@teamblind/axeda-better-auth 0.1.0-alpha.0 → 0.1.0-alpha.1

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @teamblind/axeda-better-auth
 
+## 0.1.0-alpha.1
+
+### Minor Changes
+
+- a8a33dd: Add an absolute lifetime to sessions. Better Auth renews a session every time it is used, so a session in daily use never ended. The plugin now cuts a session's expiry, when it is created and on every renewal, so it never goes past its creation plus `maxSessionAge` (30 days by default, in seconds; `false` turns it off). It applies in Better Auth's own endpoints and in your routes, with sessions in the database or in `secondaryStorage`, and signing in again starts a new count. Sessions that are already older than 30 days are cut the next time Better Auth renews them. While the limit holds a session back, Better Auth writes the session row on every request during the last `session.expiresIn` minus `session.updateAge` of its life, instead of once a day.
+- 0d37dca: Index the `action` column of the audit log. Listing the audit log filtered by action read the whole table, so it got slower as the log grew (30 to 74 ms with 200,000 events in PostgreSQL 16 and 18, measured with `EXPLAIN`); with the index it takes a fraction of a millisecond. Better Auth creates the index when you run its migration. On a very large audit table, building it blocks writes to that table while it runs, so run the migration at a quiet moment. On MySQL, a table created before this version has `action` as `text`, which Better Auth will not index: run `ALTER TABLE axedaAudit MODIFY action varchar(255) NOT NULL;` before the migration (a new database is not affected).
+- 547cc20: Support MongoDB (tested on 7.0 in the CI and on 8.0 by hand, on a replica set; a single node is enough). Give Better Auth `mongodbAdapter(db, { client })`. MongoDB has no migrations in Better Auth, so Axeda writes once, before its first transaction, in each of its collections so that the adapter creates them and their indexes outside of a transaction, where a first use made the transaction hang. On a standalone `mongod` Axeda now stops at start with `AXEDA_TRANSACTIONS_UNSUPPORTED` and says what to do.
+
+  The unique constraints of Axeda's tables (role key, company slug, the policy state key and the pending invitation key) are now declared as unique table indexes instead of `unique` fields, because Better Auth's MongoDB adapter only creates table indexes, and without them two simultaneous writes with the same key both succeeded. On SQL they are the same constraint: running Better Auth's migration on an existing database adds the unique indexes next to the old column constraints (four small extra indexes), keeps every row and still refuses duplicates, which a test checks against the schema of 0.1.0-alpha.0.
+
+- Support MySQL (8.4 and 9, tested against real servers with a connection pool). Give Better Auth the pool from `mysql2/promise` (not the one from `mysql2`) created with `timezone: 'Z'`; without it the driver converts dates to the local time of your process. On a server that stores table names in lowercase (`lower_case_table_names` 1 or 2: Windows, macOS and some managed services) Better Auth's schema check reports Axeda's tables as missing, so turn it off with `advanced: { database: { validateSchema: false } }`. The reference lists both, and what to do when upgrading an existing MySQL database.
+
+### Patch Changes
+
+- Updated dependencies [ce83aff]
+  - @teamblind/axeda-core@0.1.0-alpha.1
+
 ## 0.1.0-alpha.0
 
 ### Minor Changes

package/README.md

@@ -1,14 +1,88 @@
 # @teamblind/axeda-better-auth
 
-The Better Auth plugin for Axeda: schema, `/axeda/*` endpoints, the typed client, `secureAuthOptions()` and the stores that persist everything through Better Auth's database adapter (SQLite and PostgreSQL verified).
+The Better Auth plugin for Axeda: schema, `/axeda/*` endpoints, the typed client, `secureAuthOptions()` and the stores that persist everything through Better Auth's database adapter. It runs on SQLite, PostgreSQL, MySQL and MongoDB.
 
-> **Status:** alpha (`0.1.0-alpha.0`); the API can still change before 1.0. Install with `npm install @teamblind/axeda-better-auth@alpha`. Documentation: [English](https://github.com/teamblindmx/axeda/tree/main/docs/en) · [Español](https://github.com/teamblindmx/axeda/tree/main/docs/es).
