@velajs/better-auth 0.1.0

package/README.md

@@ -0,0 +1,228 @@
+# @velajs/better-auth
+
+[better-auth](https://www.better-auth.com/) integration for the [Vela](https://github.com/velajs/vela) framework. Edge-safe, fully DI-driven.
+
+```bash
+pnpm add @velajs/better-auth better-auth
+```
+
+## Quick start
+
+Construct your better-auth instance once, hand it to `BetterAuthModule.forRoot`, then use `AuthGuard` + `@CurrentUser()` like any other vela primitive.
+
+```ts
+import { betterAuth } from 'better-auth';
+import { Module, Controller, Get, UseGuards, VelaFactory } from '@velajs/vela';
+import {
+  BetterAuthModule, AuthGuard, CurrentUser, Public,
+} from '@velajs/better-auth';
+
+const auth = betterAuth({
+  database: /* drizzle / prisma / kysely adapter */,
+  emailAndPassword: { enabled: true },
+  socialProviders: { github: { clientId, clientSecret } },
+});
+
+@Controller('/me')
+@UseGuards(AuthGuard)
+class MeController {
+  @Get() me(@CurrentUser() user: { id: string; email: string }) {
+    return { id: user.id, email: user.email };
+  }
+
+  @Get('/health') @Public(true)
+  health() { return { ok: true }; }
+}
+
+@Module({
+  imports: [BetterAuthModule.forRoot({ auth, isGlobal: true })],
+  controllers: [MeController],
+})
+class AppModule {}
+
+const app = await VelaFactory.create(AppModule);
+export default app; // edge-compatible (.fetch)
+```
+
+`POST /api/auth/sign-up/email`, `POST /api/auth/sign-in/email`, `GET /api/auth/sign-in/social/github` and the rest of better-auth's surface are auto-mounted at `/api/auth/*`.
+
+## Module options
+
+```ts
+BetterAuthModule.forRoot({
+  auth,                          // pre-constructed betterAuth({ ... }) instance
+  basePath: '/api/auth',         // default — must match your better-auth config
+  isGlobal: false,               // register AuthGuard as APP_GUARD (deny-by-default)
+  defaultPolicy: 'deny',         // 'deny' | 'allow' for unauthenticated requests
+  mountHandler: true,            // mount /api/auth/* catch-all controller
+});
+```
+
+## Three composition patterns
+
+### Pattern A — inline (simplest)
+
+```ts
+imports: [
+  BetterAuthModule.forRoot({
+    auth: betterAuth({ database, plugins: [magicLink({ sendMagicLink }), apiKey()] }),
+    isGlobal: true,
+  }),
+]
+```
+
+### Pattern B — DI'd plugin construction
+
+`forRootAsync` lets vela services participate in your better-auth config. Required for Cloudflare D1 / Hyperdrive bindings, since env bindings only resolve at request time.
+
+```ts
+imports: [
+  D1Module.forRoot({ binding: 'DB' }),
+  BetterAuthModule.forRootAsync({
+    inject: [D1Service, EmailService],
+    useFactory: (d1: D1Service, email: EmailService) => ({
+      auth: betterAuth({
+        database: drizzleAdapter(drizzle(d1.binding), { provider: 'sqlite' }),
+        plugins: [
+          magicLink({ sendMagicLink: (data) => email.send(data) }), // DI'd EmailService
+          apiKey(),
+          twoFactor(),
+        ],
+      }),
+    }),
+    isGlobal: true,
+  }),
+]
+```
+
+### Pattern C — modular plugin modules
+
+Each feature ships a self-contained vela module that exports a plugin token. AppModule composes them like LEGO. Each module owns its own DI surface; only the public plugin token leaves the boundary.
+
+```ts
+// magic-link-auth.module.ts
+import { Module, InjectionToken } from '@velajs/vela';
+import { magicLink } from 'better-auth/plugins';
+import { EmailService } from './email.service';
+
+export const MAGIC_LINK_PLUGIN = new InjectionToken<ReturnType<typeof magicLink>>(
+  'app.MagicLinkPlugin',
+);
+
+@Module({
+  providers: [
+    EmailService,
+    {
+      provide: MAGIC_LINK_PLUGIN,
+      inject: [EmailService],
+      useFactory: (email: EmailService) =>
+        magicLink({ sendMagicLink: (d) => email.send({ to: d.email, link: d.url }) }),
+    },
+  ],
+  exports: [MAGIC_LINK_PLUGIN],
+})
+export class MagicLinkAuthModule {}
+```
+
+```ts
+// app.module.ts
+@Module({
+  imports: [
+    MagicLinkAuthModule,
+    OAuthAuthModule,
