@stjoseph/prumo 0.2.0 → 0.4.0

package/templates/api/test/support/fakes/social-fakes.ts

@@ -0,0 +1,112 @@
+import { authFakes } from '@test/support/fakes/auth-fakes'
+import { FakeOpaqueTokens } from '@test/support/fakes/fake-opaque-tokens'
+import { ImmediateTransactionManager } from '@test/support/fakes/immediate-transaction-manager'
+import type { Identity } from '@/domain/auth/entities/identity.entity'
+import type { SocialSignIn } from '@/domain/auth/entities/social-sign-in.entity'
+import type {
+  IdentityProviders,
+  ProviderCallback,
+  ProviderName,
+  ProviderProfile,
+  ProviderRedirect,
+} from '@/domain/auth/ports/identity-providers.port'
+import type { IdentityRepository } from '@/domain/auth/repositories/identity.repository'
+import type { SocialSignInRepository } from '@/domain/auth/repositories/social-sign-in.repository'
+import { CompleteSocialSignInUseCase } from '@/domain/auth/use-cases/complete-social-sign-in.use-case'
+import { ExchangeSocialCodeUseCase } from '@/domain/auth/use-cases/exchange-social-code.use-case'
+import { LinkIdentityUseCase } from '@/domain/auth/use-cases/link-identity.use-case'
+import { StartSessionUseCase } from '@/domain/auth/use-cases/start-session.use-case'
+import { StartSocialSignInUseCase } from '@/domain/auth/use-cases/start-social-sign-in.use-case'
+import { CreateProfileUseCase } from '@/domain/users/use-cases/create-profile.use-case'
+import { FakeAccessTokens } from './fake-access-tokens'
+
+export class InMemoryIdentityRepository implements IdentityRepository {
+  readonly rows: Identity[] = []
+
+  async findBySubject(provider: ProviderName, subject: string): Promise<Identity | null> {
+    return this.rows.find((row) => row.provider === provider && row.subject === subject) ?? null
+  }
+
+  async save(identity: Identity): Promise<void> {
+    identity.id ??= crypto.randomUUID()
+    this.rows.push(identity)
+  }
+}
+
+export class InMemorySocialSignInRepository implements SocialSignInRepository {
+  readonly rows = new Map<string, SocialSignIn>()
+
+  async lockById(id: string): Promise<SocialSignIn | null> {
+    return this.rows.get(id) ?? null
+  }
+
+  async save(signIn: SocialSignIn): Promise<void> {
+    signIn.id ??= crypto.randomUUID()
+    this.rows.set(signIn.id, signIn)
+  }
+}
+
+// A provider that answers what the test tells it to, and remembers what it was asked.
+export class FakeIdentityProviders implements IdentityProviders {
+  next: ProviderProfile = {
+    subject: 'google-sub-1',
+    email: 'ana@example.com',
+    emailVerified: true,
+    name: 'Ana',
+  }
+  lastCallback: ProviderCallback | undefined
+
+  constructor(private readonly configured: ProviderName[] = ['google', 'apple']) {}
+
+  isConfigured(provider: ProviderName): boolean {
+    return this.configured.includes(provider)
+  }
+
+  async redirect(provider: ProviderName, state: string): Promise<ProviderRedirect> {
+    return {
+      url: `https://${provider}.test/authorize?state=${state}`,
+      codeVerifier: 'verifier',
+      nonce: 'nonce',
+    }
+  }
+
+  async profile(_provider: ProviderName, callback: ProviderCallback): Promise<ProviderProfile> {
+    this.lastCallback = callback
+    return this.next
+  }
+}
+
+export function socialFakes() {
+  const auth = authFakes()
+  const identities = new InMemoryIdentityRepository()
+  const signIns = new InMemorySocialSignInRepository()
+  const providers = new FakeIdentityProviders()
+  const opaque = new FakeOpaqueTokens()
+  const transactions = new ImmediateTransactionManager()
+  const startSession = new StartSessionUseCase(auth.sessions, new FakeAccessTokens(), opaque)
+  const linkIdentity = new LinkIdentityUseCase(
+    auth.users,
+    identities,
+    auth.sessions,
+    transactions,
+    new CreateProfileUseCase(auth.profiles),
+  )
+
+  return {
+    ...auth,
+    identities,
+    signIns,
+    providers,
+    linkIdentity,
+    start: new StartSocialSignInUseCase(providers, signIns, opaque),
+    complete: new CompleteSocialSignInUseCase(
+      providers,
+      signIns,
+      opaque,
+      transactions,
+      linkIdentity,
+      startSession,
+    ),
+    exchange: new ExchangeSocialCodeUseCase(signIns, opaque, transactions, startSession),
+  }
+}

