@stjoseph/prumo 0.1.1 → 0.3.0

package/templates/api/test/support/factories/user.factory.ts

@@ -1,21 +1,19 @@
-import { randomUUID } from 'node:crypto'
 import type { EntityManager } from '@mikro-orm/postgresql'
+import { User } from '@/domain/auth/entities/user.entity'
 
-type UserOverrides = Partial<{ name: string; email: string }>
+type UserOverrides = Partial<{ email: string; passwordHash: string }>
 
+// The hash is not a real one: a test that signs in goes through the sign-up route instead.
 export async function createUser(
   em: EntityManager,
   overrides: UserOverrides = {},
 ): Promise<string> {
-  const id = randomUUID()
+  const user = new User(
+    overrides.email ?? `${crypto.randomUUID()}@example.com`,
+    overrides.passwordHash ?? 'not-a-real-hash',
+  )
 
-  // auth.user belongs to Better Auth, and the ORM maps only its id, so the row is written in SQL.
-  await em
-    .getConnection()
-    .execute(
-      'insert into auth."user" (id, name, email, "emailVerified", "createdAt", "updatedAt") values (?, ?, ?, false, now(), now())',
-      [id, overrides.name ?? 'Test Person', overrides.email ?? `${id}@example.com`],
-    )
+  await em.persist(user).flush()
 
-  return id
+  return user.id
 }

package/templates/api/test/support/fakes/auth-fakes.ts

@@ -0,0 +1,42 @@
+import { FakeAccessTokens } from '@test/support/fakes/fake-access-tokens'
+import { FakeOpaqueTokens } from '@test/support/fakes/fake-opaque-tokens'
+import { FakePasswordHasher } from '@test/support/fakes/fake-password-hasher'
+import { ImmediateTransactionManager } from '@test/support/fakes/immediate-transaction-manager'
+import { InMemoryProfileRepository } from '@test/support/fakes/in-memory-profile.repository'
+import { InMemorySessionRepository } from '@test/support/fakes/in-memory-session.repository'
+import { InMemoryUserRepository } from '@test/support/fakes/in-memory-user.repository'
+import { RefreshSessionUseCase } from '@/domain/auth/use-cases/refresh-session.use-case'
+import { SignInUseCase } from '@/domain/auth/use-cases/sign-in.use-case'
+import { SignOutUseCase } from '@/domain/auth/use-cases/sign-out.use-case'
+import { SignUpUseCase } from '@/domain/auth/use-cases/sign-up.use-case'
+import { StartSessionUseCase } from '@/domain/auth/use-cases/start-session.use-case'
+import { CreateProfileUseCase } from '@/domain/users/use-cases/create-profile.use-case'
+
+// Every auth use case wired to in-memory ports, sharing one set of them as the container would.
+export function authFakes() {
+  const users = new InMemoryUserRepository()
+  const sessions = new InMemorySessionRepository()
+  const profiles = new InMemoryProfileRepository()
+  const hasher = new FakePasswordHasher()
+  const tokens = new FakeAccessTokens()
+  const opaque = new FakeOpaqueTokens()
+  const transactions = new ImmediateTransactionManager()
+  const startSession = new StartSessionUseCase(sessions, tokens, opaque)
+
+  return {
+    users,
+    sessions,
+    profiles,
+    hasher,
+    signUp: new SignUpUseCase(
+      users,
+      hasher,
+      transactions,
+      new CreateProfileUseCase(profiles),
+      startSession,
+    ),
+    signIn: new SignInUseCase(users, hasher, startSession),
+    refresh: new RefreshSessionUseCase(sessions, tokens, opaque, transactions),
+    signOut: new SignOutUseCase(sessions),
+  }
+}

package/templates/api/test/support/fakes/fake-access-tokens.ts

@@ -0,0 +1,19 @@
+import type {
+  AccessClaims,
+  AccessTokens,
+  IssuedToken,
+} from '@/domain/auth/ports/access-tokens.port'
+
+export class FakeAccessTokens implements AccessTokens {
+  async issue({ userId, sessionId }: AccessClaims, expiresAt: Date): Promise<IssuedToken> {
+    return { token: `access:${userId}:${sessionId}`, expiresAt }
+  }
+
+  async verify(token: string): Promise<AccessClaims | null> {
+    const [kind, userId, sessionId] = token.split(':')
+
+    return kind === 'access' && userId !== undefined && sessionId !== undefined
+      ? { userId, sessionId }
+      : null
+  }
+}

