@tulip-systems/core 0.10.1 → 0.10.3

package/src/modules/auth/handler/create-client.client.ts

@@ -1,53 +1,55 @@
 import "client-only";
 
-import { passkeyClient } from "@better-auth/passkey/client";
-import { adminClient, emailOTPClient, inferAdditionalFields } from "better-auth/client/plugins";
-import type { AccessControl, Role } from "better-auth/plugins";
+import type { passkeyClient } from "@better-auth/passkey/client";
+import type { BetterAuthClientOptions } from "better-auth";
+import type {
+  adminClient,
+  emailOTPClient,
+  inferAdditionalFields,
+} from "better-auth/client/plugins";
 import { createAuthClient as createBetterAuthClient } from "better-auth/react";
-import { url } from "@/lib/utils/url";
-import type { Auth } from "./service.server";
+import type { AdminClientOptions } from "../plugins/admin";
+import type { Auth, authAdditionalFields } from "./service.server";
+
+export type AuthClientOptions = BetterAuthClientOptions;
 
 /**
  * Create auth client
  */
-export type CreateAuthClientProps<
-  TAccessControl extends AccessControl,
-  TRoles extends { [key in string]: Role },
-> = {
-  /**
-   * Base URL for the auth client
-   */
-  baseURL?: string;
-  /**
-   * Access control instance
-   */
-  ac: TAccessControl;
-  roles: TRoles;
-};
-
-export function createAuthClient<
-  TAccessControl extends AccessControl,
-  TRoles extends { [key in string]: Role },
->(props: CreateAuthClientProps<TAccessControl, TRoles>) {
-  const { ac, roles } = props;
-
-  const baseURL = props.baseURL ?? url();
-
-  return createBetterAuthClient({
-    baseURL,
-    plugins: [
-      emailOTPClient(),
-      passkeyClient(),
-      adminClient({ ac, roles }),
-      inferAdditionalFields<Auth>(),
-    ],
-  });
+export function createAuthClient<TOptions extends AuthClientOptions>(
+  props: TOptions | undefined,
+): AuthClient<TOptions> {
+  return createBetterAuthClient<TOptions>(props) as unknown as AuthClient<TOptions>;
 }
 
+/**
+ * Any auth client
+ */
+declare const authClientMarker: unique symbol;
+
+export type AnyAuthClient = {
+  readonly [authClientMarker]: true;
+};
+
 /**
  * Client auth type
  */
-export type ClientAuth<
-  TAccessControl extends AccessControl,
-  TRoles extends { [key in string]: Role },
-> = ReturnType<typeof createAuthClient<TAccessControl, TRoles>>;
+export type BaseAuthClient<TOptions extends AuthClientOptions> = ReturnType<
+  typeof createBetterAuthClient<TOptions>
+>;
+
+export type AuthClient<TOptions extends AuthClientOptions> = BaseAuthClient<TOptions> & AnyAuthClient;
+
+/**
+ * Auth client plugins types
+ */
+export type AuthClientEmailOtpPlugin = ReturnType<typeof emailOTPClient>;
+export type AuthClientPasskeyPlugin = ReturnType<typeof passkeyClient>;
+
+export type AuthClientInferAdditionalFieldsPlugin = ReturnType<
+  typeof inferAdditionalFields<Auth<{ user: { additionalFields: typeof authAdditionalFields } }>>
+>;
+
+export type AuthClientAdminPlugin<TAdminClientOptions extends AdminClientOptions> = ReturnType<
+  typeof adminClient<TAdminClientOptions>
+>;

package/src/modules/auth/handler/proxy.server.ts

@@ -5,7 +5,7 @@ import { authCookiePrefix } from "./service.server";
 /**
  * Create auth proxy
  */
-export function createAuthProxy(props: { publicRoutes: string[] }) {
+export function createAuthProxy(props: { publicRoutes: string[]; cookiePrefix?: string }) {
   return (req: NextRequest) => {
     // 1. Check if the current route is protected or public
     const pathname = req.nextUrl.pathname;
@@ -15,7 +15,9 @@ export function createAuthProxy(props: { publicRoutes: string[] }) {
     );
 