+> **Status:** alpha (`0.1.0-alpha.1`); the API can still change before 1.0. Install with `npm install @teamblind/axeda-better-auth@alpha better-auth @better-auth/core`. Documentation: [English](https://github.com/teamblindmx/axeda/tree/main/docs/en) · [Español](https://github.com/teamblindmx/axeda/tree/main/docs/es).
+
+## Install
+
+```bash
+npm install @teamblind/axeda-better-auth@alpha better-auth @better-auth/core
+# to protect Express routes as well:
+npm install @teamblind/axeda-express@alpha express
+```
+
+Node.js 22 or later. ES modules only. Peer dependencies: `better-auth` and `@better-auth/core` (`^1.7.10`; tested on 1.7.10 and 1.7.17).
+
+## Use
 
 ```ts
-import { axeda, secureAuthOptions, sessionPrincipal } from '@teamblind/axeda-better-auth';
+import { betterAuth } from 'better-auth';
+import { getMigrations } from 'better-auth/db/migration';
+import { axeda, secureAuthOptions } from '@teamblind/axeda-better-auth';
+
+const axedaPlugin = axeda({
+  permissions: ['invoice:read', 'invoice:create'],
+  roles: { viewer: { name: 'Viewer', permissions: ['invoice:read'] } },
+});
+
+const options = {
+  ...secureAuthOptions({
+    baseURL: 'https://api.example.com',
+    secret: process.env.BETTER_AUTH_SECRET!, // at least 32 random characters
+    trustedOrigins: ['https://app.example.com'],
+  }),
+  database, // see "Databases" below
+  plugins: [axedaPlugin],
+  emailVerification: { sendOnSignUp: true, sendVerificationEmail }, // yours
+};
+
+await (await getMigrations(options)).runMigrations(); // SQL databases; MongoDB needs none
+const auth = betterAuth(options);
+await auth.$context;
+await axedaPlugin.start(); // checks the database has real transactions, syncs your roles
+```
+
+From the browser:
+
+```ts
+import { createAuthClient } from 'better-auth/client';
 import { axedaClient } from '@teamblind/axeda-better-auth/client';
+
+const client = createAuthClient({ baseURL: 'https://api.example.com', plugins: [axedaClient()] });
 ```
 
-Peer dependencies: `better-auth` and `@better-auth/core` (`^1.7.10`; tested on 1.7.10 and 1.7.14).
+## What you configure
+
+Axeda reads no environment variables: everything is passed in code.
+
+| You configure…                      | With                         | Required                                           |
+| ----------------------------------- | ---------------------------- | -------------------------------------------------- |
+| Better Auth: URLs, secret, sessions | `secureAuthOptions({ … })`   | `baseURL`, `secret`, `trustedOrigins`              |
+| Better Auth: the rest               | your own `betterAuth({ … })` | `database`, `plugins`, a verification email sender |
+| What Axeda manages                  | `axeda({ … })`               | `permissions`                                      |
+
+Every option, its accepted values, its default and what happens when it is wrong are in the
+[Configuration guide](https://github.com/teamblindmx/axeda/blob/main/docs/en/configuration.md).
+
+## Databases
+
+| Database   | What you give Better Auth                                  | Checked in the CI       |
+| ---------- | ---------------------------------------------------------- | ----------------------- |
+| SQLite     | `new Database(file)` from `better-sqlite3`                 | In memory               |
+| PostgreSQL | `new pg.Pool({ connectionString })`                        | 16 and 18, real servers |
+| MySQL      | `createPool({ uri, timezone: 'Z' })` from `mysql2/promise` | 8.4 and 9, real servers |
+| MongoDB    | `mongodbAdapter(db, { client })`, on a replica set         | 7.0, a real replica set |
+
+Axeda refuses to start on a database without real transactions. MySQL and MongoDB have settings of their
+own: see [Databases](https://github.com/teamblindmx/axeda/blob/main/docs/en/reference.md#databases).