package/templates/api/test/support/fakes/fake-opaque-tokens.ts

@@ -0,0 +1,14 @@
+import type { OpaqueTokens } from '@/domain/auth/ports/opaque-tokens.port'
+
+export class FakeOpaqueTokens implements OpaqueTokens {
+  private next = 0
+
+  create(): string {
+    this.next += 1
+    return `secret-${this.next}`
+  }
+
+  digest(token: string): string {
+    return `digest:${token}`
+  }
+}

package/templates/api/test/support/fakes/fake-password-hasher.ts

@@ -0,0 +1,15 @@
+import type { PasswordHasher } from '@/domain/auth/ports/password-hasher.port'
+
+// Reversible on purpose, so a test can read what was stored. Argon2 itself is proved in its adapter's test.
+export class FakePasswordHasher implements PasswordHasher {
+  verifications = 0
+
+  async hash(password: string): Promise<string> {
+    return `hashed:${password}`
+  }
+
+  async verify(hash: string | undefined, password: string): Promise<boolean> {
+    this.verifications += 1
+    return hash === `hashed:${password}`
+  }
+}

package/templates/api/test/support/fakes/immediate-transaction-manager.ts

@@ -0,0 +1,8 @@
+import type { TransactionManager } from '@/domain/shared/transactions/transaction-manager'
+
+// Runs the work and nothing else: atomicity is the adapter's to prove, against a real database.
+export class ImmediateTransactionManager implements TransactionManager {
+  run<T>(work: () => Promise<T>): Promise<T> {
+    return work()
+  }
+}

package/templates/api/test/support/fakes/in-memory-session.repository.ts

@@ -0,0 +1,19 @@
+import type { Session } from '@/domain/auth/entities/session.entity'
+import type { SessionRepository } from '@/domain/auth/repositories/session.repository'
+
+export class InMemorySessionRepository implements SessionRepository {
+  readonly rows = new Map<string, Session>()
+
+  async findById(id: string): Promise<Session | null> {
+    return this.rows.get(id) ?? null
+  }
+
+  lockById(id: string): Promise<Session | null> {
+    return this.findById(id)
+  }
+
+  async save(session: Session): Promise<void> {
+    session.id ??= crypto.randomUUID()
+    this.rows.set(session.id, session)
+  }
+}

package/templates/api/test/support/fakes/in-memory-user.repository.ts

@@ -0,0 +1,20 @@
+import type { User } from '@/domain/auth/entities/user.entity'
+import type { UserRepository } from '@/domain/auth/repositories/user.repository'
+
+export class InMemoryUserRepository implements UserRepository {
+  readonly rows = new Map<string, User>()
+
+  async findById(id: string): Promise<User | null> {
+    return this.rows.get(id) ?? null
+  }
+
+  async findByEmail(email: string): Promise<User | null> {
+    return [...this.rows.values()].find((user) => user.email === email) ?? null
+  }
+
+  async save(user: User): Promise<void> {
+    // The database assigns the id; here the first save does.
+    user.id ??= crypto.randomUUID()
+    this.rows.set(user.id, user)
+  }
+}

package/templates/api/test/support/setup.ts

@@ -1,10 +1,8 @@
 // tsyringe reads decorator metadata as each class is loaded, so this must come before any other import.
 import 'reflect-metadata'
 import { MikroORM } from '@mikro-orm/postgresql'
-import { getMigrations } from 'better-auth/db/migration'
-import { Client, type Pool } from 'pg'
+import { Client } from 'pg'
 import { afterAll, beforeAll, beforeEach, inject } from 'vitest'
-import { createAuth } from '@/infra/auth/auth.factory'
 import type { Env } from '@/infra/config/env'
 import { createOrmConfig } from '@/infra/database/mikroorm/mikro-orm.factory'
 