     // 2. Check if a session cookie is present
-    const sessionCookie = getSessionCookie(req, { cookiePrefix: authCookiePrefix });
+    const sessionCookie = getSessionCookie(req, {
+      cookiePrefix: props.cookiePrefix ?? authCookiePrefix,
+    });
 
     // 3. Redirect to /auth/login if the user is not authenticated
     if (!isPublicRoute && !sessionCookie) {

package/src/modules/auth/handler/route.server.ts

@@ -1,17 +1,18 @@
+import "server-cli-only";
+
 import { toNextJsHandler } from "better-auth/next-js";
 import type { NextRequest } from "next/server";
-import "server-cli-only";
-import type { Auth } from "./service.server";
+import type { Auth, TAuthServerOptions } from "./service.server";
 
 /**
  * Handle the auth routes
  */
-export function handleAuthRoute(props: { auth: Auth }) {
+export function handleAuthRoute<TOptions extends TAuthServerOptions>(auth: Auth<TOptions>) {
   /**
    * GET route handler
    */
   async function GET(request: NextRequest) {
-    const routes = toNextJsHandler(props.auth.handler);
+    const routes = toNextJsHandler(auth.handler);
     return routes.GET(request);
   }
 
@@ -19,7 +20,7 @@ export function handleAuthRoute(props: { auth: Auth }) {
    * POST route handler
    */
   async function POST(request: NextRequest) {
-    const routes = toNextJsHandler(props.auth.handler);
+    const routes = toNextJsHandler(auth.handler);
     return routes.POST(request);
   }
 

package/src/modules/auth/handler/service.server.ts

@@ -1,125 +1,76 @@
-import { passkey } from "@better-auth/passkey";
+import type { Session, User } from "better-auth";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
-import { createAuthMiddleware } from "better-auth/api";
-import { betterAuth } from "better-auth/minimal";
-import { admin, emailOTP } from "better-auth/plugins";
-import { eq } from "drizzle-orm";
-import ForgetPasswordEmail from "@/components/emails/forget-password-email";
-import { url } from "@/lib/utils/url";
-import type { TDatabaseSchema } from "@/modules/config/entry";
-import type { TulipConfig } from "@/modules/config/lib/config";
+import { type BetterAuthOptions, betterAuth } from "better-auth/minimal";
+import type { AdminOptions } from "better-auth/plugins";
 import type { Database } from "@/modules/database/lib/service.server";
-import type { Email } from "@/modules/emails/lib/service.server";
-import { users } from "../entry";
-import type { createAccessControl, Role } from "../lib/permissions";
+import type { TDatabaseSchema } from "@/modules/database/lib/types";
+import { adminPlugin } from "../plugins/admin";
+import { emailOtpPlugin } from "../plugins/email-otp";
 
 export const authCookiePrefix = "tulip";
 
-type InitAuthProps<TSchema extends TDatabaseSchema> = {
-  db: Database<TSchema>;
-  email: Email;
-  config: TulipConfig;
-  ac: ReturnType<typeof createAccessControl>;
-  roles: {
-    [key in string]?: Role;
-  };
-  allowedHosts: string[];
-  defaultRole?: string;
-};
+export type TAuthServerOptions = Omit<BetterAuthOptions, "database">;
+
+/**
+ * Additional fields
+ */
+export const authAdditionalFields = {
+  firstName: {
+    type: "string",
+    required: true,
+    input: true,
+  },
+  lastName: {
+    type: "string",
+    required: true,
+    input: true,
+  },
+} as const;
 