package/templates/api/test/support/setup.ts

@@ -1,10 +1,8 @@
 // tsyringe reads decorator metadata as each class is loaded, so this must come before any other import.
 import 'reflect-metadata'
 import { MikroORM } from '@mikro-orm/postgresql'
-import { getMigrations } from 'better-auth/db/migration'
-import { Client, type Pool } from 'pg'
+import { Client } from 'pg'
 import { afterAll, beforeAll, beforeEach, inject } from 'vitest'
-import { createAuth } from '@/infra/auth/auth.factory'
 import type { Env } from '@/infra/config/env'
 import { createOrmConfig } from '@/infra/database/mikroorm/mikro-orm.factory'
 
@@ -25,9 +23,8 @@ export function testEnv(): Env {
     NODE_ENV: 'test',
     PORT: 3000,
     DATABASE_URL: databaseUrl,
-    AUTH_DATABASE_URL: databaseUrl,
-    BETTER_AUTH_SECRET: 'test-secret-that-is-at-least-32-characters',
-    BETTER_AUTH_URL: 'http://localhost:3000',
+    JWT_SECRET: 'test-secret-that-is-at-least-32-characters',
+    API_URL: 'http://localhost:3000',
     WEB_ORIGIN: 'http://localhost:5173',
     LOG_LEVEL: 'error',
   }
@@ -44,41 +41,22 @@ async function createWorkerDatabase(baseUrl: string, name: string): Promise<stri
   const url = new URL(baseUrl)
   url.pathname = `/${name}`
 
-  const worker = new Client({ connectionString: url.toString() })
-
-  await worker.connect()
-  await worker.query('CREATE SCHEMA IF NOT EXISTS auth')
-  await worker.end()
-
   return url.toString()
 }
 
-async function migrateAuth(): Promise<void> {
-  const auth = createAuth(testEnv())
-  const { runMigrations } = await getMigrations(auth.options)
-
-  await runMigrations()
-  await (auth.options.database as Pool).end()
-}
-
 beforeAll(async () => {
   const name = `test_${process.env.VITEST_WORKER_ID ?? '1'}`
 
   databaseUrl = await createWorkerDatabase(inject('postgresUrl'), name)
-  await migrateAuth()
 
   orm = await MikroORM.init(createOrmConfig(testEnv()))
 
   await orm.migrator.up()
 
-  const metadata = orm.getMetadata().getAll()
-  const own = Object.values(metadata)
-    .filter(
-      (meta) => meta.tableName !== undefined && meta.pivotTable !== true && meta.schema !== 'auth',
-    )
+  // getAll() is a Map: Object.values() on it is empty, and nothing would be truncated.
+  tables = [...orm.getMetadata().getAll().values()]
+    .filter((meta) => meta.tableName !== undefined && meta.pivotTable !== true)
     .map((meta) => `"${meta.tableName}"`)
-
-  tables = [...own, 'auth."user"', 'auth.session', 'auth.account', 'auth.verification']
 })
 
