@teamblind/axeda-better-auth 0.0.0-stage → 0.1.0-alpha.0

package/dist/schema.d.ts

@@ -0,0 +1,462 @@
+/** Nombres de los modelos que Axeda añade al esquema de Better Auth. */
+export declare const MODELS: {
+    readonly role: "axedaRole";
+    readonly assignment: "axedaAssignment";
+    readonly state: "axedaState";
+    readonly audit: "axedaAudit";
+    readonly company: "axedaCompany";
+    readonly business: "axedaBusiness";
+    readonly invitation: "axedaInvitation";
+};
+/** Fila única de `axedaState` que guarda la versión de política. */
+export declare const POLICY_STATE_KEY = "policy";
+/**
+ * Valor guardado en `scopeId` para una asignación global. Es una cadena vacía y no `null`
+ * porque un índice único trata los `NULL` como distintos: con `null` podrían duplicarse
+ * asignaciones globales.
+ */
+export declare const GLOBAL_SCOPE_ID = "";
+/**
+ * Esquema que el plugin añade a Better Auth. Las migraciones las genera Better Auth a partir
+ * de esto (`getMigrations` o su CLI). Reglas: columnas nuevas siempre opcionales o con valor
+ * por defecto; un cambio destructivo exige una migración manual.
+ */
+export declare const axedaSchema: {
+    user: {
+        fields: {
+            /** Sube con cada cambio que afecta a la autorización de ese usuario. */
+            authzVersion: {
+                type: "number";
+                required: false;
+                defaultValue: number;
+                input: false;
+            };
+            banned: {
+                type: "boolean";
+                required: false;
+                defaultValue: false;
+                input: false;
+            };
+            banReason: {
+                type: "string";
+                required: false;
+                input: false;
+            };
+            banExpires: {
+                type: "date";
+                required: false;
+                input: false;
+            };
+        };
+    };
+    axedaRole: {
+        fields: {
+            key: {
+                type: "string";
+                required: true;
+                unique: true;
+                input: false;
+            };
+            name: {
+                type: "string";
+                required: true;
+                input: false;
+            };
+            description: {
+                type: "string";
+                required: false;
+                input: false;
+            };
+            permissions: {
+                type: "string[]";
+                required: true;
+                input: false;
+            };
+            requireMfa: {
+                type: "boolean";
+                required: true;
+                defaultValue: false;
+                input: false;
+            };
+            status: {
+                type: "string";
+                required: true;
+                defaultValue: string;
+                input: false;
+            };
+            managed: {
+                type: "boolean";
+                required: true;
+                defaultValue: false;
+                input: false;
+            };
+            version: {
+                type: "number";
+                required: true;
+                defaultValue: number;
+                input: false;
+            };
+            createdAt: {
+                type: "date";
+                required: true;
+                input: false;
+            };
+            updatedAt: {
+                type: "date";
+                required: true;
+                input: false;
+            };
+        };
+    };
+    axedaAssignment: {
+        fields: {
+            userId: {
+                type: "string";
+                required: true;
+                input: false;
+                references: {
+                    model: string;
+                    field: string;
+                    onDelete: "cascade";
+                };
+            };
+            roleId: {
+                type: "string";
+                required: true;
+                input: false;
+                references: {
+                    model: "axedaRole";
+                    field: string;
+                    onDelete: "cascade";
+                };
+            };
+            scopeType: {
+                type: "string";
+                required: true;
+                input: false;
+            };
+            scopeId: {
+                type: "string";
+                required: true;
+                input: false;
+            };
+            grantedBy: {
+                type: "string";
+                required: false;
+                input: false;
+            };
+            createdAt: {
+                type: "date";
+                required: true;
+                input: false;
+            };
+            expiresAt: {
+                type: "date";
+                required: false;
+                input: false;
+            };
+        };
+        indexes: ({
+            fields: [string, string, string, string];
+            unique: true;
+        } | {
+            fields: [string, string];
+            unique?: never;
+        })[];
+    };
+    axedaState: {
+        fields: {
+            key: {
+                type: "string";
+                required: true;
+                unique: true;
+                input: false;
+            };
+            version: {
+                type: "number";
+                required: true;
+                defaultValue: number;
+                input: false;
+            };
+        };
+    };
+    axedaAudit: {
+        fields: {
+            actorId: {
+                type: "string";
+                required: false;
+                input: false;
+            };
+            action: {
+                type: "string";
+                required: true;
+                input: false;
+            };
+            targetType: {
+                type: "string";
+                required: true;
+                input: false;
+            };
+            targetId: {
+                type: "string";
+                required: false;
+                input: false;
+            };
+            scopeType: {
+                type: "string";
+                required: false;
+                input: false;
+            };
+            scopeId: {
+                type: "string";
+                required: false;
+                input: false;
+            };
+            outcome: {
+                type: "string";
+                required: true;
+                input: false;
+            };
+            ip: {
+                type: "string";
+                required: false;
+                input: false;