 /**
  * Create the Better Auth server instance.
  */
-function createAuth<TSchema extends TDatabaseSchema>(props: InitAuthProps<TSchema>) {
-  return betterAuth({
+type InitAuthServerProps<TOptions extends TAuthServerOptions> = TOptions & {
+  db: Database<TDatabaseSchema>;
+};
+
+export function createAuthServer<TOptions extends TAuthServerOptions>(
+  props: InitAuthServerProps<TOptions>,
+) {
+  const { db, advanced, user, baseURL, emailAndPassword, hooks, plugins } = props;
+
+  return betterAuth<TOptions>({
+    ...props,
     advanced: {
       cookiePrefix: authCookiePrefix,
-      database: {
-        generateId: () => false,
-      },
-    },
-    baseURL: {
-      allowedHosts: props.allowedHosts,
+      database: { generateId: () => false as const },
+      ...(advanced ?? {}),
     },
-    database: drizzleAdapter(props.db, {
+    baseURL,
+    database: drizzleAdapter(db, {
       provider: "pg",
       usePlural: true,
     }),
     emailAndPassword: {
       enabled: true,
+      ...(emailAndPassword ?? {}),
     },
     user: {
+      ...(user ?? {}),
       changeEmail: {
         enabled: true,
-      },
-      additionalFields: {
-        firstName: {
-          type: "string",
-          required: true,
-          input: true,
-        },
-        lastName: {
-          type: "string",
-          required: true,
-          input: true,
-        },
+        ...(user?.changeEmail ?? {}),
       },
     },
-    hooks: {
-      after: createAuthMiddleware(async (ctx) => {
-        if (!ctx.path.startsWith("/sign-up")) return;
-
-        const session = ctx.context.newSession;
-        if (!session) return;
-
-        const existingUsers = await props.db.select().from(users);
-
-        if (existingUsers.length === 1) {
-          await props.db
-            .update(users)
-            .set({ role: "developer" })
-            .where(eq(users.id, session.user.id));
-        }
-      }),
-    },
-    plugins: [
-      passkey(),
-      admin({
-        roles: props.roles,
-        ac: props.ac,
-        adminRoles: ["admin", "developer"],
-        defaultRole: props.defaultRole ?? "user",
-      }),
-      emailOTP({
-        sendVerificationOTP: async ({ email, otp, type }) => {
-          /**
-           * Send a forget password mail
-           */
-          if (type === "forget-password") {
-            const searchParams = new URLSearchParams();
-            searchParams.set("email", email);
-            searchParams.set("otp", otp);
-
-            const resetPasswordHref = url(`/auth/reset-password?${searchParams.toString()}`);
-
-            const result = await props.email.emails.send({
-              from: props.config.email.defaultFrom,
-              to: email,
-              subject: "Wachtwoord herstellen",
-              react: ForgetPasswordEmail({ resetPasswordHref }),
-            });
-            if (result.error) throw new Error(result.error.message);
-          }
-        },
-      }),
-    ],
+    hooks,
+    plugins,
   });
 }
 
 /**
  * Better Auth instance type returned by `Auth.init()`.
  */
-export type Auth = ReturnType<typeof createAuth>;
+export type Auth<Options extends TAuthServerOptions> = ReturnType<typeof betterAuth<Options>>;
 
 /**
  * Auth service namespace.
@@ -128,5 +79,30 @@ export type Auth = ReturnType<typeof createAuth>;
  * const auth = Auth.init({ db, email, config, ac, roles, allowedHosts });
  */
 export const Auth = {
-  init: createAuth,
+  init: createAuthServer,
+  plugins: {
+    admin: adminPlugin,
+    emailOTP: emailOtpPlugin,
+  },
 };
+
+/**
+ * Session and user types for the Auth service.
+ */
+export type AuthServerUser<TOptions extends TAuthServerOptions> = User<
+  TOptions["user"],
+  TOptions["plugins"]
+>;
+
+export type AuthServerSession<TOptions extends TAuthServerOptions> = Session<
+  TOptions["session"],
+  TOptions["plugins"]
+>;
+
+/**
+ * Plugin types
+ */
+export type AuthServerAdminPlugin<Options extends AdminOptions> = ReturnType<
+  typeof adminPlugin<Options>
+>;
+export type AuthServerEmailOtpPlugin = ReturnType<typeof emailOtpPlugin>;

package/src/modules/auth/hooks/use-auth-client.tsx

@@ -1,38 +1,26 @@
 "use client";
 