+    BetterAuthModule.forRootAsync({
+      imports: [MagicLinkAuthModule, OAuthAuthModule],
+      inject: [MAGIC_LINK_PLUGIN, OAUTH_PLUGIN],
+      useFactory: (magicLink, oauth) => ({
+        auth: betterAuth({ database, plugins: [magicLink, oauth] }),
+      }),
+      isGlobal: true,
+    }),
+  ],
+})
+class AppModule {}
+```
+
+## Calling better-auth from services & controllers
+
+Inject the auth instance via the `BETTER_AUTH` token. The full `auth.api.*` surface is available — list sessions, revoke, impersonate, anything better-auth exposes server-side.
+
+```ts
+import { Inject, Injectable } from '@velajs/vela';
+import { BETTER_AUTH, type BetterAuthInstance } from '@velajs/better-auth';
+
+@Injectable()
+class AdminUserService {
+  constructor(@Inject(BETTER_AUTH) private readonly auth: BetterAuthInstance) {}
+
+  listSessions(userId: string) {
+    return this.auth.api.listUserSessions({ userId });
+  }
+  revoke(token: string) {
+    return this.auth.api.revokeSession({ sessionToken: token });
+  }
+}
+```
+
+## Decorators
+
+| Decorator           | Purpose                                                                  |
+| ------------------- | ------------------------------------------------------------------------ |
+| `@CurrentUser()`    | Lazy parameter — better-auth `User` from the request (read by AuthGuard) |
+| `@CurrentSession()` | Lazy parameter — better-auth `Session`                                   |
+| `@Public(true)`     | Class or method — bypass AuthGuard entirely                              |
+| `@OptionalAuth(true)` | Class or method — populate user if present, never throw 401            |
+| `@Roles(['admin'])` | Method — read by `RolesGuard`. Compares against `user.role`.            |
+
+`@CurrentUser()` returns a lazy proxy. It's always object-truthy (because it's a proxy). When auth is optional, probe a property instead of `!!user`:
+
+```ts
+handle(@CurrentUser() user: User | undefined) {
+  return { hasUser: user?.id != null };  // ✓ correct
+}
+```
+
+## Guards
+
+- **`AuthGuard`** — singleton. Reads `Authorization` header / cookies via `auth.api.getSession`, populates `REQUEST_CONTEXT`. Honors `@Public()` and `@OptionalAuth()` overrides. Always lets requests under `basePath` through (so the catch-all controller can run unauthenticated).
+- **`RolesGuard`** — singleton. Reads `@Roles([...])` metadata, compares against `user.role`. Use with `@UseGuards(AuthGuard, RolesGuard)` — order matters.
+
+Global registration: pass `isGlobal: true` to `forRoot` (binds AuthGuard to `APP_GUARD`). Routes are deny-by-default; mark public ones with `@Public(true)`.
+
+## Edge-safe DB adapters
+
+`@velajs/better-auth` itself is `node:`-clean. Edge-safety of your runtime depends on your better-auth DB adapter:
+
+| Adapter                                    | Edge-safe |
+| ------------------------------------------ | :-------: |
+| `drizzleAdapter` + `drizzle-orm/d1`         |     ✅    |
+| `drizzleAdapter` + `@neondatabase/serverless` |   ✅    |
+| `kyselyAdapter` + `kysely-d1`               |     ✅    |
+| `prismaAdapter` + `@prisma/adapter-d1`      |     ✅    |
+| `drizzleAdapter` + `better-sqlite3`         |     ❌    |
+| `prismaAdapter` (default, no edge client)   |     ❌    |
+
+If you deploy to Cloudflare Workers, smoke-test your bundle for `node:` imports.
+
+## Custom mount path
+
+Set `mountHandler: false` and mount the catch-all yourself if you need a base path other than `/api/auth`:
+
+```ts
+import { Controller, All, Req, Inject, Injectable } from '@velajs/vela';
+import { BETTER_AUTH, Public } from '@velajs/better-auth';
+
+@Public(true)
+@Controller('/auth')
+@Injectable()
+class CustomCatchallController {
+  constructor(@Inject(BETTER_AUTH) private auth: BetterAuthInstance) {}
+  @All('/*') handle(@Req() c: Context) { return this.auth.handler(c.req.raw); }
+}
+```
+
+Pass `basePath: '/auth'` to `BetterAuthModule.forRoot` so `AuthGuard` skips the right paths, and keep your `betterAuth({ basePath: '/auth' })` config in sync.
+
+## License
+
+MIT