+            };
+            userAgent: {
+                type: "string";
+                required: false;
+                input: false;
+            };
+            metadata: {
+                type: "json";
+                required: true;
+                input: false;
+            };
+            at: {
+                type: "date";
+                required: true;
+                input: false;
+            };
+        };
+        indexes: ({
+            fields: [string];
+        } | {
+            fields: [string, string];
+        })[];
+    };
+    axedaCompany: {
+        fields: {
+            slug: {
+                type: "string";
+                required: true;
+                unique: true;
+                input: false;
+            };
+            name: {
+                type: "string";
+                required: true;
+                input: false;
+            };
+            legalName: {
+                type: "string";
+                required: false;
+                input: false;
+            };
+            logoUrl: {
+                type: "string";
+                required: false;
+                input: false;
+            };
+            faviconUrl: {
+                type: "string";
+                required: false;
+                input: false;
+            };
+            status: {
+                type: "string";
+                required: true;
+                defaultValue: string;
+                input: false;
+            };
+            metadata: {
+                type: "json";
+                required: true;
+                input: false;
+            };
+            version: {
+                type: "number";
+                required: true;
+                defaultValue: number;
+                input: false;
+            };
+            deletedAt: {
+                type: "date";
+                required: false;
+                input: false;
+            };
+            createdAt: {
+                type: "date";
+                required: true;
+                input: false;
+            };
+            updatedAt: {
+                type: "date";
+                required: true;
+                input: false;
+            };
+        };
+        indexes: {
+            fields: [string];
+        }[];
+    };
+    axedaBusiness: {
+        fields: {
+            companyId: {
+                type: "string";
+                required: true;
+                input: false;
+                references: {
+                    model: "axedaCompany";
+                    field: string;
+                    onDelete: "cascade";
+                };
+            };
+            slug: {
+                type: "string";
+                required: true;
+                input: false;
+            };
+            name: {
+                type: "string";
+                required: true;
+                input: false;
+            };
+            logoUrl: {
+                type: "string";
+                required: false;
+                input: false;
+            };
+            faviconUrl: {
+                type: "string";
+                required: false;
+                input: false;
+            };
+            status: {
+                type: "string";
+                required: true;
+                defaultValue: string;
+                input: false;
+            };
+            metadata: {
+                type: "json";
+                required: true;
+                input: false;
+            };
+            version: {
+                type: "number";
+                required: true;
+                defaultValue: number;
+                input: false;
+            };
+            deletedAt: {
+                type: "date";
+                required: false;
+                input: false;
+            };
+            createdAt: {
+                type: "date";
+                required: true;
+                input: false;
+            };
+            updatedAt: {
+                type: "date";
+                required: true;
+                input: false;
+            };
+        };
+        indexes: ({
+            fields: [string, string];
+            unique: true;
+        } | {
+            fields: [string];
+            unique?: never;
+        })[];
+    };
+    axedaInvitation: {
+        fields: {
+            email: {
+                type: "string";
+                required: true;
+                input: false;
+            };
+            scopeType: {
+                type: "string";
+                required: true;
+                input: false;
+            };
+            scopeId: {
+                type: "string";
+                required: true;
+                input: false;
+            };
+            roleIds: {
+                type: "string[]";
+                required: true;
+                input: false;
+            };
+            invitedBy: {
+                type: "string";
+                required: true;
+                input: false;
+            };
+            secretHash: {
+                type: "string";
+                required: true;
+                input: false;
+            };
+            expiresAt: {
+                type: "date";
+                required: true;
+                input: false;
+            };
+            acceptedAt: {
+                type: "date";
+                required: false;
+                input: false;
+            };
+            revokedAt: {
+                type: "date";
+                required: false;
+                input: false;
+            };
+            /**
+             * Clave única mientras la invitación está pendiente (hash de correo + alcance); al
+             * cerrarla pasa a `closed:<id>`. Así dos invitaciones iguales a la vez no caben, sin
+             * depender de índices parciales que no todas las bases tienen.
+             */
+            pendingKey: {
+                type: "string";
+                required: true;
+                unique: true;
+                input: false;
+            };
+            /** 0 mientras está pendiente. Se sube con `incrementOne`: solo un cierre lo consigue. */
+            consumed: {
+                type: "number";
+                required: true;
+                defaultValue: number;
+                input: false;
+            };
+            createdAt: {
+                type: "date";
+                required: true;
+                input: false;
+            };
+        };
+        indexes: ({
+            fields: [string, string];
+        } | {
+            fields: [string];
+        })[];
+    };
+};