@@ -25,9 +23,8 @@ export function testEnv(): Env {
     NODE_ENV: 'test',
     PORT: 3000,
     DATABASE_URL: databaseUrl,
-    AUTH_DATABASE_URL: databaseUrl,
-    BETTER_AUTH_SECRET: 'test-secret-that-is-at-least-32-characters',
-    BETTER_AUTH_URL: 'http://localhost:3000',
+    JWT_SECRET: 'test-secret-that-is-at-least-32-characters',
+    API_URL: 'http://localhost:3000',
     WEB_ORIGIN: 'http://localhost:5173',
     LOG_LEVEL: 'error',
   }
@@ -44,41 +41,22 @@ async function createWorkerDatabase(baseUrl: string, name: string): Promise<stri
   const url = new URL(baseUrl)
   url.pathname = `/${name}`
 
-  const worker = new Client({ connectionString: url.toString() })
-
-  await worker.connect()
-  await worker.query('CREATE SCHEMA IF NOT EXISTS auth')
-  await worker.end()
-
   return url.toString()
 }
 
-async function migrateAuth(): Promise<void> {
-  const auth = createAuth(testEnv())
-  const { runMigrations } = await getMigrations(auth.options)
-
-  await runMigrations()
-  await (auth.options.database as Pool).end()
-}
-
 beforeAll(async () => {
   const name = `test_${process.env.VITEST_WORKER_ID ?? '1'}`
 
   databaseUrl = await createWorkerDatabase(inject('postgresUrl'), name)
-  await migrateAuth()
 
   orm = await MikroORM.init(createOrmConfig(testEnv()))
 
   await orm.migrator.up()
 
-  const metadata = orm.getMetadata().getAll()
-  const own = Object.values(metadata)
-    .filter(
-      (meta) => meta.tableName !== undefined && meta.pivotTable !== true && meta.schema !== 'auth',
-    )
+  // getAll() is a Map: Object.values() on it is empty, and nothing would be truncated.
+  tables = [...orm.getMetadata().getAll().values()]
+    .filter((meta) => meta.tableName !== undefined && meta.pivotTable !== true)
     .map((meta) => `"${meta.tableName}"`)
-
-  tables = [...own, 'auth."user"', 'auth.session', 'auth.account', 'auth.verification']
 })
 
 beforeEach(async () => {

package/templates/mobile/README.md

@@ -2,7 +2,7 @@
 
 ## Requirements
 
-Node 22.17 or later, pnpm, and the API running with `MOBILE_APP_SCHEME=app`. A simulator or a device with Expo Go
+Node 22.18 or later, pnpm 10.26 or later, and the API running. A simulator or a device with Expo Go
 to open the app.
 
 ## Running it

package/templates/mobile/jest.config.js

@@ -1,14 +1,3 @@
-const preset = require('jest-expo/jest-preset')
-
-const [nodeModules, ...rest] = preset.transformIgnorePatterns
-const babel = preset.transform['\\.[jt]sx?$']
-
-if (!nodeModules.includes('(?!(') || babel === undefined) {
-  throw new Error(
-    'jest-expo changed its transform settings; re-check the Better Auth entries below',
-  )
-}
-
 module.exports = {
   preset: 'jest-expo',
   moduleNameMapper: { '^@/(.*)$': '<rootDir>/src/$1', '^@test/(.*)$': '<rootDir>/test/$1' },
@@ -16,10 +5,4 @@ module.exports = {
   // workspace the contract is a package to transform too, and Jest's 5s default was crossed in CI while the same
   // suite passed alone. The budget is the machine's slowness, not the test's.
   testTimeout: 30_000,
-  // Better Auth ships ESM only, partly as .mjs, so it joins the packages jest-expo transforms, with the same Babel.
-  transform: { '\\.mjs$': babel },
-  transformIgnorePatterns: [
-    nodeModules.replace('(?!(', '(?!(better-auth|@better-auth|nanostores|'),
-    ...rest,
-  ],
 }