package/dist/better-auth.controller.d.ts

@@ -0,0 +1,7 @@
+import type { Context } from 'hono';
+import type { BetterAuthInstance } from './better-auth.types';
+export declare class BetterAuthCatchallController {
+    private readonly auth;
+    constructor(auth: BetterAuthInstance);
+    handle(c: Context): Promise<Response>;
+}

package/dist/better-auth.controller.js

@@ -0,0 +1,45 @@
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+import { All, Controller, Inject, Injectable, Req } from "@velajs/vela";
+import { BETTER_AUTH } from "./better-auth.tokens.js";
+import { Public } from "./decorators/public.decorator.js";
+export class BetterAuthCatchallController {
+    auth;
+    constructor(auth){
+        this.auth = auth;
+    }
+    async handle(c) {
+        return this.auth.handler(c.req.raw);
+    }
+}
+_ts_decorate([
+    All('/*'),
+    _ts_param(0, Req()),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof Context === "undefined" ? Object : Context
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], BetterAuthCatchallController.prototype, "handle", null);
+BetterAuthCatchallController = _ts_decorate([
+    Public(true),
+    Controller('/api/auth'),
+    Injectable(),
+    _ts_param(0, Inject(BETTER_AUTH)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof BetterAuthInstance === "undefined" ? Object : BetterAuthInstance
+    ])
+], BetterAuthCatchallController);

package/dist/better-auth.module.d.ts

@@ -0,0 +1,16 @@
+import { type AsyncModuleOptions, type DynamicModule } from '@velajs/vela';
+import type { BetterAuthInstance, BetterAuthModuleOptions } from './better-auth.types';
+type ForRootAsyncOptions = AsyncModuleOptions<{
+    auth: BetterAuthInstance;
+    basePath?: string;
+    defaultPolicy?: 'deny' | 'allow';
+}> & {
+    isGlobal?: boolean;
+    mountHandler?: boolean;
+    key?: string;
+};
+export declare class BetterAuthModule {
+    static forRoot(options: BetterAuthModuleOptions): DynamicModule;
+    static forRootAsync(options: ForRootAsyncOptions): DynamicModule;
+}
+export {};