-import type { AccessControl, Role } from "better-auth/plugins";
 import { createContext, type PropsWithChildren, use } from "react";
-import type { ClientAuth } from "../handler/create-client.client";
+import type { AnyAuthClient, AuthClient } from "../handler/create-client.client";
 
 /**
  * Auth client context
  */
-
-export const AuthClientContext = createContext(null as unknown as ClientAuth<never, never>);
+export const AuthClientContext = createContext(null as AnyAuthClient | null);
 
 /**
  * Use auth client
  */
-export function useAuthClient<
-  TAccessControl extends AccessControl = never,
-  TRoles extends { [key in string]: Role } = never,
->() {
+export function useAuthClient<TAuthClient extends AnyAuthClient = AuthClient<object>>() {
   const context = use(AuthClientContext);
   if (!context) throw new Error("Auth client is not provided");
 
-  return context as ClientAuth<TAccessControl, TRoles>;
+  return context as TAuthClient;
 }
 
 /**
  * Auth client provider
  */
-export function AuthProvider<
-  TAccessControl extends AccessControl,
-  TRoles extends { [key in string]: Role },
->(props: PropsWithChildren<{ authClient: ClientAuth<TAccessControl, TRoles> }>) {
-  return (
-    <AuthClientContext value={props.authClient as ClientAuth<never, never>}>
-      {props.children}
-    </AuthClientContext>
-  );
+export function AuthProvider(props: PropsWithChildren<{ authClient: AnyAuthClient }>) {
+  return <AuthClientContext value={props.authClient}>{props.children}</AuthClientContext>;
 }

package/src/modules/auth/hooks/use-permission.ts

@@ -1,10 +1,11 @@
 "use client";
 
-import type { Permission } from "../lib/permissions";
+import type { AuthClient, AuthClientAdminPlugin } from "../handler/create-client.client";
+import type { AccessControl, Permission } from "../lib/permissions";
 import { useAuthClient } from "./use-auth-client";
 import { useSession } from "./use-session";
 
-export type UsePermissionProps =
+export type UsePermissionProps<TAccessControl extends AccessControl = AccessControl> =
   | {
       /**
        * Strategy to use when checking multiple permissions
@@ -18,7 +19,7 @@ export type UsePermissionProps =
        * Permission to check
        * @example { project: ["view", "create"] }
        */
-      permission?: Permission;
+      permission?: Permission<TAccessControl>;
     }
   | {
       /**
@@ -33,20 +34,24 @@ export type UsePermissionProps =
        * Permission to check
        * @example [{ project: ["view", "create"] }, { client: ["view"] }, { drive: ["view"] }]
        */
-      permission?: Permission[];
+      permission?: Permission<TAccessControl>[];
     };
 
 /**
  * UsePermission
  */
-export function usePermission({ strategy = "all", permission }: UsePermissionProps) {
-  const authClient = useAuthClient();
+export function usePermission<TAccessControl extends AccessControl = AccessControl>({
+  strategy = "all",
+  permission,
+}: UsePermissionProps<TAccessControl> = {}) {
+  const authClient =
+    useAuthClient<AuthClient<{ plugins: [AuthClientAdminPlugin<{ ac: TAccessControl }>] }>>();
   const sessionQuery = useSession(authClient);
 