 beforeEach(async () => {

package/templates/api/test/support/test-app.ts

@@ -0,0 +1,65 @@
+import { FakeMailer } from '@test/support/fakes/fake-mailer' // prumo:email
+import { testEnv, testOrm } from '@test/support/setup'
+import type { DependencyContainer } from 'tsyringe'
+import { MAILER } from '@/domain/auth/ports/mailer.port' // prumo:email
+import type { Env } from '@/infra/config/env'
+import { createContainer } from '@/infra/di'
+import { buildApp } from '@/infra/http/app'
+
+export const ORIGIN = 'http://localhost:5173'
+export const PASSWORD = 'correct-horse-battery'
+
+// The application as a test meets it: the real container over the test database, with a mailer whose inbox the
+// test can read.
+export async function testApp({
+  env = testEnv(),
+  configure,
+}: {
+  env?: Env
+  configure?: (container: DependencyContainer) => void
+} = {}) {
+  const container = createContainer({ env, orm: testOrm() })
+  // prumo:email
+  const mailer = new FakeMailer()
+
+  container.register(MAILER, { useValue: mailer })
+  // prumo:end-email
+  configure?.(container)
+
+  const app = await buildApp(container)
+
+  // Signs up through the real routes and, where the email must be confirmed first, confirms it. Returns the
+  // response that delivered the session: cookies for the web, tokens in the body for a bearer client.
+  async function signUp({ bearer = false, email = `${crypto.randomUUID()}@example.com` } = {}) {
+    const headers = bearer ? { 'x-auth-transport': 'bearer' } : { origin: ORIGIN }
+    let response = await app.inject({
+      method: 'POST',
+      url: '/api/auth/sign-up',
+      headers,
+      payload: { name: 'Ana', email, password: PASSWORD },
+    })
+
+    // prumo:email
+    if (response.body.includes('verificationRequired')) {
+      response = await app.inject({
+        method: 'POST',
+        url: '/api/auth/email/verify',
+        headers,
+        payload: { email, code: mailer.lastCode(email) },
+      })
+    }
+
+    // prumo:end-email
+    return { response, email }
+  }
+
+  return {
+    app,
+    signUp,
+    mailer, // prumo:email
+  }
+}
+
+export function cookieHeader(response: { cookies: { name: string; value: string }[] }): string {
+  return response.cookies.map((cookie) => `${cookie.name}=${cookie.value}`).join('; ')
+}

package/templates/mobile/README.md

@@ -2,7 +2,7 @@
 
 ## Requirements
 
-Node 22.18 or later, pnpm 10.26 or later, and the API running with `MOBILE_APP_SCHEME=app`. A simulator or a device with Expo Go
+Node 22.18 or later, pnpm 10.26 or later, and the API running. A simulator or a device with Expo Go
 to open the app.
 
 ## Running it

package/templates/mobile/jest.config.js

@@ -1,14 +1,3 @@
-const preset = require('jest-expo/jest-preset')
-
-const [nodeModules, ...rest] = preset.transformIgnorePatterns
-const babel = preset.transform['\\.[jt]sx?$']
-
-if (!nodeModules.includes('(?!(') || babel === undefined) {
-  throw new Error(
-    'jest-expo changed its transform settings; re-check the Better Auth entries below',
-  )
-}
-
 module.exports = {
   preset: 'jest-expo',
   moduleNameMapper: { '^@/(.*)$': '<rootDir>/src/$1', '^@test/(.*)$': '<rootDir>/test/$1' },
@@ -16,10 +5,4 @@ module.exports = {
   // workspace the contract is a package to transform too, and Jest's 5s default was crossed in CI while the same
   // suite passed alone. The budget is the machine's slowness, not the test's.
   testTimeout: 30_000,
-  // Better Auth ships ESM only, partly as .mjs, so it joins the packages jest-expo transforms, with the same Babel.
-  transform: { '\\.mjs$': babel },
-  transformIgnorePatterns: [
-    nodeModules.replace('(?!(', '(?!(better-auth|@better-auth|nanostores|'),
-    ...rest,
-  ],
 }

package/templates/mobile/package.json

@@ -15,18 +15,14 @@
     "prepare": "node .githooks/install.mjs"
   },
   "dependencies": {
-    "@better-auth/core": "1.7.7",
-    "@better-auth/expo": "1.7.7",
     "@hookform/resolvers": "5.9.1",
     "@tanstack/query-sync-storage-persister": "5.102.8",
     "@tanstack/react-query": "5.102.8",
     "@tanstack/react-query-persist-client": "5.102.8",
-    "better-auth": "1.7.7",
     "class-variance-authority": "0.7.1",
     "expo": "57.0.22",
     "expo-constants": "57.0.18",
     "expo-linking": "57.0.10",
-    "expo-network": "57.0.2",
     "expo-router": "57.0.21",
     "expo-secure-store": "57.0.4",
     "expo-splash-screen": "57.0.9",

