@stnd/account 0.1.1

package/CHANGELOG.md

@@ -0,0 +1,8 @@
+# @stnd/account
+
+## 0.1.1
+
+### Patch Changes
+
+- Updated dependencies
+  - @stnd/styles@0.5.2

package/README.md

@@ -0,0 +1,146 @@
+---
+title: "@stnd/account"
+aliases: []
+created: 2026-07-05 07:37
+modified: 2026-07-05 19:22
+last_audited: 2026-07-14
+audit_interval_days: 90
+next_audit: 2026-10-12
+audit_priority: 3
+maturity: tree
+mode: read
+publish: false
+status: active
+tags:
+  - package
+  - stnd
+theme: kernel
+type: package
+visibility: private
+---
+
+# @[stnd](../README)/account
+
+A comprehensive, self-contained authentication module for the Standard Garden framework, leveraging [BetterAuth](https://better-auth.com).
+
+## ELI5
+
+Login, sessions, *“sign in with Google”*, passkeys (Face ID/Touch ID) — all of it, already wired together, so an app doesn’t reinvent auth from scratch. It’s a Standard module: add it to `moduleLoad`, point it at a D1 database, and the `/api/auth/*` routes + the sign-in UI just exist.
+
+**Install:** `moduleLoad: ["@stnd/account"]` in `astro.config.mjs`, then follow *“Getting Started”* below (D1 schema + env vars — there’s real setup, this isn’t zero-config).
+
+**Use it (client-side sign-in):**
+
+```javascript
+import { signIn } from "@stnd/account/client";
+await signIn.social({ provider: "google" });
+```
+
+## Features
+
+- **Google OAuth:** Pre-configured social login integration.
+- **Passkeys:** Built-in support for Touch ID / Face ID / WebAuthn.
+- **Magic Links:** Ready to be wired up with email service providers.
+- **Astro Integration:** Automatic API route generation (`/api/auth/[…all]`) and middleware protection.
+- **D1 Compatibility:** Seamlessly integrates with Cloudflare D1 and `cloudflare:workers` environment variables.
+
+## Getting Started
+
+### 1. Database Setup
+
+This module requires specific tables in your Cloudflare D1 database. A `schema.sql` file is provided in this directory.
+
+When you’re ready to test locally or deploy, apply the schema using Wrangler:
+
+```bash
+wrangler d1 execute <YOUR_DB_NAME> --local --file=packages/account/schema.sql
+```
+
+*(Remove `--local` when applying to your production database).*
+
+### 2. Environment Variables
+
+Ensure your application’s `.dev.vars` (for local development) and Cloudflare environment secrets contain the following:
+
+```env
+BETTER_AUTH_SECRET="your-generated-secret"
+GOOGLE_CLIENT_ID="your-google-client-id"
+GOOGLE_CLIENT_SECRET="your-google-client-secret"
+```
+
+> **Note:** Generate a secure secret using `npx @better-auth/cli secret` or `openssl rand -base64 32`.
+
+### 3. Application Integration
+
+In your app’s `astro.config.js` (e.g., `apps/ade/astro.config.js`), ensure the module is loaded:
+
+```javascript
+import standard from "@stnd/core";
+
+export default defineConfig({
+  integrations: [
+    standard({