   /**
    * If no role is found in the session, deny by default
    */
-  const role = sessionQuery.data?.user.role;
+  const role = sessionQuery.data?.user.role as "admin" | "user" | undefined;
   if (!role) return { permission, success: false };
 
   /**
@@ -63,7 +68,7 @@ export function usePermission({ strategy = "all", permission }: UsePermissionPro
     const success = permissions.some((permission) =>
       authClient.admin.checkRolePermission({
         role,
-        permissions: permission,
+        permissions: permission as CheckRolePermission<TAccessControl>,
       }),
     );
 
@@ -76,7 +81,7 @@ export function usePermission({ strategy = "all", permission }: UsePermissionPro
   if (strategy === "all" && !Array.isArray(permission)) {
     const success = authClient.admin.checkRolePermission({
       role,
-      permissions: permission,
+      permissions: permission as CheckRolePermission<TAccessControl>,
     });
 
     return { permission, success };
@@ -87,3 +92,12 @@ export function usePermission({ strategy = "all", permission }: UsePermissionPro
    */
   return { permission, success: false };
 }
+
+/**
+ * These types are used to extract the permissions from the checkRolePermission endpoint. They are used to ensure that the permissions passed to the hook are valid.
+ */
+type CheckRolePermission<TAccessControl extends AccessControl> = Parameters<
+  ReturnType<
+    AuthClientAdminPlugin<{ ac: TAccessControl }>["getActions"]
+  >["admin"]["checkRolePermission"]
+>[0]["permissions"];

package/src/modules/auth/hooks/use-session.ts

@@ -1,20 +1,33 @@
 "use client";
 
 import { useSuspenseQuery } from "@tanstack/react-query";
-import type { ClientAuth } from "../entry.client";
+import type { InferSessionFromClient, InferUserFromClient } from "better-auth";
+import type { AuthClient, AuthClientOptions } from "../handler/create-client.client";
 
-export function useSession(authClient: ClientAuth<never, never>) {
-  const session = useSuspenseQuery({
+/**
+ * Use session return type
+ */
+type UseSessionReturnType<TOptions extends AuthClientOptions> = {
+  user: InferUserFromClient<TOptions>;
+  session: InferSessionFromClient<TOptions>;
+} | null;
+
+/**
+ * Use session
+ */
+export function useSession<TOptions extends AuthClientOptions>(authClient: AuthClient<TOptions>) {
+  const session = useSuspenseQuery<UseSessionReturnType<TOptions>>({
     queryKey: ["session"],
     queryFn: async () => {
-      const session = await authClient.getSession();
+      const client = authClient as unknown as AuthClient<object>;
+      const session = await client.getSession();
 
       if (session.error) {
         console.error(session.error);
         return null;
       }
 
-      return session.data;
+      return session.data as UseSessionReturnType<TOptions>;
     },
     staleTime: 1000 * 60 * 60,
   });

package/src/modules/auth/lib/helpers.server.ts

@@ -1,55 +1,27 @@
 import "server-cli-only";
-
-import { eq } from "drizzle-orm";
 import { headers } from "next/headers";
-import type { TulipContext } from "@/modules/config/entry";
-import type { TDatabaseSchema } from "@/modules/database/lib/types";
-import { ServerError } from "@/modules/router/lib/error.server";
-import { users } from "../entry";
-import type { CreateUserSchema, UpdateUserSchema } from "./validators";
+import type {
+  Auth,
+  AuthServerSession,
+  AuthServerUser,
+  TAuthServerOptions,
+} from "../handler/service.server";
 
 /**
  * Get the session
  */
-export async function getSession<TSchema extends TDatabaseSchema>({
-  auth,
-}: Pick<TulipContext<TSchema>, "auth">) {
-  return auth.api.getSession({ headers: await headers() });
-}
+export type GetSessionResult<TAuthOptions extends TAuthServerOptions> = {
+  session: AuthServerSession<TAuthOptions>;
+  user: AuthServerUser<TAuthOptions>;
+} | null;
 