package/templates/mobile/package.json

@@ -15,17 +15,14 @@
     "prepare": "node .githooks/install.mjs"
   },
   "dependencies": {
-    "@better-auth/expo": "1.7.6",
     "@hookform/resolvers": "5.9.1",
     "@tanstack/query-sync-storage-persister": "5.102.8",
     "@tanstack/react-query": "5.102.8",
     "@tanstack/react-query-persist-client": "5.102.8",
-    "better-auth": "1.7.6",
     "class-variance-authority": "0.7.1",
     "expo": "57.0.22",
     "expo-constants": "57.0.18",
     "expo-linking": "57.0.10",
-    "expo-network": "57.0.2",
     "expo-router": "57.0.21",
     "expo-secure-store": "57.0.4",
     "expo-splash-screen": "57.0.9",
@@ -59,6 +56,6 @@
     "typescript": "6.0.3"
   },
   "engines": {
-    "node": ">=22.17.0"
+    "node": ">=22.18.0"
   }
 }

package/templates/mobile/scripts/ports.mjs

@@ -25,7 +25,7 @@ const APPS = {
 // A port that moves takes these with it: the key to write, in which app, from which app's port.
 const FOLLOWERS = {
   api: [
-    { app: 'api', key: 'BETTER_AUTH_URL' },
+    { app: 'api', key: 'API_URL' },
     { app: 'web', key: 'VITE_API_URL' },
     { app: 'mobile', key: 'EXPO_PUBLIC_API_URL' },
   ],

package/templates/mobile/src/api-contract/api-error.ts

@@ -8,13 +8,6 @@ type ProblemDocument = {
   errors?: FieldErrors
 }
 
-type AuthClientError = {
-  status: number
-  statusText: string
-  message?: string
-  code?: string
-}
-
 export class ApiError extends Error {
   constructor(
     readonly status: number,
@@ -44,8 +37,4 @@ export class ApiError extends Error {
       problem.errors ?? {},
     )
   }
-
-  static fromAuthError(error: AuthClientError): ApiError {
-    return new ApiError(error.status, error.code ?? error.statusText, error.message, undefined, {})
-  }
 }