+      moduleLoad: [
+        "@stnd/account",
+        // ... other modules
+      ],
+      account: {
+        // Optional Configuration overrides (defaults fallback to env vars)
+        // db: env.DB, // D1 database binding
+        // rpName: "My Custom App", // Passkey Relying Party Name
+        // rpID: "my-app.com",      // Passkey Relying Party ID
+        // baseURL: "https://auth.my-app.com",
+        // trustedOrigins: ["https://my-app.com"]
+      },
+    }),
+  ],
+});
+```
+
+### 4. Google OAuth Setup
+
+To enable Google Login, you must configure a project in the [Google Cloud Console](https://console.cloud.google.com/):
+
+1. **Create Project**: Start a new project (e.g., `Utopie-ADE`).
+2. **OAuth Consent Screen**:
+   - Set User Type to **External**.
+   - Add your email as a **Test User** (required while the app is in *“Testing”* status).
+3. **Credentials**:
+   - Create **OAuth client ID** of type **Web application**.
+   - **Authorized JavaScript origins**: `http://localhost:8083` (and your production domain).
+   - **Authorized redirect URIs**: `http://localhost:8083/api/auth/callback/google` (and `https://your-domain.com/api/auth/callback/google`).
+4. **Copy IDs**: Paste the Client ID and Secret into your `.env` or `.dev.vars`.
+5. **Passkey (WebAuthn) Setup**
+   Passkeys require a secure context (HTTPS or Localhost).
+
+- **Development**: Use `http://localhost:8083` or your local port. Note that some browsers require the `rpID` to match the exact hostname. The module defaults to `localhost`.
+- **Production**: Ensure `env.RP_ID` (or `account.rpID` in `astro.config.js`) is set to your domain (e.g., `ade.stnd.build`). You should also configure `env.RP_NAME` (or `account.rpName`) for the prompt display.
+
+### 6. Client Usage
+
+In your Svelte frontend components, you can import the pre-configured better-auth clients:
+
+```javascript
+import { signIn, signUp, useSession, signOut } from "@stnd/account/client";
+
+// Example: sign in with Google
+const handleSignIn = async () => {
+  await signIn.social({ provider: "google" });
+};
+```
+
+## Maintenance & Troubleshooting
+
+### Database Adapter Errors
+If you see `Failed to initialize database adapter` or `db.insertInto is not a function`, ensure that the `kysely` and `kysely-d1` dependencies are correctly installed in the module workspace and that the `D1Dialect` is being passed the valid D1 binding from the request context.
+
+### Origin Mismatch (403 Forbidden)
+Ensure `baseURL` in `auth.js` matches the port your app is actually running on (e.g., `8083` for ADE). BetterAuth’s CSRF protection is strict about port numbers.
+
+## Notes / Observations
+
+*(jot down anything noticed here — quirks, gotchas, ideas)*
+
+## Todo
+
+- [ ] Nothing tracked yet. [priority:: 3] [token_scale:: 3] [created:: 2026-07-14] [area:: framework]