package/dist/better-auth.module.js

@@ -0,0 +1,117 @@
+import { APP_GUARD, stableHash } from "@velajs/vela";
+import { BetterAuthCatchallController } from "./better-auth.controller.js";
+import { BETTER_AUTH, BETTER_AUTH_OPTIONS } from "./better-auth.tokens.js";
+import { AuthGuard } from "./guards/auth.guard.js";
+import { RolesGuard } from "./guards/roles.guard.js";
+const DEFAULT_BASE_PATH = '/api/auth';
+export class BetterAuthModule {
+    static forRoot(options) {
+        const normalized = normalize(options);
+        const providers = baseProviders(normalized, options.auth);
+        return {
+            module: BetterAuthModule,
+            key: stableHash({
+                basePath: normalized.basePath,
+                defaultPolicy: normalized.defaultPolicy,
+                isGlobal: !!options.isGlobal,
+                mountHandler: !!normalized.mountHandler
+            }),
+            providers,
+            controllers: normalized.mountHandler ? [
+                BetterAuthCatchallController
+            ] : [],
+            exports: [
+                BETTER_AUTH,
+                BETTER_AUTH_OPTIONS,
+                AuthGuard,
+                RolesGuard
+            ]
+        };
+    }
+    static forRootAsync(options) {
+        const mountHandler = options.mountHandler !== false;
+        const isGlobal = options.isGlobal === true;
+        const optsProvider = {
+            provide: BETTER_AUTH_OPTIONS,
+            useFactory: async (...deps)=>{
+                const value = await options.useFactory(...deps);
+                return {
+                    auth: value.auth,
+                    basePath: value.basePath ?? DEFAULT_BASE_PATH,
+                    defaultPolicy: value.defaultPolicy ?? 'deny',
+                    isGlobal,
+                    mountHandler
+                };
+            },
+            inject: options.inject ?? []
+        };
+        const authProvider = {
+            provide: BETTER_AUTH,
+            useFactory: (opts)=>opts.auth,
+            inject: [
+                BETTER_AUTH_OPTIONS
+            ]
+        };
+        const providers = [
+            optsProvider,
+            authProvider,
+            AuthGuard,
+            RolesGuard
+        ];
+        if (isGlobal) {
+            providers.push({
+                provide: APP_GUARD,
+                useExisting: AuthGuard
+            });
+        }
+        return {
+            module: BetterAuthModule,
+            key: options.key ?? stableHash({
+                inject: options.inject,
+                isGlobal,
+                mountHandler
+            }),
+            imports: options.imports ?? [],
+            providers,
+            controllers: mountHandler ? [
+                BetterAuthCatchallController
+            ] : [],
+            exports: [
+                BETTER_AUTH,
+                BETTER_AUTH_OPTIONS,
+                AuthGuard,
+                RolesGuard
+            ]
+        };
+    }
+}
+function normalize(options) {
+    return {
+        auth: options.auth,
+        basePath: options.basePath ?? DEFAULT_BASE_PATH,
+        isGlobal: options.isGlobal ?? false,
+        defaultPolicy: options.defaultPolicy ?? 'deny',
+        mountHandler: options.mountHandler ?? true
+    };
+}
+function baseProviders(normalized, authInstance) {
+    const providers = [
+        {
+            provide: BETTER_AUTH_OPTIONS,
+            useValue: normalized
+        },
+        {
+            provide: BETTER_AUTH,
+            useValue: authInstance
+        },
+        AuthGuard,
+        RolesGuard
+    ];
+    if (normalized.isGlobal) {
+        providers.push({
+            provide: APP_GUARD,
+            useExisting: AuthGuard
+        });
+    }
+    return providers;
+}

package/dist/better-auth.tokens.d.ts

@@ -0,0 +1,6 @@
+import { InjectionToken } from '@velajs/vela';
+import type { BetterAuthInstance, BetterAuthModuleOptions } from './better-auth.types';
+export declare const BETTER_AUTH: InjectionToken<BetterAuthInstance>;
+export declare const BETTER_AUTH_OPTIONS: InjectionToken<BetterAuthModuleOptions>;
+export declare const AUTH_USER_KEY: unique symbol;
+export declare const AUTH_SESSION_KEY: unique symbol;