+
+## Guides
+
+- [Quick start](https://github.com/teamblindmx/axeda/blob/main/docs/en/quickstart.md): run the example, then add Axeda to your app.
+- [Configuration](https://github.com/teamblindmx/axeda/blob/main/docs/en/configuration.md): every option, the startup order and a production checklist.
+- [Reference](https://github.com/teamblindmx/axeda/blob/main/docs/en/reference.md): endpoints, error codes and the TypeScript API.
+- [Security](https://github.com/teamblindmx/axeda/blob/main/docs/en/security.md): what `secureAuthOptions()` fixes and what stays yours.
+- [Upgrading](https://github.com/teamblindmx/axeda/blob/main/docs/en/upgrading.md): from `0.1.0-alpha.0`.
 
 Part of [Axeda](https://github.com/teamblindmx/axeda), hierarchical authorization (global → company → business) on top of [Better Auth](https://www.better-auth.com). Licensed under [Apache-2.0](LICENSE).

package/dist/plugin.d.ts

@@ -21,6 +21,13 @@ export interface AxedaPluginOptions extends AxedaOptions {
      * sesión). Desactivado por defecto: es el único endpoint que no exige iniciar sesión.
      */
     readonly publicIdentity?: boolean;
+    /**
+     * La vida máxima de una sesión, en segundos, contada desde que se abrió. Better Auth renueva la
+     * sesión mientras se usa (`session.expiresIn` es el tiempo sin actividad), así que sin esto una
+     * sesión usada a diario no caducaría nunca. Pasado este tiempo hay que volver a iniciar sesión.
+     * Por defecto 30 días; `false` lo desactiva.
+     */
+    readonly maxSessionAge?: number | false;
 }
 /**
  * Plugin de Axeda para Better Auth: esquema, endpoints `/axeda/*`, el hook de borrado de usuario
@@ -66,7 +73,6 @@ export declare function axeda(options: AxedaPluginOptions): {
                 key: {
                     type: "string";
                     required: true;
-                    unique: true;
                     input: false;
                 };
                 name: {
@@ -119,6 +125,10 @@ export declare function axeda(options: AxedaPluginOptions): {
                     input: false;
                 };
             };
+            indexes: {
+                fields: [string];
+                unique: true;
+            }[];
         };
         axedaAssignment: {
             fields: {
@@ -181,7 +191,6 @@ export declare function axeda(options: AxedaPluginOptions): {
                 key: {
                     type: "string";
                     required: true;
-                    unique: true;
                     input: false;
                 };
                 version: {
@@ -191,6 +200,10 @@ export declare function axeda(options: AxedaPluginOptions): {
                     input: false;
                 };
             };
+            indexes: {
+                fields: [string];
+                unique: true;
+            }[];
         };
         axedaAudit: {
             fields: {
@@ -261,7 +274,6 @@ export declare function axeda(options: AxedaPluginOptions): {
                 slug: {
                     type: "string";
                     required: true;
-                    unique: true;
                     input: false;
                 };
                 name: {
@@ -317,9 +329,13 @@ export declare function axeda(options: AxedaPluginOptions): {
                     input: false;
                 };
             };
-            indexes: {
+            indexes: ({
                 fields: [string];
-            }[];
+                unique: true;
+            } | {
+                fields: [string];
+                unique?: never;
+            })[];
         };
         axedaBusiness: {
             fields: {
@@ -444,7 +460,6 @@ export declare function axeda(options: AxedaPluginOptions): {
                 pendingKey: {
                     type: "string";
                     required: true;
-                    unique: true;
                     input: false;
                 };
                 consumed: {
@@ -460,9 +475,14 @@ export declare function axeda(options: AxedaPluginOptions): {
                 };
             };
             indexes: ({
+                fields: [string];
+                unique: true;
+            } | {
                 fields: [string, string];
+                unique?: never;
             } | {
                 fields: [string];
+                unique?: never;
             })[];
         };
     };
@@ -1930,7 +1950,20 @@ export declare function axeda(options: AxedaPluginOptions): {
                     create: {