package/dist/schema.js

@@ -0,0 +1,162 @@
+/** Nombres de los modelos que Axeda añade al esquema de Better Auth. */
+export const MODELS = {
+    role: 'axedaRole',
+    assignment: 'axedaAssignment',
+    state: 'axedaState',
+    audit: 'axedaAudit',
+    company: 'axedaCompany',
+    business: 'axedaBusiness',
+    invitation: 'axedaInvitation',
+};
+/** Fila única de `axedaState` que guarda la versión de política. */
+export const POLICY_STATE_KEY = 'policy';
+/**
+ * Valor guardado en `scopeId` para una asignación global. Es una cadena vacía y no `null`
+ * porque un índice único trata los `NULL` como distintos: con `null` podrían duplicarse
+ * asignaciones globales.
+ */
+export const GLOBAL_SCOPE_ID = '';
+/**
+ * Esquema que el plugin añade a Better Auth. Las migraciones las genera Better Auth a partir
+ * de esto (`getMigrations` o su CLI). Reglas: columnas nuevas siempre opcionales o con valor
+ * por defecto; un cambio destructivo exige una migración manual.
+ */
+export const axedaSchema = {
+    user: {
+        fields: {
+            /** Sube con cada cambio que afecta a la autorización de ese usuario. */
+            authzVersion: { type: 'number', required: false, defaultValue: 0, input: false },
+            // Mismos nombres y tipos que el plugin `admin` de Better Auth, para que convivan.
+            banned: { type: 'boolean', required: false, defaultValue: false, input: false },
+            banReason: { type: 'string', required: false, input: false },
+            banExpires: { type: 'date', required: false, input: false },
+        },
+    },
+    [MODELS.role]: {
+        fields: {
+            key: { type: 'string', required: true, unique: true, input: false },
+            name: { type: 'string', required: true, input: false },
+            description: { type: 'string', required: false, input: false },
+            permissions: { type: 'string[]', required: true, input: false },
+            requireMfa: { type: 'boolean', required: true, defaultValue: false, input: false },
+            status: { type: 'string', required: true, defaultValue: 'active', input: false },
+            managed: { type: 'boolean', required: true, defaultValue: false, input: false },
+            version: { type: 'number', required: true, defaultValue: 1, input: false },
+            createdAt: { type: 'date', required: true, input: false },
+            updatedAt: { type: 'date', required: true, input: false },
+        },
+    },
+    [MODELS.assignment]: {
+        fields: {
+            userId: {
+                type: 'string',
+                required: true,
+                input: false,
+                references: { model: 'user', field: 'id', onDelete: 'cascade' },
+            },
+            roleId: {
+                type: 'string',
+                required: true,
+                input: false,
+                references: { model: MODELS.role, field: 'id', onDelete: 'cascade' },
+            },
+            scopeType: { type: 'string', required: true, input: false },
+            scopeId: { type: 'string', required: true, input: false },
+            grantedBy: { type: 'string', required: false, input: false },
+            createdAt: { type: 'date', required: true, input: false },
+            expiresAt: { type: 'date', required: false, input: false },
+        },
+        indexes: [
+            { fields: ['userId', 'roleId', 'scopeType', 'scopeId'], unique: true },
+            { fields: ['scopeType', 'scopeId'] },
+        ],
+    },
+    [MODELS.state]: {
+        fields: {
+            key: { type: 'string', required: true, unique: true, input: false },
+            version: { type: 'number', required: true, defaultValue: 0, input: false },
+        },
+    },
+    [MODELS.audit]: {
+        fields: {
+            // Sin clave foránea: la auditoría debe sobrevivir al borrado del usuario.
+            actorId: { type: 'string', required: false, input: false },
+            action: { type: 'string', required: true, input: false },
+            targetType: { type: 'string', required: true, input: false },
+            targetId: { type: 'string', required: false, input: false },
+            scopeType: { type: 'string', required: false, input: false },