package/actions/system.js

@@ -0,0 +1,28 @@
+/**
+ * System actions bundle for Account Module embedded in Launcher.
+ */
+import { signOut } from "@stnd/account/client";
+
+const systemActions = [
+  {
+    trigger: "::logout",
+    meta: {
+      title: "Logout",
+      desc: "End your session and log out",
+      icon: "logout",
+      requireAuth: true,
+    },
+    action: async () => {
+      try {
+        await signOut();
+        window.toast("Logged out successfully", "success");
+        window.location.href = "/"; // Force refresh to clear state
+      } catch (err) {
+        console.error("Logout failed:", err);
+        window.toast("Failed to logout", "error");
+      }
+    },
+  },
+];
+
+export default systemActions;

package/auth.js

@@ -0,0 +1,235 @@
+import { betterAuth } from "better-auth";
+import { passkey } from "@better-auth/passkey";
+import { magicLink, emailOTP } from "better-auth/plugins";
+import { Kysely } from "kysely";
+import { D1Dialect } from "kysely-d1";
+import { createKyselyAdapter } from "@better-auth/kysely-adapter";
+import config from "virtual:stnd/config";
+import Log from "@stnd/log";
+
+const log = Log({ scope: "Account" });
+
+/**
+ * Resolves a configuration value based on the current environment.
+ * Accepts either a direct value (string/array) or an object with
+ * 'dev', 'preview', and 'production' keys.
+ */
+function resolveConfigValue(value, env) {
+  if (!value) return undefined;
+  if (typeof value === "string" || Array.isArray(value)) return value;
+
+  const isDev = import.meta.env.DEV;
+  const isPreview = !!env?.CF_PAGES && env?.CF_PAGES_BRANCH !== "main";
+
+  if (isDev) {
+    return value.dev || value.preview || value.production;
+  } else if (isPreview) {
+    return value.preview || value.production || value.dev;
+  } else {
+    return value.production || value.preview || value.dev;
+  }
+}
+
+/**
+ * Creates the BetterAuth instance relying on standard config overrides
+ * if available (e.g., config.account.db). Let's lazily initialize this to
+ * avoid top-level await that can crash some environments.
+ */
+
+export function initAuth(env) {
+  // In Cloudflare Workers, we must be careful with singletons that capture
+  // request-bound resources (like D1 bindings).
+  // We recreate the instance if the env changes or simply return a fresh one
+  // to avoid "Cannot perform I/O on behalf of a different request".
+
+  // Expected standard config structure:
+  // config.account = {
+  //   db: env.ADE_DB,
+  //   googleClientId: env.GOOGLE_CLIENT_ID,
+  //   googleClientSecret: env.GOOGLE_CLIENT_SECRET,
+  //   baseURL: "https://your.site",
+  //   secret: env.JWT_SECRET,
+  // }
+
+  const accountConfig = config.account || {};
+
+  // For D1 bindings (Cloudflare Workers)
+  // BetterAuth expects standard adapter syntax. If a raw D1 binding is provided,
+  // Svelte/Astro usually relies on an adapter package like better-sqlite3 or d1
+  let database = accountConfig.db || env?.DB || env?.ADE_DB || env?.Garden;
+
+  log.debug(
+    `[initAuth] Determining database. Have ADE_DB? ${!!env?.ADE_DB}. Have DB? ${!!env?.DB}. Have Garden? ${!!env?.Garden}`,
+  );
+  log.debug(`[initAuth] database Type: ${typeof database}`);
+  if (database) {
+    log.debug(`[initAuth] database keys: ${Object.keys(database).join(", ")}`);
+  } else {
+    log.warn(
+      "No database connection provided to Account module in config.account.db",
+    );
+  }
+
+  try {
+    log.debug("[initAuth] Calling betterAuth(...)");
+
+    const resolvedBaseURL = resolveConfigValue(accountConfig.baseURL, env);
+    const resolvedTrustedOrigins = resolveConfigValue(
+      accountConfig.trustedOrigins,
+      env,
+    ) || [
+        "https://www.lartdenseigner.com",
+        "https://www.standard.garden",
+        "https://www.stnd.build",
+        "http://localhost:8083",
+        "http://localhost:8084",
+        "http://localhost:8089",
+        // ADE Desktop — Vite dev server and Tauri WebView
+        "http://localhost:1420",
+        "tauri://localhost",
+      ];
+
+    const auth = betterAuth({
+      baseURL:
+        resolvedBaseURL ||
+        (env.BASE_URL ? env.BASE_URL : "http://localhost:8089"),
+      secret:
+        accountConfig.secret ||
+        env.BETTER_AUTH_SECRET ||
+        env.JWT_SECRET ||
+        "dev-secret-key",
+      advanced: {
+        trustedOrigins: resolvedTrustedOrigins,
+        checkOrigin: false,
+      },
+      database: {
+        db: new Kysely({
+          dialect: new D1Dialect({
+            database: database,
+          }),
+        }),
+        type: "sqlite",
+      },
+      emailAndPassword: {
+        enabled: true,
+      },
+      user: {
+        additionalFields: {
+          access_rights: {
+            type: "string",
+            required: false,
+            defaultValue: "{}",
+          },