                         before: (session: {
                             userId: string;
-                        }) => Promise<void>;
+                        }) => Promise<{
+                            data: {
+                                expiresAt: Date;
+                            };
+                        } | undefined>;
+                    };
+                    update: {
+                        before: (session: {
+                            expiresAt?: unknown;
+                        }, context: unknown) => Promise<{
+                            data: {
+                                expiresAt: Date;
+                            };
+                        } | undefined>;
                     };
                 };
                 user: {

package/dist/plugin.js

@@ -4,6 +4,7 @@ import { createEndpoints } from './endpoints.js';
 import { createUserEndpoints } from './endpoints-users.js';
 import { createInvitationEndpoints, createPublicEndpoints, createTenantEndpoints, } from './endpoints-tenants.js';
 import { axedaSchema } from './schema.js';
+import { cappedExpiry, resolveMaxSessionAge, sessionBeingRefreshed } from './session-lifetime.js';
 import { createBetterAuthPersistence } from './stores.js';
 import { createBetterAuthUserAdmin } from './user-admin.js';
 import { createBetterAuthUserDirectory } from './users.js';
@@ -69,6 +70,7 @@ const RATE_LIMITS = [
  * ```
  */
 export function axeda(options) {
+    const maxSessionAge = resolveMaxSessionAge(options.maxSessionAge);
     let core;
     let persistence;
     const instance = () => {
@@ -146,6 +148,24 @@ export function axeda(options) {
                                             message: 'This account is suspended.',
                                         });
                                     }
+                                    // La vida máxima también recorta la sesión que nace (p. ej. si es menor que
+                                    // `session.expiresIn`).
+                                    const expiresAt = maxSessionAge === undefined
+                                        ? undefined
+                                        : cappedExpiry(session.expiresAt, session.createdAt ?? new Date(), maxSessionAge);
+                                    return expiresAt === undefined ? undefined : { data: { expiresAt } };
+                                },
+                            },
+                            update: {
+                                // Better Auth renueva la sesión moviendo su caducidad hacia delante cada vez que
+                                // se usa. Aquí se recorta para que nunca pase de su creación más la vida máxima, y
+                                // su propia caducidad hace el resto, en sus endpoints y en tus rutas.
+                                before: (session, context) => {
+                                    const current = sessionBeingRefreshed(context);
+                                    const expiresAt = maxSessionAge === undefined || current === undefined
+                                        ? undefined
+                                        : cappedExpiry(session.expiresAt, current.createdAt, maxSessionAge);
+                                    return Promise.resolve(expiresAt === undefined ? undefined : { data: { expiresAt } });
                                 },
                             },
                         },

package/dist/preset.d.ts

@@ -57,7 +57,7 @@ export interface SecureAuthOptions {
  * comodín o sin `https` en producción.
  *
  * No añade plugins (2FA, passkeys…): las funciones que exigen 2FA (`requireMfa`) necesitan el
- * plugin `twoFactor` de Better Auth, y conviene desactivar «confiar en este dispositivo» en las
- * cuentas administrativas (ver la guía de seguridad).
+ * plugin `twoFactor` de Better Auth, y conviene desactivar «confiar en este dispositivo» con
+ * `trustDeviceMaxAge: 0` en las cuentas administrativas (ver la guía de seguridad).
  */
 export declare function secureAuthOptions(input: SecureAuthInput): SecureAuthOptions;

package/dist/preset.js

@@ -74,8 +74,8 @@ function trustedOriginList(input, production) {
  * comodín o sin `https` en producción.
  *
  * No añade plugins (2FA, passkeys…): las funciones que exigen 2FA (`requireMfa`) necesitan el
- * plugin `twoFactor` de Better Auth, y conviene desactivar «confiar en este dispositivo» en las
- * cuentas administrativas (ver la guía de seguridad).