-/**
- * Create a user
- */
-export function createUser<TSchema extends TDatabaseSchema>(
-  { auth, headers }: TulipContext<TSchema> & { headers: Headers },
-  { body }: { body: CreateUserSchema },
+export async function getSession<TAuthOptions extends TAuthServerOptions>(
+  auth: Auth<TAuthOptions>,
 ) {
-  const { firstName, lastName } = body;
-
-  return auth.api.createUser({
-    headers,
-    body: {
-      ...body,
-      name: `${firstName} ${lastName}`,
-      data: { firstName, lastName },
-    },
-  });
-}
+  const headersList = await headers();
 
-/**
- * Update a user
- */
-
-export async function updateUser<TSchema extends TDatabaseSchema>(
-  { db }: TulipContext<TSchema>,
-  { userId, body }: { userId: string; body: Partial<UpdateUserSchema> },
-) {
-  const [result] = await db.update(users).set(body).where(eq(users.id, userId)).returning();
-  if (!result) {
-    throw new ServerError("INTERNAL_SERVER_ERROR", {
-      message: "Gebruiker kon niet worden aangemaakt",
-    });
-  }
+  const api = auth.api as unknown as Auth<object>["api"];
+  const data = await api.getSession({ headers: headersList });
 
-  return result;
+  return data as GetSessionResult<TAuthOptions>;
 }

package/src/modules/auth/lib/permissions.ts

@@ -1,7 +1,40 @@
-import { createAccessControl, type Role } from "better-auth/plugins/access";
+import {
+  type AccessControl as BetterAuthAccessControl,
+  type Statements as BetterAuthStatements,
+  createAccessControl,
+  type Role,
+} from "better-auth/plugins/access";
 import { adminAc, defaultStatements } from "better-auth/plugins/admin/access";
 
-export type Permission = Record<string, string[]>;
+/**
+ * Permission Statements
+ * @description These are the statements that define the permissions for the application. They are used to create the access control and to check the permissions for the users.
+ */
+type Statements = BetterAuthStatements;
+
+/**
+ * Access Control
+ * @description The access control is created using the statements and is used to check the permissions for the users. It is also used to define the roles for the application.
+ */
+export type AccessControl<TStatements extends Statements = Statements> =
+  BetterAuthAccessControl<TStatements>;
+
+/**
+ * Permission Actions
+ * @description The actions that can be performed on a resource. For example, if the resource is "project", the actions can be "view", "create", "edit", "delete", etc.
+ */
+type Actions<T> = T extends readonly unknown[] ? T[number] : never;
+
+/**
+ * Permission
+ * @description The permission is an object that defines the resource and the actions that can be performed on that resource. For example, { project: ["view", "create"] } means that the user has permission to view and create projects.
+ */
+export type Permission<TAccessControl extends AccessControl = AccessControl> =
+  TAccessControl extends AccessControl<infer S extends Statements>
+    ? {
+        [K in keyof S]?: Actions<S[K]>[];
+      }
+    : Record<string, string[]>;
 
 /**
  * Create statements

package/src/modules/auth/plugins/admin.ts

@@ -0,0 +1,28 @@
+import { type AccessControl, type AdminOptions, admin, type Role } from "better-auth/plugins";
+
+/**
+ * Admin client options
+ */
+export type AdminClientOptions = {
+  ac?: AccessControl | undefined;
+  roles?: { [key in string]: Role } | undefined;
+};
+
+/**
+ * Admin plugin.
+ */
+export function adminPlugin<Options extends AdminOptions>({
+  roles,
+  ac,
+  adminRoles,
+  defaultRole,
+  ...props
+}: Options) {
+  return admin<Options>({
+    ...props,
+    roles,
+    ac,
+    adminRoles: adminRoles ?? ["admin", "developer"],
+    defaultRole: defaultRole ?? "user",
+  } as unknown as Options);
+}