package/dist/better-auth.tokens.js

@@ -0,0 +1,5 @@
+import { InjectionToken } from "@velajs/vela";
+export const BETTER_AUTH = new InjectionToken('vela.BetterAuth');
+export const BETTER_AUTH_OPTIONS = new InjectionToken('vela.BetterAuthOptions');
+export const AUTH_USER_KEY = Symbol.for('vela.better-auth.user');
+export const AUTH_SESSION_KEY = Symbol.for('vela.better-auth.session');

package/dist/better-auth.types.d.ts

@@ -0,0 +1,11 @@
+import type { Auth, Session as BASession, User as BAUser } from 'better-auth';
+export type BetterAuthInstance = Auth<any>;
+export interface BetterAuthModuleOptions {
+    auth: BetterAuthInstance;
+    basePath?: string;
+    isGlobal?: boolean;
+    defaultPolicy?: 'deny' | 'allow';
+    mountHandler?: boolean;
+}
+export type User = BAUser;
+export type Session = BASession;

package/dist/better-auth.types.js

@@ -0,0 +1 @@
+export { };

package/dist/decorators/current-session.decorator.d.ts

@@ -0,0 +1 @@
+export declare const CurrentSession: (data?: unknown, ...pipes: import("@velajs/vela").PipeType[]) => ParameterDecorator;

package/dist/decorators/current-session.decorator.js

@@ -0,0 +1,7 @@
+import { createLazyParamDecorator, REQUEST_CONTEXT } from "@velajs/vela";
+import { AUTH_SESSION_KEY } from "../better-auth.tokens.js";
+export const CurrentSession = createLazyParamDecorator((_data, ctx)=>{
+    const honoCtx = ctx.getContext();
+    const reqCtx = honoCtx.get('container').resolve(REQUEST_CONTEXT);
+    return reqCtx.get(AUTH_SESSION_KEY);
+});

package/dist/decorators/current-user.decorator.d.ts

@@ -0,0 +1 @@
+export declare const CurrentUser: (data?: unknown, ...pipes: import("@velajs/vela").PipeType[]) => ParameterDecorator;

package/dist/decorators/current-user.decorator.js

@@ -0,0 +1,7 @@
+import { createLazyParamDecorator, REQUEST_CONTEXT } from "@velajs/vela";
+import { AUTH_USER_KEY } from "../better-auth.tokens.js";
+export const CurrentUser = createLazyParamDecorator((_data, ctx)=>{
+    const honoCtx = ctx.getContext();
+    const reqCtx = honoCtx.get('container').resolve(REQUEST_CONTEXT);
+    return reqCtx.get(AUTH_USER_KEY);
+});

package/dist/decorators/optional-auth.decorator.d.ts

@@ -0,0 +1,2 @@
+export declare const OptionalAuth: import("@velajs/vela").ReflectableDecorator<boolean>;
+export declare const OPTIONAL_AUTH_KEY: string;

package/dist/decorators/optional-auth.decorator.js

@@ -0,0 +1,5 @@
+import { Reflector } from "@velajs/vela";
+export const OptionalAuth = Reflector.createDecorator({
+    key: 'vela.auth.optional'
+});
+export const OPTIONAL_AUTH_KEY = OptionalAuth.KEY;

package/dist/decorators/public.decorator.d.ts

@@ -0,0 +1,2 @@
+export declare const Public: import("@velajs/vela").ReflectableDecorator<boolean>;
+export declare const PUBLIC_KEY: string;

package/dist/decorators/public.decorator.js

@@ -0,0 +1,5 @@
+import { Reflector } from "@velajs/vela";
+export const Public = Reflector.createDecorator({
+    key: 'vela.auth.public'
+});
+export const PUBLIC_KEY = Public.KEY;

package/dist/decorators/roles.decorator.d.ts

@@ -0,0 +1,2 @@
+export declare const Roles: import("@velajs/vela").ReflectableDecorator<string[]>;
+export declare const ROLES_KEY: string;