+          settings: {
+            type: "string",
+            required: false,
+            defaultValue: "{}",
+          },
+        },
+      },
+      socialProviders: {
+        ...(accountConfig.googleClientId || env?.GOOGLE_CLIENT_ID ? {
+          google: {
+            clientId: accountConfig.googleClientId || env?.GOOGLE_CLIENT_ID || "",
+            clientSecret: accountConfig.googleClientSecret || env?.GOOGLE_CLIENT_SECRET || "",
+          },
+        } : {}),
+        // Apple Sign In — requires Apple Developer Program ($99/year)
+        // Uncomment and set APPLE_CLIENT_ID + APPLE_CLIENT_SECRET when ready
+        // ...(accountConfig.appleClientId || env?.APPLE_CLIENT_ID ? {
+        //   apple: {
+        //     clientId: accountConfig.appleClientId || env?.APPLE_CLIENT_ID || "",
+        //     clientSecret: accountConfig.appleClientSecret || env?.APPLE_CLIENT_SECRET || "",
+        //   },
+        // } : {}),
+      },
+      plugins: [
+        passkey({
+          rpID: accountConfig.rpID || env.RP_ID || "localhost",
+          rpName: accountConfig.rpName || env.RP_NAME || "Standard Account",
+        }),
+        magicLink({
+          sendMagicLink: async ({ email, token, url }) => {
+            log.info(`Mock sending Magic Link to ${email}: ${url}`);
+
+            if (!env.RESEND_API_KEY) {
+              if (import.meta.env.DEV) return;
+              log.warn("RESEND_API_KEY is not set. Magic Link not sent.");
+              return;
+            }
+
+            try {
+              const res = await fetch("https://api.resend.com/emails", {
+                method: "POST",
+                headers: {
+                  Authorization: `Bearer ${env.RESEND_API_KEY}`,
+                  "Content-Type": "application/json",
+                },
+                body: JSON.stringify({
+                  from: accountConfig.emailFrom || "auth@standard.garden",
+                  to: email,
+                  subject: `Your login link to ${accountConfig.rpName || "Standard App"}`,
+                  html: `
+                    <div style="font-family: system-ui, sans-serif; max-width: 600px; margin: 0 auto; color: #111;">
+                      <h1>Welcome!</h1>
+                      <p>Click the link below to sign in:</p>
+                      <a href="${url}" style="display:inline-block; padding:12px 24px; background:#111; color:#fff; text-decoration:none; border-radius:4px; font-weight:bold;">Sign In</a>
+                      <p style="margin-top:24px; color:#666; font-size:14px;">This link expires in 15 minutes.</p>
+                    </div>
+                  `,
+                }),
+              });
+              if (!res.ok) throw new Error(await res.text());
+            } catch (e) {
+              log.error("Failed to send Magic Link email:", e);
+            }
+          },
+        }),
+        emailOTP({
+          async sendVerificationOTP({ email, otp, type }) {
+            log.info(`Mock sending OTP ${otp} to ${email}`);
+
+            if (!env.RESEND_API_KEY) {
+              if (import.meta.env.DEV) return;
+              log.warn("RESEND_API_KEY is not set. OTP not sent.");
+              return;
+            }
+
+            try {
+              const res = await fetch("https://api.resend.com/emails", {
+                method: "POST",
+                headers: {
+                  Authorization: `Bearer ${env.RESEND_API_KEY}`,
+                  "Content-Type": "application/json",
+                },
+                body: JSON.stringify({
+                  from: accountConfig.emailFrom || "auth@standard.garden",
+                  to: email,
+                  subject: `Your login code: ${otp}`,
+                  html: `
+                    <div style="font-family: system-ui, sans-serif; max-width: 600px; margin: 0 auto; color: #111;">
+                      <h1>Your Login Code</h1>
+                      <p>Use the following code to sign in to ${accountConfig.rpName || "Standard App"}:</p>
+                      <div style="font-size: 32px; font-weight: bold; letter-spacing: 4px; padding: 20px; background: #f4f4f5; text-align: center; border-radius: 8px; margin: 24px 0;">
+                        ${otp}
+                      </div>
+                      <p style="color:#666; font-size:14px;">This code expires in 10 minutes.</p>
+                    </div>
+                  `,
+                }),
+              });
+              if (!res.ok) throw new Error(await res.text());
+            } catch (e) {
+              log.error("Failed to send OTP email:", e);
+            }
+          }
+        }),
+      ],
+    });
+    log.debug("[initAuth] betterAuth successfully initialized");
+    return auth;
+  } catch (e) {
+    log.error("[initAuth] FATAL: betterAuth failed to initialize", e);
+    throw e;
+  }
+}

