delete restrict;`);
-  }
-
-}

package/templates/api/src/infra/auth/auth.cli.ts

@@ -1,5 +0,0 @@
-import { loadEnv } from '@/infra/config/env'
-import { createAuth } from './auth.factory'
-
-// Read by Better Auth's CLI (`auth migrate --config`), which only needs the schema, not the hooks.
-export const auth = createAuth(loadEnv())

package/templates/api/src/infra/auth/auth.factory.ts

@@ -1,77 +0,0 @@
-import { cimd } from '@better-auth/cimd' // prumo:mcp
-import { fetchClientMetadataResource } from '@better-auth/cimd/node' // prumo:mcp
-import { expo } from '@better-auth/expo'
-import { mcp } from '@better-auth/mcp' // prumo:mcp
-import { type BetterAuthPlugin, betterAuth } from 'better-auth'
-import { jwt } from 'better-auth/plugins' // prumo:mcp
-import { Pool } from 'pg'
-import type { Env } from '@/infra/config/env'
-
-type NewUser = { id: string; name: string }
-
-export type AuthHooks = {
-  onUserCreated?: (user: NewUser) => Promise<void>
-}
-
-export const AUTH = Symbol('Auth')
-
-// prumo:mcp
-// The protected resource MCP clients ask a token for; access tokens carry it as their audience.
-export function mcpResource(env: Pick<Env, 'BETTER_AUTH_URL'>): string {
-  return `${env.BETTER_AUTH_URL}/api/mcp`
-}
-
-// prumo:end-mcp
-export function createAuth(
-  env: Pick<
-    Env,
-    | 'AUTH_DATABASE_URL'
-    | 'BETTER_AUTH_SECRET'
-    | 'BETTER_AUTH_URL'
-    | 'WEB_ORIGIN'
-    | 'MOBILE_APP_SCHEME'
-  >,
-  hooks: AuthHooks = {},
-) {
-  const mobile = env.MOBILE_APP_SCHEME
-  const plugins: BetterAuthPlugin[] = mobile === undefined ? [] : [expo()]
-
-  // prumo:mcp
-  plugins.push(
-    jwt(),
-    mcp({
-      loginPage: `${env.WEB_ORIGIN}/sign-in`,
-      consentPage: `${env.WEB_ORIGIN}/consent`,
-      resource: mcpResource(env),
-    }),
-    cimd({ fetchClientMetadataResource, metadataProfile: 'mcp-2026-07-28' }),
-  )
-
-  // prumo:end-mcp
-  return betterAuth({
-    baseURL: env.BETTER_AUTH_URL,
-    basePath: '/api/auth',
-    secret: env.BETTER_AUTH_SECRET,
-    trustedOrigins: mobile === undefined ? [env.WEB_ORIGIN] : [env.WEB_ORIGIN, `${mobile}://`],
-    plugins,
-    database: new Pool({
-      connectionString: env.AUTH_DATABASE_URL,
-      options: '-c search_path=auth',
-    }),
-    emailAndPassword: { enabled: true },
-    advanced: { database: { generateId: 'uuid' } },
-    databaseHooks: {
-      user: {
-        create: {
-          after: async (user) => {
-            await hooks.onUserCreated?.(user)
-          },
-        },
-      },
-    },
-  })
-}
-
-export type Auth = ReturnType<typeof createAuth>
-export type AuthSession = Awaited<ReturnType<Auth['api']['getSession']>>
-export type AuthUser = NonNullable<AuthSession>['user']

package/templates/api/src/infra/database/mikroorm/entities/auth-user.schema.ts

@@ -1,16 +0,0 @@
-import { EntitySchema } from '@mikro-orm/core'
-
-// Better Auth owns auth.user. This maps only its id, so a foreign key into it is declared rather than
-// hand-written; schema diffing skips the table, and nothing reads or writes it through the ORM.
-export class AuthUser {
-  id: string
-}
-
-export const AuthUserSchema = new EntitySchema({
-  class: AuthUser,
-  schema: 'auth',
-  tableName: 'user',
-  properties: {
-    id: { type: 'uuid', primary: true },
-  },
-})