package/templates/mobile/scripts/ports.mjs

@@ -25,7 +25,7 @@ const APPS = {
 // A port that moves takes these with it: the key to write, in which app, from which app's port.
 const FOLLOWERS = {
   api: [
-    { app: 'api', key: 'BETTER_AUTH_URL' },
+    { app: 'api', key: 'API_URL' },
     { app: 'web', key: 'VITE_API_URL' },
     { app: 'mobile', key: 'EXPO_PUBLIC_API_URL' },
   ],

package/templates/mobile/src/api-contract/api-error.ts

@@ -5,14 +5,8 @@ type ProblemDocument = {
   status?: number
   detail?: string
   requestId?: string
-  errors?: FieldErrors
-}
-
-type AuthClientError = {
-  status: number
-  statusText: string
-  message?: string
   code?: string
+  errors?: FieldErrors
 }
 
 export class ApiError extends Error {
@@ -22,6 +16,8 @@ export class ApiError extends Error {
     readonly detail: string | undefined,
     readonly requestId: string | undefined,
     readonly errors: FieldErrors,
+    // A stable name for a refusal the client acts on, such as `email_not_verified`.
+    readonly code?: string,
   ) {
     super(detail ?? title)
   }
@@ -42,10 +38,7 @@ export class ApiError extends Error {
       problem.detail,
       problem.requestId ?? requestId,
       problem.errors ?? {},
+      problem.code,
     )
   }
-
-  static fromAuthError(error: AuthClientError): ApiError {
-    return new ApiError(error.status, error.code ?? error.statusText, error.message, undefined, {})
-  }
 }