+ * plugin `twoFactor` de Better Auth, y conviene desactivar «confiar en este dispositivo» con
+ * `trustDeviceMaxAge: 0` en las cuentas administrativas (ver la guía de seguridad).
  */
 export function secureAuthOptions(input) {
     const production = (input.environment ?? 'production') === 'production';

package/dist/schema.d.ts

@@ -20,6 +20,10 @@ export declare const GLOBAL_SCOPE_ID = "";
  * Esquema que el plugin añade a Better Auth. Las migraciones las genera Better Auth a partir
  * de esto (`getMigrations` o su CLI). Reglas: columnas nuevas siempre opcionales o con valor
  * por defecto; un cambio destructivo exige una migración manual.
+ *
+ * Las restricciones únicas van como `indexes` con `unique: true` y no como `unique` de un campo: el
+ * adaptador de MongoDB de Better Auth solo crea los índices de tabla, y sin ellos dos escrituras
+ * simultáneas con la misma clave caben las dos. En SQL son equivalentes.
  */
 export declare const axedaSchema: {
     user: {
@@ -54,7 +58,6 @@ export declare const axedaSchema: {
             key: {
                 type: "string";
                 required: true;
-                unique: true;
                 input: false;
             };
             name: {
@@ -107,6 +110,10 @@ export declare const axedaSchema: {
                 input: false;
             };
         };
+        indexes: {
+            fields: [string];
+            unique: true;
+        }[];
     };
     axedaAssignment: {
         fields: {
@@ -169,7 +176,6 @@ export declare const axedaSchema: {
             key: {
                 type: "string";
                 required: true;
-                unique: true;
                 input: false;
             };
             version: {
@@ -179,6 +185,10 @@ export declare const axedaSchema: {
                 input: false;
             };
         };
+        indexes: {
+            fields: [string];
+            unique: true;
+        }[];
     };
     axedaAudit: {
         fields: {
@@ -249,7 +259,6 @@ export declare const axedaSchema: {
             slug: {
                 type: "string";
                 required: true;
-                unique: true;
                 input: false;
             };
             name: {
@@ -305,9 +314,13 @@ export declare const axedaSchema: {
                 input: false;
             };
         };
-        indexes: {
+        indexes: ({
             fields: [string];
-        }[];
+            unique: true;
+        } | {
+            fields: [string];
+            unique?: never;
+        })[];
     };
     axedaBusiness: {
         fields: {
@@ -437,7 +450,6 @@ export declare const axedaSchema: {
             pendingKey: {
                 type: "string";
                 required: true;
-                unique: true;
                 input: false;
             };
             /** 0 mientras está pendiente. Se sube con `incrementOne`: solo un cierre lo consigue. */
@@ -454,9 +466,14 @@ export declare const axedaSchema: {
             };
         };
         indexes: ({
+            fields: [string];
+            unique: true;
+        } | {
             fields: [string, string];
+            unique?: never;
         } | {
             fields: [string];
+            unique?: never;
         })[];
     };
 };

package/dist/schema.js

@@ -20,6 +20,10 @@ export const GLOBAL_SCOPE_ID = '';
  * Esquema que el plugin añade a Better Auth. Las migraciones las genera Better Auth a partir
  * de esto (`getMigrations` o su CLI). Reglas: columnas nuevas siempre opcionales o con valor
  * por defecto; un cambio destructivo exige una migración manual.
+ *
+ * Las restricciones únicas van como `indexes` con `unique: true` y no como `unique` de un campo: el
+ * adaptador de MongoDB de Better Auth solo crea los índices de tabla, y sin ellos dos escrituras
+ * simultáneas con la misma clave caben las dos. En SQL son equivalentes.