package/templates/api/test/infra/auth/auth.factory.spec.ts

@@ -1,22 +0,0 @@
-import { testEnv } from '@test/support/setup'
-import { describe, expect, it } from 'vitest'
-import { createAuth } from '@/infra/auth/auth.factory'
-
-const proxy =
-  'http://localhost:3000/api/auth/expo-authorization-proxy?authorizationURL=https://example.com/authorize&oauthState=s'
-
-describe('createAuth', () => {
-  it('exposes no Expo redirect endpoint without a mobile scheme', async () => {
-    const response = await createAuth(testEnv()).handler(new Request(proxy))
-
-    expect(response.status).toBe(404)
-  })
-
-  it('exposes the Expo endpoint and trusts the scheme once a mobile scheme is set', async () => {
-    const auth = createAuth({ ...testEnv(), MOBILE_APP_SCHEME: 'app' })
-    const response = await auth.handler(new Request(proxy))
-
-    expect(response.status).toBe(302)
-    expect(auth.options.trustedOrigins).toContain('app://')
-  })
-})

package/templates/mobile/src/features/auth/auth-client.ts

@@ -1,27 +0,0 @@
-import { expoClient } from '@better-auth/expo/client'
-import { createAuthClient } from 'better-auth/react'
-import * as SecureStore from 'expo-secure-store'
-import type { Transport } from '@/api-contract'
-
-export type AuthClient = ReturnType<typeof createAuth>
-
-export type SessionAuth = Pick<AuthClient, 'signIn' | 'signUp' | 'getSession'>
-
-export function createAuth({ baseUrl, fetch }: { baseUrl: string; fetch: Transport }) {
-  return createAuthClient({
-    baseURL: baseUrl,
-    basePath: '/api/auth',
-    fetchOptions: { customFetchImpl: fetch },
-    plugins: [expoClient({ storage: SecureStore })],
-  })
-}
-
-export function withSessionCookie(auth: AuthClient, fetch: Transport): Transport {
-  return async (input, init) => {
-    const headers = new Headers(init?.headers)
-
-    headers.set('cookie', await auth.getCookie())
-
-    return fetch(input, { ...init, headers, credentials: 'omit' })
-  }
-}

package/templates/mobile/src/features/auth/session.ts

@@ -1,17 +0,0 @@
-import { queryOptions } from '@tanstack/react-query'
-import { ApiError } from '@/api-contract'
-import type { SessionAuth } from './auth-client'
-
-export const sessionQuery = (auth: SessionAuth) =>
-  queryOptions({
-    queryKey: ['session'],
-    queryFn: async () => {
-      const { data, error } = await auth.getSession()
-
-      if (error !== null) {
-        throw ApiError.fromAuthError(error)
-      }
-
-      return data
-    },
-  })

package/templates/web/src/features/auth/auth-client.ts

@@ -1,17 +0,0 @@
-import { oauthProviderClient } from '@better-auth/oauth-provider/client' // prumo:mcp
-import { createAuthClient } from 'better-auth/react'
-import type { Transport } from '@/api-contract'
-
-export type AuthClient = ReturnType<typeof createAuth>
-
-export function createAuth({ baseUrl, fetch }: { baseUrl: string; fetch: Transport }) {
-  return createAuthClient({
-    baseURL: baseUrl,
-    basePath: '/api/auth',
-    fetchOptions: { customFetchImpl: fetch },
-    // prumo:mcp
-    // Carries the signed query of an MCP client's authorization through sign-in and consent.
-    plugins: [oauthProviderClient()],
-    // prumo:end-mcp
-  })
-}

package/templates/web/src/features/auth/session.ts

@@ -1,17 +0,0 @@
-import { queryOptions } from '@tanstack/react-query'
-import { ApiError } from '@/api-contract'
-import type { AuthClient } from './auth-client'
-
-export const sessionQuery = (auth: AuthClient) =>
-  queryOptions({
-    queryKey: ['session'],
-    queryFn: async () => {
-      const { data, error } = await auth.getSession()
-
-      if (error !== null) {
-        throw ApiError.fromAuthError(error)
-      }
-
-      return data
-    },
-  })