@tatara/cli 0.9.1 → 0.10.0

package/templates/features/better-auth/files/src/modules/users/services/auth.ts

@@ -0,0 +1,37 @@
+import { createAuthInstance } from "@tatara/auth";
+import { newId } from "@tatara/db";
+import { bearer, openAPI } from "better-auth/plugins";
+import { env } from "#core/config/env";
+import { database } from "#modules/users/services/adapter";
+// tatara:slot imports
+
+/**
+ * The app's better-auth for its users. The options are the app's own; tatara only adds the
+ * principal middleware and the org check that come back with the instance.
+ */
+export const { auth, attachPrincipal, requireOrg } = createAuthInstance(
+	{
+		appName: "__APP_NAME__",
+		baseURL: env.APP_URL,
+		basePath: "/api/auth",
+		secret: env.BETTER_AUTH_SECRET,
+		trustedOrigins: env.CORS_ORIGINS,
+		database,
+		advanced: { database: { generateId: () => newId() } },
+		// tatara:slot options
+		plugins: [
+			// Authorization: Bearer <session token> for mobile and API clients
+			bearer(),
+			// reference for the auth endpoints at /api/auth/reference
+			openAPI(),
+			// tatara:slot plugins
+		],
+	},
+	{
+		resolvers: [
+			// tatara:slot resolvers
+		],
+	},
+);
+
+export type Session = typeof auth.$Infer.Session;

package/templates/features/better-auth/files/src/{core/auth → modules/users/services}/delivery.ts

@@ -1,5 +1,5 @@
 import { createOutbox } from "@tatara/auth";
-import { smsSender } from "#core/auth/sms";
+import { smsSender } from "#modules/users/services/sms";
 import { env } from "#core/config/env";
 // tatara:slot imports
 

package/templates/features/better-auth/files/tests/helpers/auth.ts

@@ -1,5 +1,5 @@
 import { createTestUser as createUser, sessionHeaders } from "@tatara/auth/testing";
-import { auth } from "#core/auth/auth";
+import { auth } from "#modules/users/services/auth";
 // tatara:slot imports
 
 export interface AsUserOptions {
@@ -24,10 +24,11 @@ export async function createTestUser(options: AsUserOptions = {}): Promise<strin
 /** A new user with a real session; the token is sent as a bearer token. */
 export async function authenticate(
 	options: AsUserOptions = {},
-): Promise<{ userId: string; headers: Record<string, string> }> {
+): Promise<{ userId: string; orgId?: string; headers: Record<string, string> }> {
 	// tatara:slot authenticate
 	const userId = await createTestUser(options);
-	return { userId, headers: await sessionHeaders(auth, userId) };
+	const headers = await sessionHeaders(auth, userId);
+	// tatara:slot authenticated
 }
 
 /** Headers that authenticate as a new user. */

package/templates/features/better-auth/files+admin/tests/tatara/auth-openapi-admin.test.ts

@@ -0,0 +1,10 @@
+import { expect, it } from "vitest";
+import { adminApi } from "#tests/helpers/api";
+
+it("documents the staff auth on the admin app, not the users' sign-up", async () => {
+	const res = await adminApi.get<{ paths: Record<string, unknown> }>("/openapi.json");
+	expect(res.status).toBe(200);
+	const paths = Object.keys(res.body.paths);
+	expect(paths).toContain("/api/auth/sign-in/email");
+	expect(paths.some((path) => path.startsWith("/api/auth/sign-in/anonymous"))).toBe(false);
+});

package/templates/features/better-auth/files+auth-orgs/{src/core/auth/tests/principal.test.ts → tests/tatara/auth-principal.test.ts}

@@ -1,5 +1,5 @@
 import { beforeEach, describe, expect, it } from "vitest";
-import { auth } from "#core/auth/auth";
+import { auth } from "#modules/users/services/auth";
 import { api } from "#tests/helpers/api";
 import { authenticate } from "#tests/helpers/auth";
 import { resetDatabase } from "#tests/helpers/db";

package/templates/features/better-auth/files+auth-orgs+authz/{src/core/auth/tests/principal-authz.test.ts → tests/tatara/auth-principal-authz.test.ts}