  */
 export const axedaSchema = {
     user: {
@@ -34,7 +38,7 @@ export const axedaSchema = {
     },
     [MODELS.role]: {
         fields: {
-            key: { type: 'string', required: true, unique: true, input: false },
+            key: { type: 'string', required: true, input: false },
             name: { type: 'string', required: true, input: false },
             description: { type: 'string', required: false, input: false },
             permissions: { type: 'string[]', required: true, input: false },
@@ -45,6 +49,7 @@ export const axedaSchema = {
             createdAt: { type: 'date', required: true, input: false },
             updatedAt: { type: 'date', required: true, input: false },
         },
+        indexes: [{ fields: ['key'], unique: true }],
     },
     [MODELS.assignment]: {
         fields: {
@@ -73,9 +78,10 @@ export const axedaSchema = {
     },
     [MODELS.state]: {
         fields: {
-            key: { type: 'string', required: true, unique: true, input: false },
+            key: { type: 'string', required: true, input: false },
             version: { type: 'number', required: true, defaultValue: 0, input: false },
         },
+        indexes: [{ fields: ['key'], unique: true }],
     },
     [MODELS.audit]: {
         fields: {
@@ -94,13 +100,16 @@ export const axedaSchema = {
         },
         indexes: [
             { fields: ['actorId'] },
+            // Sin él, filtrar por acción recorre toda la tabla y crece con ella (50-70 ms con 200 000 eventos
+            // en PostgreSQL 16 y 18, 30 ms en PGlite); con él son décimas de milisegundo.
+            { fields: ['action'] },
             { fields: ['targetType', 'targetId'] },
             { fields: ['scopeType', 'scopeId'] },
         ],
     },
     [MODELS.company]: {
         fields: {
-            slug: { type: 'string', required: true, unique: true, input: false },
+            slug: { type: 'string', required: true, input: false },
             name: { type: 'string', required: true, input: false },
             legalName: { type: 'string', required: false, input: false },
             logoUrl: { type: 'string', required: false, input: false },
@@ -112,7 +121,7 @@ export const axedaSchema = {
             createdAt: { type: 'date', required: true, input: false },
             updatedAt: { type: 'date', required: true, input: false },
         },
-        indexes: [{ fields: ['deletedAt'] }],
+        indexes: [{ fields: ['slug'], unique: true }, { fields: ['deletedAt'] }],
     },
     [MODELS.business]: {
         fields: {
@@ -152,11 +161,15 @@ export const axedaSchema = {
              * cerrarla pasa a `closed:<id>`. Así dos invitaciones iguales a la vez no caben, sin
              * depender de índices parciales que no todas las bases tienen.
              */
-            pendingKey: { type: 'string', required: true, unique: true, input: false },
+            pendingKey: { type: 'string', required: true, input: false },
             /** 0 mientras está pendiente. Se sube con `incrementOne`: solo un cierre lo consigue. */
             consumed: { type: 'number', required: true, defaultValue: 0, input: false },
             createdAt: { type: 'date', required: true, input: false },
         },
-        indexes: [{ fields: ['scopeType', 'scopeId'] }, { fields: ['email'] }],
+        indexes: [
+            { fields: ['pendingKey'], unique: true },
+            { fields: ['scopeType', 'scopeId'] },
+            { fields: ['email'] },
+        ],
     },
 };

package/dist/session-lifetime.d.ts

@@ -0,0 +1,21 @@
+/** Treinta días: tras ese tiempo hay que volver a iniciar sesión, por mucho que se use. */
+export declare const DEFAULT_MAX_SESSION_AGE: number;
+/**
+ * La vida máxima de una sesión, en segundos, o `undefined` si se desactivó con `false`.
+ * Un valor que no sea un entero positivo es un error de configuración, no se corrige en silencio.
+ */
+export declare function resolveMaxSessionAge(value: number | false | undefined): number | undefined;
+/**
+ * Recorta cuándo caduca una sesión para que nunca pase de su creación más `maxAge`. Devuelve
+ * `undefined` si no hay nada que recortar.
+ */
+export declare function cappedExpiry(expiresAt: unknown, createdAt: unknown, maxAge: number): Date | undefined;
+/**
+ * La sesión que Better Auth está renovando. Una renovación solo trae la nueva fecha de caducidad;
+ * la fila (con su `createdAt`) está en el contexto de la petición, donde Better Auth la leyó
+ * justo antes. Sin petición (un trabajo que llama a `updateSession` por su cuenta) no hay de dónde
+ * sacarla y la renovación se deja pasar.