package/dist/decorators/roles.decorator.js

@@ -0,0 +1,5 @@
+import { Reflector } from "@velajs/vela";
+export const Roles = Reflector.createDecorator({
+    key: 'vela.auth.roles'
+});
+export const ROLES_KEY = Roles.KEY;

package/dist/guards/auth.guard.d.ts

@@ -0,0 +1,9 @@
+import { type CanActivate, type ExecutionContext } from '@velajs/vela';
+import type { BetterAuthInstance, BetterAuthModuleOptions } from '../better-auth.types';
+export declare class AuthGuard implements CanActivate {
+    private readonly auth;
+    private readonly opts;
+    private readonly reflector;
+    constructor(auth: BetterAuthInstance, opts: BetterAuthModuleOptions);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}

package/dist/guards/auth.guard.js

@@ -0,0 +1,62 @@
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+import { Inject, Injectable, REQUEST_CONTEXT, Reflector, UnauthorizedException } from "@velajs/vela";
+import { AUTH_SESSION_KEY, AUTH_USER_KEY, BETTER_AUTH, BETTER_AUTH_OPTIONS } from "../better-auth.tokens.js";
+import { OptionalAuth } from "../decorators/optional-auth.decorator.js";
+import { Public } from "../decorators/public.decorator.js";
+export class AuthGuard {
+    auth;
+    opts;
+    reflector = new Reflector();
+    constructor(auth, opts){
+        this.auth = auth;
+        this.opts = opts;
+    }
+    async canActivate(context) {
+        if (this.reflector.getAllAndOverride(Public, context)) return true;
+        const request = context.getRequest();
+        const path = new URL(request.url).pathname;
+        const basePath = this.opts.basePath ?? '/api/auth';
+        if (path === basePath || path.startsWith(`${basePath}/`)) return true;
+        const data = await this.auth.api.getSession({
+            headers: request.headers
+        });
+        if (data) {
+            const reqCtx = resolveRequestContext(context);
+            reqCtx.set(AUTH_USER_KEY, data.user);
+            reqCtx.set(AUTH_SESSION_KEY, data.session);
+            return true;
+        }
+        if (this.opts.defaultPolicy === 'allow' || this.reflector.getAllAndOverride(OptionalAuth, context)) {
+            return true;
+        }
+        throw new UnauthorizedException('Authentication required');
+    }
+}
+AuthGuard = _ts_decorate([
+    Injectable(),
+    _ts_param(0, Inject(BETTER_AUTH)),
+    _ts_param(1, Inject(BETTER_AUTH_OPTIONS)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof BetterAuthInstance === "undefined" ? Object : BetterAuthInstance,
+        typeof BetterAuthModuleOptions === "undefined" ? Object : BetterAuthModuleOptions
+    ])
+], AuthGuard);
+function resolveRequestContext(context) {
+    const honoCtx = context.getContext();
+    const container = honoCtx.get('container');
+    return container.resolve(REQUEST_CONTEXT);
+}

package/dist/guards/roles.guard.d.ts

@@ -0,0 +1,5 @@
+import { type CanActivate, type ExecutionContext } from '@velajs/vela';
+export declare class RolesGuard implements CanActivate {
+    private readonly reflector;
+    canActivate(context: ExecutionContext): boolean;
+}

