@stnd/account 0.1.3 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @stnd/account
 
+## 0.2.0
+
+### Minor Changes
+
+- Auto-bumped @stnd/account due to modified code.
+
+### Patch Changes
+
+- Updated dependencies
+  - @stnd/styles@0.6.0
+
 ## 0.1.3
 
 ### Patch Changes

package/auth.js

@@ -89,18 +89,51 @@ export function initAuth(env) {
         "tauri://localhost",
       ];
 
+    const isDev = import.meta.env.DEV;
+    const resolvedSecret =
+      accountConfig.secret ||
+      env.BETTER_AUTH_SECRET ||
+      env.JWT_SECRET;
+
+    if (!resolvedSecret) {
+      if (!isDev) {
+        throw new Error(
+          "FATAL: BETTER_AUTH_SECRET (or JWT_SECRET) is required in production environments. Set it with `wrangler secret put BETTER_AUTH_SECRET`."
+        );
+      }
+      log.warn("Using insecure fallback 'dev-secret-key' in development mode.");
+    }
+
+    const secret = resolvedSecret || "dev-secret-key";
+
     const auth = betterAuth({
       baseURL:
         resolvedBaseURL ||
         (env.BASE_URL ? env.BASE_URL : "http://localhost:8089"),
-      secret:
-        accountConfig.secret ||
-        env.BETTER_AUTH_SECRET ||
-        env.JWT_SECRET ||
-        "dev-secret-key",
+      secret,
       advanced: {
         trustedOrigins: resolvedTrustedOrigins,
-        checkOrigin: false,
+        useSecureCookies: !isDev,
+      },
+      session: {
+        expiresIn: 60 * 60 * 24 * 7, // 7 days
+        updateAge: 60 * 60 * 24, // Refresh every 24 hours
+        cookieCache: {
+          enabled: true,
+          maxAge: 60 * 5, // 5 minutes cache in signed cookie
+        },
+      },
+      rateLimit: {
+        enabled: true,
+        window: 60,
+        max: 100,
+        customRules: {
+          "/sign-in/email": { window: 60, max: 5 },
+          "/sign-up/email": { window: 60, max: 3 },
+          "/magic-link/send": { window: 60, max: 3 },
+          "/email-otp/send-verification-otp": { window: 60, max: 3 },
+          "/passkey/verify-authentication": { window: 60, max: 10 },
+        },
       },
       database: {
         db: new Kysely({
@@ -112,6 +145,8 @@ export function initAuth(env) {
       },
       emailAndPassword: {
         enabled: true,
+        minPasswordLength: 8,
+        maxPasswordLength: 128,
       },
       user: {
         additionalFields: {
@@ -169,12 +204,20 @@ export function initAuth(env) {
                   from: accountConfig.emailFrom || "auth@standard.garden",
                   to: email,
                   subject: `Your login link to ${accountConfig.rpName || "Standard App"}`,
+                  headers: {
+                    "List-Unsubscribe": `<${resolvedBaseURL || "https://standard.garden"}>, <mailto:support@standard.garden?subject=unsubscribe>`,
+                  },
                   html: `
                     <div style="font-family: system-ui, sans-serif; max-width: 600px; margin: 0 auto; color: #111;">
                       <h1>Welcome!</h1>
                       <p>Click the link below to sign in:</p>
                       <a href="${url}" style="display:inline-block; padding:12px 24px; background:#111; color:#fff; text-decoration:none; border-radius:4px; font-weight:bold;">Sign In</a>
                       <p style="margin-top:24px; color:#666; font-size:14px;">This link expires in 15 minutes.</p>
+                      <hr style="border:none; border-top:1px solid #e5e7eb; margin:24px 0;" />
+                      <p style="color:#888; font-size:12px; line-height:1.5; margin:0;">
+                        Vous recevez ce courriel suite à une demande de connexion sur ${accountConfig.rpName || "Standard Garden"}.<br />
+                        Pour gérer vos préférences, vous désinscrire ou exercer votre droit à l'oubli, accédez à vos <a href="${resolvedBaseURL || "https://standard.garden"}" style="color:#444; text-decoration:underline;">paramètres de compte</a>.
+                      </p>
                     </div>
                   `,
                 }),
@@ -206,6 +249,9 @@ export function initAuth(env) {
                   from: accountConfig.emailFrom || "auth@standard.garden",
                   to: email,
                   subject: `Your login code: ${otp}`,
+                  headers: {
+                    "List-Unsubscribe": `<${resolvedBaseURL || "https://standard.garden"}>, <mailto:support@standard.garden?subject=unsubscribe>`,
+                  },
                   html: `
                     <div style="font-family: system-ui, sans-serif; max-width: 600px; margin: 0 auto; color: #111;">
                       <h1>Your Login Code</h1>
@@ -214,6 +260,11 @@ export function initAuth(env) {
                         ${otp}
                       </div>
                       <p style="color:#666; font-size:14px;">This code expires in 10 minutes.</p>
+                      <hr style="border:none; border-top:1px solid #e5e7eb; margin:24px 0;" />
+                      <p style="color:#888; font-size:12px; line-height:1.5; margin:0;">
+                        Vous recevez ce courriel suite à une demande de connexion sur ${accountConfig.rpName || "Standard Garden"}.<br />
+                        Pour gérer vos préférences, vous désinscrire ou exercer votre droit à l'oubli, accédez à vos <a href="${resolvedBaseURL || "https://standard.garden"}" style="color:#444; text-decoration:underline;">paramètres de compte</a>.
+                      </p>
                     </div>
                   `,
                 }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stnd/account",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "type": "module",
   "svelte": "./ui/UserMenu.svelte",
   "main": "./index.module.js",
@@ -27,7 +27,7 @@
     "@stnd/art": "0.1.1",
     "@stnd/icon": "0.2.2",
     "@stnd/log": "0.5.1",
-    "@stnd/styles": "0.5.4",
+    "@stnd/styles": "0.6.0",
     "@stnd/utils": "0.5.1"
   },
   "peerDependencies": {