+ */
+export declare function sessionBeingRefreshed(context: unknown): {
+    readonly createdAt: unknown;
+} | undefined;

package/dist/session-lifetime.js

@@ -0,0 +1,50 @@
+import { AxedaError } from '@teamblind/axeda-core';
+/** Treinta días: tras ese tiempo hay que volver a iniciar sesión, por mucho que se use. */
+export const DEFAULT_MAX_SESSION_AGE = 30 * 24 * 60 * 60;
+/**
+ * La vida máxima de una sesión, en segundos, o `undefined` si se desactivó con `false`.
+ * Un valor que no sea un entero positivo es un error de configuración, no se corrige en silencio.
+ */
+export function resolveMaxSessionAge(value) {
+    if (value === false)
+        return undefined;
+    if (value === undefined)
+        return DEFAULT_MAX_SESSION_AGE;
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new AxedaError('AXEDA_INVALID_CONFIG', `maxSessionAge must be a positive whole number of seconds, or false to turn it off (got ${String(value)}).`);
+    }
+    return value;
+}
+const asDate = (value) => {
+    if (value instanceof Date || typeof value === 'string' || typeof value === 'number') {
+        const date = new Date(value);
+        return Number.isNaN(date.getTime()) ? undefined : date;
+    }
+    return undefined;
+};
+/**
+ * Recorta cuándo caduca una sesión para que nunca pase de su creación más `maxAge`. Devuelve
+ * `undefined` si no hay nada que recortar.
+ */
+export function cappedExpiry(expiresAt, createdAt, maxAge) {
+    const expiry = asDate(expiresAt);
+    const created = asDate(createdAt);
+    if (expiry === undefined || created === undefined)
+        return undefined;
+    const limit = created.getTime() + maxAge * 1000;
+    return expiry.getTime() > limit ? new Date(limit) : undefined;
+}
+/**
+ * La sesión que Better Auth está renovando. Una renovación solo trae la nueva fecha de caducidad;
+ * la fila (con su `createdAt`) está en el contexto de la petición, donde Better Auth la leyó
+ * justo antes. Sin petición (un trabajo que llama a `updateSession` por su cuenta) no hay de dónde
+ * sacarla y la renovación se deja pasar.
+ */
+export function sessionBeingRefreshed(context) {
+    if (typeof context !== 'object' || context === null)
+        return undefined;
+    const inner = context
+        .context;
+    const row = inner?.session?.session;
+    return row === undefined || row === null ? undefined : { createdAt: row.createdAt };
+}

package/dist/stores.js

@@ -1,9 +1,19 @@
 import { AxedaError, createAuditIdFactory, } from '@teamblind/axeda-core';
 import { isForeignKeyViolation, isUniqueViolation } from './errors.js';
 import { scopeColumns, toAssignment, toAuditEvent, toRole, } from './rows.js';
-import { MODELS, POLICY_STATE_KEY } from './schema.js';
+import { axedaSchema, MODELS, POLICY_STATE_KEY } from './schema.js';
 import { byId, decodeCursor, encodeCursor } from './shared.js';
 import { createBusinessStore, createCompanyStore, createInvitationStore } from './tenant-stores.js';
+/**
+ * MongoDB sin conjunto de réplicas (un `mongod` suelto) rechaza las transacciones con un error del
+ * servidor que no dice qué hacer. Se traduce al error de Axeda para ese caso.
+ */
+function explainTransactionFailure(error) {
+    if (error instanceof Error && /replica set member or mongos/i.test(error.message)) {
+        throw new AxedaError('AXEDA_TRANSACTIONS_UNSUPPORTED', 'MongoDB only runs transactions on a replica set (a single-node one is enough, also for development) or on a sharded cluster, and Axeda needs them to keep permission versions consistent. Start MongoDB with --replSet and run rs.initiate(), or use a database that supports transactions.', { cause: error });
+    }
+    throw error;
+}
 /**
  * Better Auth limita `findMany` a 100 filas si no se indica otra cosa. Para datos de seguridad
  * un tope silencioso es peligroso, así que siempre se pide un límite explícito.