+            scopeId: { type: 'string', required: false, input: false },
+            outcome: { type: 'string', required: true, input: false },
+            ip: { type: 'string', required: false, input: false },
+            userAgent: { type: 'string', required: false, input: false },
+            metadata: { type: 'json', required: true, input: false },
+            at: { type: 'date', required: true, input: false },
+        },
+        indexes: [
+            { fields: ['actorId'] },
+            { fields: ['targetType', 'targetId'] },
+            { fields: ['scopeType', 'scopeId'] },
+        ],
+    },
+    [MODELS.company]: {
+        fields: {
+            slug: { type: 'string', required: true, unique: true, input: false },
+            name: { type: 'string', required: true, input: false },
+            legalName: { type: 'string', required: false, input: false },
+            logoUrl: { type: 'string', required: false, input: false },
+            faviconUrl: { type: 'string', required: false, input: false },
+            status: { type: 'string', required: true, defaultValue: 'active', input: false },
+            metadata: { type: 'json', required: true, input: false },
+            version: { type: 'number', required: true, defaultValue: 1, input: false },
+            deletedAt: { type: 'date', required: false, input: false },
+            createdAt: { type: 'date', required: true, input: false },
+            updatedAt: { type: 'date', required: true, input: false },
+        },
+        indexes: [{ fields: ['deletedAt'] }],
+    },
+    [MODELS.business]: {
+        fields: {
+            companyId: {
+                type: 'string',
+                required: true,
+                input: false,
+                references: { model: MODELS.company, field: 'id', onDelete: 'cascade' },
+            },
+            slug: { type: 'string', required: true, input: false },
+            name: { type: 'string', required: true, input: false },
+            logoUrl: { type: 'string', required: false, input: false },
+            faviconUrl: { type: 'string', required: false, input: false },
+            status: { type: 'string', required: true, defaultValue: 'active', input: false },
+            metadata: { type: 'json', required: true, input: false },
+            version: { type: 'number', required: true, defaultValue: 1, input: false },
+            deletedAt: { type: 'date', required: false, input: false },
+            createdAt: { type: 'date', required: true, input: false },
+            updatedAt: { type: 'date', required: true, input: false },
+        },
+        indexes: [{ fields: ['companyId', 'slug'], unique: true }, { fields: ['deletedAt'] }],
+    },
+    [MODELS.invitation]: {
+        fields: {
+            email: { type: 'string', required: true, input: false },
+            scopeType: { type: 'string', required: true, input: false },
+            scopeId: { type: 'string', required: true, input: false },
+            roleIds: { type: 'string[]', required: true, input: false },
+            // Sin clave foránea: la invitación puede sobrevivir al usuario que invitó.
+            invitedBy: { type: 'string', required: true, input: false },
+            secretHash: { type: 'string', required: true, input: false },
+            expiresAt: { type: 'date', required: true, input: false },
+            acceptedAt: { type: 'date', required: false, input: false },
+            revokedAt: { type: 'date', required: false, input: false },
+            /**
+             * Clave única mientras la invitación está pendiente (hash de correo + alcance); al
+             * cerrarla pasa a `closed:<id>`. Así dos invitaciones iguales a la vez no caben, sin
+             * depender de índices parciales que no todas las bases tienen.
+             */
+            pendingKey: { type: 'string', required: true, unique: true, input: false },
+            /** 0 mientras está pendiente. Se sube con `incrementOne`: solo un cierre lo consigue. */
+            consumed: { type: 'number', required: true, defaultValue: 0, input: false },
+            createdAt: { type: 'date', required: true, input: false },
+        },
+        indexes: [{ fields: ['scopeType', 'scopeId'] }, { fields: ['email'] }],
+    },
+};