package/dist/guards/roles.guard.js

@@ -0,0 +1,36 @@
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+import { ForbiddenException, Injectable, REQUEST_CONTEXT, Reflector } from "@velajs/vela";
+import { AUTH_USER_KEY } from "../better-auth.tokens.js";
+import { Roles } from "../decorators/roles.decorator.js";
+export class RolesGuard {
+    reflector = new Reflector();
+    canActivate(context) {
+        const required = this.reflector.getAllAndOverride(Roles, context);
+        if (!required || required.length === 0) return true;
+        const honoCtx = context.getContext();
+        const reqCtx = honoCtx.get('container').resolve(REQUEST_CONTEXT);
+        const user = reqCtx.get(AUTH_USER_KEY);
+        if (!user) {
+            throw new ForbiddenException('Role check requires authentication');
+        }
+        const userRoles = normalizeRoles(user.role);
+        const ok = required.some((r)=>userRoles.includes(r));
+        if (!ok) {
+            throw new ForbiddenException(`Insufficient role; one of [${required.join(', ')}] required`);
+        }
+        return true;
+    }
+}
+RolesGuard = _ts_decorate([
+    Injectable()
+], RolesGuard);
+function normalizeRoles(role) {
+    if (!role) return [];
+    if (Array.isArray(role)) return role;
+    return role.split(',').map((r)=>r.trim()).filter(Boolean);
+}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export { BetterAuthModule } from './better-auth.module';
+export { BetterAuthCatchallController } from './better-auth.controller';
+export { BETTER_AUTH, BETTER_AUTH_OPTIONS, AUTH_USER_KEY, AUTH_SESSION_KEY, } from './better-auth.tokens';
+export { AuthGuard } from './guards/auth.guard';
+export { RolesGuard } from './guards/roles.guard';
+export { CurrentUser } from './decorators/current-user.decorator';
+export { CurrentSession } from './decorators/current-session.decorator';
+export { Public, PUBLIC_KEY } from './decorators/public.decorator';
+export { OptionalAuth, OPTIONAL_AUTH_KEY } from './decorators/optional-auth.decorator';
+export { Roles, ROLES_KEY } from './decorators/roles.decorator';
+export type { BetterAuthInstance, BetterAuthModuleOptions, Session, User, } from './better-auth.types';

package/dist/index.js

@@ -0,0 +1,14 @@
+// Module
+export { BetterAuthModule } from "./better-auth.module.js";
+export { BetterAuthCatchallController } from "./better-auth.controller.js";
+// Tokens & symbols
+export { BETTER_AUTH, BETTER_AUTH_OPTIONS, AUTH_USER_KEY, AUTH_SESSION_KEY } from "./better-auth.tokens.js";
+// Guards
+export { AuthGuard } from "./guards/auth.guard.js";
+export { RolesGuard } from "./guards/roles.guard.js";
+// Decorators
+export { CurrentUser } from "./decorators/current-user.decorator.js";
+export { CurrentSession } from "./decorators/current-session.decorator.js";
+export { Public, PUBLIC_KEY } from "./decorators/public.decorator.js";
+export { OptionalAuth, OPTIONAL_AUTH_KEY } from "./decorators/optional-auth.decorator.js";
+export { Roles, ROLES_KEY } from "./decorators/roles.decorator.js";

package/package.json

@@ -0,0 +1,64 @@
+{
+  "name": "@velajs/better-auth",
+  "version": "0.1.0",
+  "description": "better-auth integration for the Vela framework",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "sideEffects": false,
+  "keywords": [
+    "vela",
+    "better-auth",
+    "auth",
+    "authentication",
+    "session",
+    "oauth",
+    "edge",
+    "framework"
+  ],
+  "author": "ksh",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/velajs/better-auth.git"
+  },
+  "homepage": "https://github.com/velajs/better-auth#readme",
+  "bugs": {
+    "url": "https://github.com/velajs/better-auth/issues"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "peerDependencies": {
+    "@velajs/vela": ">=1.6.0",
+    "better-auth": ">=1.2.0",
+    "hono": ">=4"
+  },
+  "devDependencies": {
+    "@swc/cli": "^0.8.0",
+    "@swc/core": "^1.15.11",
+    "@velajs/vela": "^1.6.0",
+    "better-auth": "^1.2.0",
+    "hono": "^4",
+    "typescript": "^5",
+    "unplugin-swc": "^1.5.9",
+    "vitest": "^4.0.18"
+  },
+  "scripts": {
+    "build": "rm -rf dist && swc src -d dist --strip-leading-paths && tsc --emitDeclarationOnly",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  }
+}