package/client.svelte.js

@@ -0,0 +1,19 @@
+import { createAuthClient } from "better-auth/svelte";
+import { passkeyClient } from "@better-auth/passkey/client";
+import { magicLinkClient, emailOTPClient } from "better-auth/client/plugins";
+
+/**
+ * Creates a configured BetterAuth client tailored for the Standard framework.
+ * 
+ * Includes the Passkeys plugin per requirements.
+ */
+export const accountClient = createAuthClient({
+    plugins: [
+        passkeyClient(),
+        magicLinkClient(),
+        emailOTPClient()
+    ]
+});
+
+// Re-export common client capabilities
+export const { signIn, signUp, useSession, signOut, emailOtp } = accountClient;

package/index.module.js

@@ -0,0 +1,59 @@
+/**
+ * Account Module Manifest
+ *
+ * Exposes BetterAuth authentication via the Standard Module System.
+ * Handles routes, middleware, and exports the User model.
+ */
+export default {
+  id: "stnd-account",
+  name: "Stnd :: Account",
+  description:
+    "User authentication, Google OAuth, and Passkeys support using BetterAuth.",
+
+  routes: [
+    {
+      path: "/api/auth/[...all]",
+      entrypoint: "./route.js",
+    },
+  ],
+  middleware: [
+    {
+      entrypoint: "./middleware.js",
+      order: -100, // Run early
+    },
+  ],
+  optimizeDeps: [
+    "better-auth",
+    "better-auth/db",
+    "better-auth/plugins",
+    "@better-auth/passkey",
+    "kysely",
+    "kysely-d1",
+    "@better-auth/kysely-adapter",
+  ],
+  store: {
+    user: "./models/User.js#userStore",
+  },
+  aliases: {
+    // Allows `import { auth } from "@stnd/account/auth"`
+    "@stnd/account/auth": "./auth.js",
+    "@stnd/account/client": "./client.svelte.js",
+    "@stnd/account/models": "./models",
+    "@stnd/account/ui": "./ui",
+    "@stnd/account/views": "./views",
+  },
+  hooks: {
+    // No "::login" launcher:view hook here: apps that want a login view
+    // must register their own (see apps/stnd.gd/modules/launcher). Two
+    // modules both registering "::login" with override:true made the
+    // winner depend on module discovery order — a real "last one wins"
+    // race. LoginView.svelte is still exported via the "@stnd/account/views"
+    // alias for apps that want to register it themselves.
+    "launcher:action": [
+      {
+        action: "./actions/system.js",
+        meta: { label: "Account System Actions" },
+      },
+    ],
+  },
+};

package/middleware.js

@@ -0,0 +1,59 @@
+import { defineMiddleware } from "astro:middleware";
+import { initAuth } from "./auth.js";
+import Log from "@stnd/log";
+import { env as cfEnv } from "cloudflare:workers";
+
+const log = Log({ scope: "AccountMiddleware" });
+
+/**
+ * Standard Account Middleware
+ * 
+ * Intercepts requests, validates the session via BetterAuth, and injects
+ * `context.locals.user` and `context.locals.session` for downstream endpoints.
+ */
+export const onRequest = defineMiddleware(async (context, next) => {
+    let env = null;
+
+    if (cfEnv && (cfEnv.ADE_DB || cfEnv.DB || cfEnv.Garden)) {
+        env = cfEnv;
+    }
+
+    if (!env && context.locals?.runtime?.env) {
+        env = context.locals.runtime.env;
+    }
+    if (!env && context.locals?.cfContext?.env) {
+        env = context.locals.cfContext.env;
+    }
+    if (!env && context.locals?.env) {
+        env = context.locals.env;
+    }
+    if (!env) {
+        env = {};
+    }
+
+    try {
+        const auth = initAuth(env);
+
+        if (!auth) {
+            throw new Error("initAuth returned null or undefined");
+        }
+
+        const isAuthed = await auth.api.getSession({
+            headers: context.request.headers,
+        });
+
+        if (isAuthed) {
+            context.locals.user = isAuthed.user;
+            context.locals.session = isAuthed.session;
+        } else {
+            context.locals.user = null;
+            context.locals.session = null;
+        }
+    } catch (err) {
+        log.error("Error during session validation", err);
+        context.locals.user = null;
+        context.locals.session = null;
+    }
+
+    return next();
+});