@@ -338,6 +348,34 @@ export function createBetterAuthPersistence(databaseAdapter, options = {}) {
         });
         return ensured;
     };
+    // MongoDB no tiene migraciones: su adaptador crea cada colección y sus índices la primera vez que
+    // escribe en ella. Si esa primera vez cae DENTRO de una transacción, que ya leyó la colección, el
+    // adaptador pide crear el índice fuera de la sesión, MongoDB lo deja esperando a que acabe la
+    // transacción y la transacción espera al índice: se cuelga hasta que caduca (60 s). Se evita
+    // escribiendo una vez, antes de la primera transacción, en cada colección de Axeda (sin tocar nada:
+    // el filtro no coincide con ningún documento).
+    let prepared = null;
+    const prepare = () => {
+        prepared ??= (async () => {
+            await ensurePolicyRow();
+            if (adapter.id !== 'mongodb-adapter')
+                return;
+            await Promise.all(Object.values(MODELS).map((model) => {
+                const field = Object.entries(axedaSchema[model].fields).find(([, attributes]) => attributes.type === 'string')?.[0];
+                if (field === undefined)
+                    return Promise.resolve();
+                return adapter.updateMany({
+                    model,
+                    where: [{ field: 'id', value: 'axeda-collection-setup' }],
+                    update: { [field]: '' },
+                });
+            }));
+        })().catch((error) => {
+            prepared = null;
+            throw error;
+        });
+        return prepared;
+    };
     const storesFor = (target, atomic, ensure) => ({
         roles: createRoleStore(target, atomic, now),
         assignments: createAssignmentStore(target, now),
@@ -347,12 +385,17 @@ export function createBetterAuthPersistence(databaseAdapter, options = {}) {
         businesses: createBusinessStore(target, atomic, now),
         invitations: createInvitationStore(target, now),
     });
-    const root = storesFor(adapter, (work) => adapter.transaction((trx) => work(trx)), ensurePolicyRow);
+    const root = storesFor(adapter, async (work) => {
+        await prepare();
+        return adapter.transaction((trx) => work(trx)).catch(explainTransactionFailure);
+    }, ensurePolicyRow);
     return {
         ...root,
         async transaction(callback) {
-            await ensurePolicyRow();
-            return adapter.transaction((trx) => callback(storesFor(trx, (work) => work(trx), () => Promise.resolve())));
+            await prepare();
+            return adapter
+                .transaction((trx) => callback(storesFor(trx, (work) => work(trx), () => Promise.resolve())))
+                .catch(explainTransactionFailure);
         },
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teamblind/axeda-better-auth",
-  "version": "0.1.0-alpha.0",
+  "version": "0.1.0-alpha.1",
   "description": "Better Auth plugin for Axeda: schema, endpoints, client plugin and store implementations.",
   "license": "Apache-2.0",
   "author": "TeamBlind",
@@ -49,7 +49,7 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@teamblind/axeda-core": "^0.1.0-alpha.0",
+    "@teamblind/axeda-core": "^0.1.0-alpha.1",
     "zod": "^4.6.7"
   },
   "peerDependencies": {
@@ -57,6 +57,7 @@
     "better-auth": "^1.7.10"
   },
   "devDependencies": {
+    "@better-auth/api-key": "^1.7.10",
     "@better-auth/core": "^1.7.10",
     "@electric-sql/pglite": "^0.5.10",
     "@types/better-sqlite3": "^9.6.0",
@@ -64,6 +65,8 @@
     "better-auth": "^1.7.10",
     "better-sqlite3": "^13.0.3",
     "kysely": "^0.29.6",
+    "mongodb": "^7.8.0",
+    "mysql2": "^3.24.6",
     "pg": "^8.23.1"
   }
 }