package/templates/mobile/src/api-contract/auth.ts

@@ -0,0 +1,221 @@
+import { queryOptions } from '@tanstack/react-query'
+import { ApiError } from './api-error'
+import type { Transport } from './client'
+
+export type Session = { user: { id: string; email: string } }
+
+export type Tokens = { accessToken: string; refreshToken: string; expiresIn: number }
+
+export type SignUpRequest = { name: string; email: string; password: string }
+
+export type SignInRequest = { email: string; password: string }
+
+// prumo:email
+export type VerifyEmailRequest = { email: string; code: string }
+
+export type ResetPasswordRequest = { email: string; code: string; password: string }
+
+// prumo:end-email
+// prumo:social
+export type SocialProvider = 'google' | 'apple'
+
+// prumo:end-social
+// An account that must confirm its email first gets no session from signing up, and says so.
+export type SignUpResult = { verificationRequired: boolean }
+
+// Where a native client keeps its tokens. The web passes none: its tokens live in cookies no script can read.
+export type TokenStore = {
+  read(): Promise<Tokens | null>
+  write(tokens: Tokens | null): Promise<void>
+}
+
+export type AuthClient = ReturnType<typeof createAuthClient>
+
+export function createAuthClient({
+  baseUrl,
+  fetch,
+  tokens,
+}: {
+  baseUrl: string
+  fetch: Transport
+  tokens?: TokenStore
+}) {
+  const url = (path: string) => `${baseUrl}/api/auth${path}`
+
+  function send(path: string, body?: unknown): Promise<Response> {
+    const headers = new Headers()
+
+    // Asking for the tokens in the body is what makes the API leave cookies out.
+    if (tokens !== undefined) {
+      headers.set('x-auth-transport', 'bearer')
+    }
+
+    if (body !== undefined) {
+      headers.set('content-type', 'application/json')
+    }
+
+    return fetch(url(path), {
+      method: 'POST',
+      headers,
+      body: body === undefined ? undefined : JSON.stringify(body),
+    })
+  }
+
+  async function begin(path: string, body: unknown): Promise<SignUpResult> {
+    const response = await send(path, body)
+
+    if (!response.ok) {
+      throw await ApiError.fromResponse(response)
+    }
+
+    // The web's answer is empty: its session arrived as cookies.
+    const text = await response.text()
+    const answer = text === '' ? {} : (JSON.parse(text) as Partial<Tokens & SignUpResult>)
+
+    if (answer.verificationRequired === true) {
+      return { verificationRequired: true }
+    }
+
+    await tokens?.write(answer as Tokens)
+    return { verificationRequired: false }
+  }
+
+  // prumo:email
+  async function ask(path: string, body: unknown): Promise<void> {
+    const response = await send(path, body)
+
+    if (!response.ok) {
+      throw await ApiError.fromResponse(response)
+    }
+  }
+
+  // prumo:end-email
+
+  let refreshing: Promise<boolean> | undefined
+
+  // Every request that meets a 401 at once waits on the same refresh: a second refresh would present a token the
+  // first has already rotated.
+  function refresh(): Promise<boolean> {
+    refreshing ??= (async () => {
+      try {
+        // The web has no store and sends its cookie; a native client with nothing stored has nothing to send.
+        const stored = tokens === undefined ? undefined : await tokens.read()
+
+        if (stored === null) {
+          return false
+        }
+
+        const response = await send(
+          '/refresh',
+          stored === undefined ? undefined : { refreshToken: stored.refreshToken },
+        )
+
+        // Another tab rotated the token a moment ago, and the browser already holds the new one.
+        if (response.status === 409) {
+          return true
+        }
+
+        if (!response.ok) {
+          await tokens?.write(null)
+          return false
+        }
+
+        await tokens?.write((await response.json()) as Tokens)
+        return true
+      } finally {
+        refreshing = undefined
+      }
+    })()
+
+    return refreshing
+  }
+
+  // Every request to the API goes through here: with a bearer when there is one, and refreshed once on a 401.
+  const authorized: Transport = async (input, init) => {
+    const attempt = async () => {
+      const headers = new Headers(init?.headers)
+      const stored = await tokens?.read()
+
+      if (stored !== null && stored !== undefined) {
+        headers.set('authorization', `Bearer ${stored.accessToken}`)
+      }
+
+      return fetch(input, { ...init, headers })
+    }
+    const response = await attempt()
+
+    if (response.status !== 401 || !(await refresh())) {
+      return response
+    }
+
+    return attempt()
+  }
+
+  return {
+    baseUrl,
+    fetch: authorized,
+    refresh,
+
+    signUp: (request: SignUpRequest) => begin('/sign-up', request),
+
+    signIn: async (request: SignInRequest): Promise<void> => {
+      await begin('/sign-in', request)
+    },
+
+    // prumo:email
+    // Each answers alike for an unknown email, so a form can say "if the account exists, a code is on its way".
+    requestEmailVerification: (email: string) => ask('/email/verification', { email }),
+
+    verifyEmail: async (request: VerifyEmailRequest): Promise<void> => {
+      await begin('/email/verify', request)
+    },
+
+    requestPasswordReset: (email: string) => ask('/password/forgot', { email }),
+
+    resetPassword: async (request: ResetPasswordRequest): Promise<void> => {
+      await begin('/password/reset', request)
+    },
+    // prumo:end-email
+    // prumo:social
+    // Where to send the browser to sign in with a provider: the API takes it there and back. The web comes back
+    // signed in; a mobile app comes back with a code to exchange.
+    socialSignInUrl: (provider: SocialProvider, client: 'web' | 'mobile', returnTo = '/') =>
+      `${url(`/social/${provider}`)}?${new URLSearchParams({ client, returnTo })}`,
+
+    exchangeSocialCode: async (code: string): Promise<void> => {
+      await begin('/social/exchange', { code })
+    },
+    // prumo:end-social
+
+    // The device forgets the tokens whether or not the request arrives: signing out locally is what was asked.
+    async signOut(): Promise<void> {
+      try {
+        const response = await authorized(url('/sign-out'), { method: 'POST' })
+
+        if (!response.ok && response.status !== 401) {
+          throw await ApiError.fromResponse(response)
+        }
+      } finally {
+        await tokens?.write(null)
+      }
+    },
+
+    // A visitor without a session is not an error: the answer is null.
+    async getSession(): Promise<Session | null> {
+      const response = await authorized(url('/session'))
+
+      if (response.status === 401) {
+        return null
+      }
+
+      if (!response.ok) {
+        throw await ApiError.fromResponse(response)
+      }
+
+      return (await response.json()) as Session
+    },
+  }
+}
+
+export const sessionQuery = (auth: Pick<AuthClient, 'getSession'>) =>
+  queryOptions({ queryKey: ['session'], queryFn: () => auth.getSession() })