package/models/User.js

@@ -0,0 +1,107 @@
+import { atom } from "nanostores";
+import Log from "@stnd/log";
+
+const log = Log({ scope: "User" });
+
+// ============================================================================
+// AUTH STORE (Canonical — used by all Standard apps)
+// ============================================================================
+
+export const userStore = atom(null);
+export const sessionStore = atom(null);
+
+/**
+ * Set the authenticated user.
+ * Dispatches "user-login" + legacy "visitor-login" events.
+ */
+export function setUser(user, session = null) {
+    if (user && user.isAuthenticated === undefined) {
+        user.isAuthenticated = true;
+    }
+    log.info("Set user:", user?.email || user?.username || user?.id);
+    userStore.set(user);
+    sessionStore.set(session);
+
+    if (typeof window !== "undefined" && user) {
+        window.dispatchEvent(new CustomEvent("user-login", { detail: user }));
+        window.dispatchEvent(new CustomEvent("visitor-login"));
+    }
+}
+
+/**
+ * Clear the authenticated user (logout).
+ * Dispatches "user-logout" + legacy "visitor-logout" events.
+ */
+export function clearUser() {
+    log.info("Clear user");
+    userStore.set(null);
+    sessionStore.set(null);
+
+    if (typeof window !== "undefined") {
+        window.dispatchEvent(new CustomEvent("user-logout"));
+        window.dispatchEvent(new CustomEvent("visitor-logout"));
+    }
+}
+
+/**
+ * Check if the current store holds an authenticated user.
+ */
+export function isAuthenticated() {
+    const user = userStore.get();
+    if (!user) return false;
+    return user.isAuthenticated === true;
+}
+
+// Expose on window for backward compat and debugging
+if (typeof window !== "undefined") {
+    window.setUser = setUser;
+    window.clearUser = clearUser;
+    // Legacy names (stnd.gd)
+    window.setVisitor = (v) => setUser(v);
+    window.clearVisitor = () => clearUser();
+}
+
+// ============================================================================
+// USER CLASS (Generic shared logic)
+// ============================================================================
+
+export default class User {
+    constructor(raw) {
+        this.raw = raw;
+    }
+
+    /**
+     * Check if user has access to a specific resource (e.g. formation slug).
+     *
+     * Uses the generic `access_rights` JSON field stored on the User model.
+     */
+    hasAccessTo(slug) {
+        if (this.raw?.role === "admin") return true;
+
+        const rights = this.raw?.access_rights;
+        if (typeof rights === "string") {
+            try {
+                const parsed = JSON.parse(rights);
+                return !!parsed[slug];
+            } catch (e) { return false; }
+        } else if (rights && typeof rights === "object") {
+            return !!rights[slug];
+        }
+
+        return false;
+    }
+
+    // ==========================================================================
+    // STATIC FACTORIES
+    // ==========================================================================
+
+    /**
+     * Resolve User from Astro locals (placed by middleware)
+     */
+    static fromLocals(locals) {
+        if (locals?.user) {
+            return new User(locals.user);
+        }
+        return null;
+    }
+}