package/templates/mobile/src/api-contract/auth.ts

@@ -0,0 +1,161 @@
+import { queryOptions } from '@tanstack/react-query'
+import { ApiError } from './api-error'
+import type { Transport } from './client'
+
+export type Session = { user: { id: string; email: string } }
+
+export type Tokens = { accessToken: string; refreshToken: string; expiresIn: number }
+
+export type SignUpRequest = { name: string; email: string; password: string }
+
+export type SignInRequest = { email: string; password: string }
+
+// Where a native client keeps its tokens. The web passes none: its tokens live in cookies no script can read.
+export type TokenStore = {
+  read(): Promise<Tokens | null>
+  write(tokens: Tokens | null): Promise<void>
+}
+
+export type AuthClient = ReturnType<typeof createAuthClient>
+
+export function createAuthClient({
+  baseUrl,
+  fetch,
+  tokens,
+}: {
+  baseUrl: string
+  fetch: Transport
+  tokens?: TokenStore
+}) {
+  const url = (path: string) => `${baseUrl}/api/auth${path}`
+
+  function send(path: string, body?: unknown): Promise<Response> {
+    const headers = new Headers()
+
+    // Asking for the tokens in the body is what makes the API leave cookies out.
+    if (tokens !== undefined) {
+      headers.set('x-auth-transport', 'bearer')
+    }
+
+    if (body !== undefined) {
+      headers.set('content-type', 'application/json')
+    }
+
+    return fetch(url(path), {
+      method: 'POST',
+      headers,
+      body: body === undefined ? undefined : JSON.stringify(body),
+    })
+  }
+
+  async function begin(path: string, body: unknown): Promise<void> {
+    const response = await send(path, body)
+
+    if (!response.ok) {
+      throw await ApiError.fromResponse(response)
+    }
+
+    await tokens?.write((await response.json()) as Tokens)
+  }
+
+  let refreshing: Promise<boolean> | undefined
+
+  // Every request that meets a 401 at once waits on the same refresh: a second refresh would present a token the
+  // first has already rotated.
+  function refresh(): Promise<boolean> {
+    refreshing ??= (async () => {
+      try {
+        // The web has no store and sends its cookie; a native client with nothing stored has nothing to send.
+        const stored = tokens === undefined ? undefined : await tokens.read()
+
+        if (stored === null) {
+          return false
+        }
+
+        const response = await send(
+          '/refresh',
+          stored === undefined ? undefined : { refreshToken: stored.refreshToken },
+        )
+
+        // Another tab rotated the token a moment ago, and the browser already holds the new one.
+        if (response.status === 409) {
+          return true
+        }
+
+        if (!response.ok) {
+          await tokens?.write(null)
+          return false
+        }
+
+        await tokens?.write((await response.json()) as Tokens)
+        return true
+      } finally {
+        refreshing = undefined
+      }
+    })()
+
+    return refreshing
+  }
+
+  // Every request to the API goes through here: with a bearer when there is one, and refreshed once on a 401.
+  const authorized: Transport = async (input, init) => {
+    const attempt = async () => {
+      const headers = new Headers(init?.headers)
+      const stored = await tokens?.read()
+
+      if (stored !== null && stored !== undefined) {
+        headers.set('authorization', `Bearer ${stored.accessToken}`)
+      }
+
+      return fetch(input, { ...init, headers })
+    }
+    const response = await attempt()
+
+    if (response.status !== 401 || !(await refresh())) {
+      return response
+    }
+
+    return attempt()
+  }
+
+  return {
+    baseUrl,
+    fetch: authorized,
+    refresh,
+
+    signUp: (request: SignUpRequest) => begin('/sign-up', request),
+
+    signIn: (request: SignInRequest) => begin('/sign-in', request),
+
+    // The device forgets the tokens whether or not the request arrives: signing out locally is what was asked.
+    async signOut(): Promise<void> {
+      try {
+        const response = await authorized(url('/sign-out'), { method: 'POST' })
+
+        if (!response.ok && response.status !== 401) {
+          throw await ApiError.fromResponse(response)
+        }
+      } finally {
+        await tokens?.write(null)
+      }
+    },
+
+    // A visitor without a session is not an error: the answer is null.
+    async getSession(): Promise<Session | null> {
+      const response = await authorized(url('/session'))
+
+      if (response.status === 401) {
+        return null
+      }
+
+      if (!response.ok) {
+        throw await ApiError.fromResponse(response)
+      }
+
+      return (await response.json()) as Session
+    },
+  }
+}
+
+export const sessionQuery = (auth: Pick<AuthClient, 'getSession'>) =>
+  queryOptions({ queryKey: ['session'], queryFn: () => auth.getSession() })

package/templates/mobile/src/api-contract/index.ts

@@ -1,4 +1,14 @@
 export { ApiError, type FieldErrors } from './api-error'
+export {
+  type AuthClient,
+  createAuthClient,
+  type Session,
+  type SignInRequest,
+  type SignUpRequest,
+  sessionQuery,
+  type TokenStore,
+  type Tokens,
+} from './auth'
 export { type ApiClient, createClient, type Transport } from './client'
 export {
   LOCALES,

package/templates/mobile/src/app/(app)/_layout.tsx

@@ -1,7 +1,7 @@
 import { useQuery } from '@tanstack/react-query'
 import { Redirect, Stack, usePathname } from 'expo-router'
+import { sessionQuery } from '@/api-contract'
 import { rememberIntendedRoute } from '@/features/auth/intended-route'
-import { sessionQuery } from '@/features/auth/session'
 import { useClients } from '@/features/clients/clients-context'
 
 export default function AuthenticatedLayout() {

package/templates/mobile/src/app/_layout.tsx

@@ -4,18 +4,18 @@ import { PersistQueryClientProvider } from '@tanstack/react-query-persist-client
 import { Stack } from 'expo-router'
 import * as SplashScreen from 'expo-splash-screen'
 import { useEffect, useState } from 'react'
-import { createClient } from '@/api-contract'
+import { createAuthClient, createClient, sessionQuery } from '@/api-contract'
 import { config } from '@/config'
-import { createAuth, withSessionCookie } from '@/features/auth/auth-client'
-import { sessionQuery } from '@/features/auth/session'
+import { secureTokenStore } from '@/features/auth/token-store'
 import { ClientsProvider, useClients } from '@/features/clients/clients-context'
 import { QUERY_CACHE_MAX_AGE, queryPersister } from '@/features/storage/query-persister'
 