package/templates/mobile/src/api-contract/index.ts

@@ -1,4 +1,18 @@
 export { ApiError, type FieldErrors } from './api-error'
+export {
+  type AuthClient,
+  createAuthClient,
+  type ResetPasswordRequest, // prumo:email
+  type Session,
+  type SignInRequest,
+  type SignUpRequest,
+  type SignUpResult,
+  type SocialProvider, // prumo:social
+  sessionQuery,
+  type TokenStore,
+  type Tokens,
+  type VerifyEmailRequest, // prumo:email
+} from './auth'
 export { type ApiClient, createClient, type Transport } from './client'
 export {
   LOCALES,

package/templates/mobile/src/app/(app)/_layout.tsx

@@ -1,7 +1,7 @@
 import { useQuery } from '@tanstack/react-query'
 import { Redirect, Stack, usePathname } from 'expo-router'
+import { sessionQuery } from '@/api-contract'
 import { rememberIntendedRoute } from '@/features/auth/intended-route'
-import { sessionQuery } from '@/features/auth/session'
 import { useClients } from '@/features/clients/clients-context'
 
 export default function AuthenticatedLayout() {

package/templates/mobile/src/app/(auth)/forgot-password.tsx

@@ -0,0 +1,20 @@
+import { useRouter } from 'expo-router'
+import { Text } from 'react-native'
+import { SafeAreaView } from 'react-native-safe-area-context'
+import { ForgotPasswordForm } from '@/features/auth/forgot-password-form'
+import { useClients } from '@/features/clients/clients-context'
+
+export default function ForgotPasswordScreen() {
+  const { auth } = useClients()
+  const router = useRouter()
+
+  return (
+    <SafeAreaView className="flex-1 justify-center gap-6 p-6">
+      <Text className="text-2xl font-semibold text-neutral-900">Reset your password</Text>
+      <ForgotPasswordForm
+        auth={auth}
+        onSent={(email) => router.push({ pathname: '/reset-password', params: { email } })}
+      />
+    </SafeAreaView>
+  )
+}

package/templates/mobile/src/app/(auth)/reset-password.tsx

@@ -0,0 +1,18 @@
+import { useLocalSearchParams, useRouter } from 'expo-router'
+import { Text } from 'react-native'
+import { SafeAreaView } from 'react-native-safe-area-context'
+import { ResetPasswordForm } from '@/features/auth/reset-password-form'
+import { useClients } from '@/features/clients/clients-context'
+
+export default function ResetPasswordScreen() {
+  const { auth } = useClients()
+  const router = useRouter()
+  const { email } = useLocalSearchParams<{ email: string }>()
+
+  return (
+    <SafeAreaView className="flex-1 justify-center gap-6 p-6">
+      <Text className="text-2xl font-semibold text-neutral-900">Choose a new password</Text>
+      <ResetPasswordForm auth={auth} email={email} onReset={() => router.replace('/')} />
+    </SafeAreaView>
+  )
+}

package/templates/mobile/src/app/(auth)/sign-in.tsx

@@ -3,6 +3,7 @@ import { Text, View } from 'react-native'
 import { SafeAreaView } from 'react-native-safe-area-context'
 import { takeIntendedRoute } from '@/features/auth/intended-route'
 import { SignInForm } from '@/features/auth/sign-in-form'
+import { SocialButtons } from '@/features/auth/social-buttons' // prumo:social
 import { useClients } from '@/features/clients/clients-context'
 
 export default function SignInScreen() {
@@ -12,6 +13,9 @@ export default function SignInScreen() {
   return (
     <SafeAreaView className="flex-1 justify-center gap-6 p-6">
       <Text className="text-2xl font-semibold text-neutral-900">Sign in</Text>
+      {/* prumo:social */}
+      <SocialButtons auth={auth} onSignedIn={() => router.replace(takeIntendedRoute() ?? '/')} />
+      {/* prumo:end-social */}
       <SignInForm auth={auth} onSignedIn={() => router.replace(takeIntendedRoute() ?? '/')} />
       <View className="flex-row gap-1">
         <Text className="text-sm text-neutral-500">No account?</Text>
@@ -19,6 +23,11 @@ export default function SignInScreen() {
           Sign up
         </Link>
       </View>
+      {/* prumo:email */}
+      <Link href="/forgot-password" className="text-sm text-neutral-900">
+        Forgot your password?
+      </Link>
+      {/* prumo:end-email */}
     </SafeAreaView>
   )
 }