@@ -1,5 +1,5 @@
 import { beforeEach, expect, it } from "vitest";
-import { auth } from "#core/auth/auth";
+import { auth } from "#modules/users/services/auth";
 import { api } from "#tests/helpers/api";
 import { authenticate } from "#tests/helpers/auth";
 import { applyTestAccess } from "#tests/helpers/authz";

package/templates/features/better-auth/files+drizzle+mysql/src/{core/auth → modules/users/services}/adapter.ts

@@ -1,5 +1,5 @@
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
-import * as authSchema from "#core/auth/db/auth.schema";
+import * as authSchema from "#modules/users/db/auth.schema";
 import { db } from "#core/db/client";
 // tatara:slot imports
 

package/templates/features/better-auth/files+drizzle+postgres/src/{core/auth → modules/users/services}/adapter.ts

@@ -1,5 +1,5 @@
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
-import * as authSchema from "#core/auth/db/auth.schema";
+import * as authSchema from "#modules/users/db/auth.schema";
 import { db } from "#core/db/client";
 // tatara:slot imports
 

package/templates/versions.json

@@ -33,11 +33,11 @@
   "@types/nodemailer": "8.0.2",
   "@tatara/core": "0.1.1",
   "@tatara/http": "0.1.1",
-  "@tatara/db": "0.2.0",
+  "@tatara/db": "0.2.1",
   "@tatara/testing": "0.1.1",
-  "@tatara/auth": "0.1.1",
-  "@tatara/keycloak": "0.1.1",
-  "@tatara/authz": "0.2.0",
+  "@tatara/auth": "0.2.0",
+  "@tatara/keycloak": "0.1.2",
+  "@tatara/authz": "0.3.0",
   "@tatara/storage": "0.2.0",
   "@tatara/email": "0.2.0",
   "@tatara/i18n": "0.1.0",

package/templates/features/better-auth/files/src/core/auth/auth.ts

@@ -1,26 +0,0 @@
-import { betterAuth } from "better-auth";
-import { bearer, openAPI } from "better-auth/plugins";
-import { database } from "#core/auth/adapter";
-import { env } from "#core/config/env";
-import { newId } from "@tatara/db";
-// tatara:slot imports
-
-export const auth = betterAuth({
-	appName: "__APP_NAME__",
-	baseURL: env.APP_URL,
-	basePath: "/api/auth",
-	secret: env.BETTER_AUTH_SECRET,
-	trustedOrigins: env.CORS_ORIGINS,
-	database,
-	advanced: { database: { generateId: () => newId() } },
-	// tatara:slot options
-	plugins: [
-		// Authorization: Bearer <session token> for mobile and API clients
-		bearer(),
-		// reference for the auth endpoints at /api/auth/reference
-		openAPI(),
-		// tatara:slot plugins
-	],
-});
-
-export type Session = typeof auth.$Infer.Session;

package/templates/features/better-auth/files/src/core/auth/principal.ts

@@ -1,10 +0,0 @@
-import { principalMiddleware, sessionPrincipal } from "@tatara/auth";
-import { auth } from "#core/auth/auth";
-import type { AppEnv } from "#core/http/context";
-// tatara:slot imports
-
-/** Sets `c.var.principal` from the first resolver that recognises the request's credentials. */
-export const attachPrincipal = principalMiddleware<AppEnv>([
-	(c) => sessionPrincipal(auth, c.req.raw.headers),
-	// tatara:slot resolvers
-]);

package/templates/features/better-auth/files+admin/src/core/auth/tests/openapi-admin.test.ts

@@ -1,8 +0,0 @@
-import { expect, it } from "vitest";
-import { adminApi } from "#tests/helpers/api";
-
-it("leaves auth out of the admin OpenAPI document", async () => {
-	const res = await adminApi.get<{ paths: Record<string, unknown> }>("/openapi.json");
-	expect(res.status).toBe(200);
-	expect(Object.keys(res.body.paths).some((path) => path.startsWith("/api/auth/"))).toBe(false);
-});