 SplashScreen.preventAutoHideAsync()
 
 function createClients() {
-  const auth = createAuth({ baseUrl: config.apiUrl, fetch })
-  const api = createClient({ baseUrl: config.apiUrl, fetch: withSessionCookie(auth, fetch) })
+  const auth = createAuthClient({ baseUrl: config.apiUrl, fetch, tokens: secureTokenStore })
+  // Through the auth client, so every request carries the bearer and an expired one is refreshed and repeated.
+  const api = createClient({ baseUrl: config.apiUrl, fetch: auth.fetch })
 
   return { auth, api }
 }

package/templates/mobile/src/features/auth/sign-in-form.tsx

@@ -3,13 +3,11 @@ import { useQueryClient } from '@tanstack/react-query'
 import { Controller, useForm } from 'react-hook-form'
 import { View } from 'react-native'
 import { z } from 'zod'
-import { ApiError } from '@/api-contract'
+import { type AuthClient, sessionQuery } from '@/api-contract'
 import { Button } from '@/components/ui/button'
 import { Field } from '@/components/ui/field'
 import { FormError } from '@/features/forms/form-error'
 import { applyServerError } from '@/features/forms/server-errors'
-import type { SessionAuth } from './auth-client'
-import { sessionQuery } from './session'
 
 const schema = z.object({
   email: z.email(),
@@ -18,7 +16,13 @@ const schema = z.object({
 
 type SignInValues = z.infer<typeof schema>
 
-export function SignInForm({ auth, onSignedIn }: { auth: SessionAuth; onSignedIn: () => void }) {
+export function SignInForm({
+  auth,
+  onSignedIn,
+}: {
+  auth: Pick<AuthClient, 'signIn' | 'getSession'>
+  onSignedIn: () => void
+}) {
   const queryClient = useQueryClient()
   const form = useForm<SignInValues>({
     resolver: zodResolver(schema),
@@ -29,10 +33,10 @@ export function SignInForm({ auth, onSignedIn }: { auth: SessionAuth; onSignedIn
   const { errors, isSubmitting } = form.formState
 
   async function onSubmit(values: SignInValues) {
-    const { error } = await auth.signIn.email(values)
-
-    if (error !== null) {
-      applyServerError(ApiError.fromAuthError(error), ['email', 'password'], form.setError)
+    try {
+      await auth.signIn(values)
+    } catch (error) {
+      applyServerError(error, ['email', 'password'], form.setError)
       return
     }
 

package/templates/mobile/src/features/auth/sign-out-button.tsx

@@ -1,7 +1,7 @@
 import { useQueryClient } from '@tanstack/react-query'
+import type { AuthClient } from '@/api-contract'
 import { Button } from '@/components/ui/button'
 import { clearUserData } from '@/features/storage/storage'
-import type { AuthClient } from './auth-client'
 
 export type SignOutAuth = Pick<AuthClient, 'signOut'>
 
@@ -18,11 +18,11 @@ export function SignOutButton({
     try {
       await auth.signOut()
     } catch {
-      // A failed request leaves nothing on the device to act on: the Expo plugin deletes the stored cookie before it
-      // sends. The server's session outlives it until it expires, and signing out locally is still what was asked.
+      // A failed request leaves nothing on the device to act on: the auth client forgets the tokens either way. The
+      // server's session outlives them until it expires, and signing out locally is still what was asked.
     }
 
-    // What the plugin cannot know is the rest of this user's data: the query cache and every user-scoped key, or the
+    // What the auth client cannot know is the rest of this user's data: the query cache and every user-scoped key, or the
     // next person on this device reads them.
     queryClient.clear()
     clearUserData()