package/dist/shared.d.ts

@@ -0,0 +1,15 @@
+import type { DBAdapter, DBTransactionAdapter } from '@better-auth/core/db/adapter';
+export type Adapter = DBAdapter | DBTransactionAdapter;
+/** Ejecuta `work` de forma atómica con el adaptador que corresponda. */
+export type Atomic = <T>(work: (adapter: Adapter) => Promise<T>) => Promise<T>;
+export declare const encodeCursor: (value: string) => string;
+export declare const decodeCursor: (cursor: string) => string;
+export declare const byId: (id: string) => {
+    field: string;
+    value: string;
+}[];
+/**
+ * Better Auth limita `findMany` a 100 filas si no se indica otra cosa. Para datos de seguridad
+ * un tope silencioso es peligroso, así que siempre se pide un límite explícito.
+ */
+export declare const MAX_ROWS = 10000;

package/dist/shared.js

@@ -0,0 +1,8 @@
+export const encodeCursor = (value) => Buffer.from(value, 'utf8').toString('base64url');
+export const decodeCursor = (cursor) => Buffer.from(cursor, 'base64url').toString('utf8');
+export const byId = (id) => [{ field: 'id', value: id }];
+/**
+ * Better Auth limita `findMany` a 100 filas si no se indica otra cosa. Para datos de seguridad
+ * un tope silencioso es peligroso, así que siempre se pide un límite explícito.
+ */
+export const MAX_ROWS = 10_000;

package/dist/stores.d.ts

@@ -0,0 +1,13 @@
+import type { BetterAuthOptions } from '@better-auth/core';
+import type { DBAdapter } from '@better-auth/core/db/adapter';
+import { type AxedaPersistence } from '@teamblind/axeda-core';
+export interface BetterAuthPersistenceOptions {
+    /** Reloj para `createdAt` y `updatedAt`. Por defecto, la hora del sistema. */
+    readonly now?: () => Date;
+}
+/**
+ * Implementa los puertos de persistencia de Axeda sobre el adaptador de base de datos de
+ * Better Auth (`ctx.adapter`). Sirve para cualquier base que Better Auth soporte; las
+ * transacciones deben ser reales, algo que Axeda comprueba al arrancar.
+ */
+export declare function createBetterAuthPersistence<Options extends BetterAuthOptions>(databaseAdapter: DBAdapter<Options>, options?: BetterAuthPersistenceOptions): AxedaPersistence;