@velajs/better-auth 0.5.0 → 0.6.1

package/dist/index.js

@@ -1,15 +1,364 @@
-// Module
-export { BetterAuthModule } from "./better-auth.module.js";
-export { BetterAuthService } from "./better-auth.service.js";
-export { BetterAuthCatchallController, createBetterAuthCatchallController } from "./better-auth.controller.js";
-// Tokens & symbols
-export { BETTER_AUTH_OPTIONS, AUTH_USER_KEY, AUTH_SESSION_KEY } from "./better-auth.tokens.js";
-// Guards
-export { AuthGuard } from "./guards/auth.guard.js";
-export { RolesGuard } from "./guards/roles.guard.js";
-// Decorators
-export { CurrentUser } from "./decorators/current-user.decorator.js";
-export { CurrentSession } from "./decorators/current-session.decorator.js";
-export { Public, PUBLIC_KEY } from "./decorators/public.decorator.js";
-export { OptionalAuth, OPTIONAL_AUTH_KEY } from "./decorators/optional-auth.decorator.js";
-export { Roles, ROLES_KEY } from "./decorators/roles.decorator.js";
+import { a as __decorateMetadata, i as __decorateParam, n as BetterAuthService, r as __decorate, t as BETTER_AUTH_BUILDER } from "./better-auth.service-BMkyFX-w.js";
+import { All, Controller, ForbiddenException, Inject, Injectable, InjectionToken, REQUEST_CONTEXT, Reflector, Req, UnauthorizedException, createLazyParamDecorator, defineModule, lazyProvider, provideGlobal, stableHash } from "@velajs/vela";
+import { AUTHZ } from "@velajs/authz/vela";
+//#region src/decorators/public.decorator.ts
+const Public = Reflector.createDecorator({ key: "vela.auth.public" });
+const PUBLIC_KEY = Public.KEY;
+//#endregion
+//#region src/better-auth.controller.ts
+/**
+* Build a catch-all controller that mounts better-auth's handler at `basePath`
+* (default `/api/auth`). This is a factory because vela reads a controller's
+* route off the class at decoration time, so a custom base path needs its own
+* decorated class — the path can't be parametrized on a single shared class.
+*
+* Two base paths to keep consistent:
+* - this `basePath` is RELATIVE to vela's `globalPrefix` (always prepended);
+* - better-auth routes against its OWN absolute `basePath` (the one you pass to
+*   `betterAuth({ basePath })`), which must equal `globalPrefix + basePath`.
+*
+* Both default to `/api/auth`, so the no-prefix / no-config case just works.
+*/
+function createBetterAuthCatchallController(basePath = "/api/auth") {
+	let BetterAuthCatchallController = class BetterAuthCatchallController {
+		auth;
+		constructor(auth) {
+			this.auth = auth;
+		}
+		async handle(c) {
+			return this.auth.handler(c.req.raw);
+		}
+	};
+	__decorate([
+		All("/*"),
+		__decorateParam(0, Req()),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], BetterAuthCatchallController.prototype, "handle", null);
+	BetterAuthCatchallController = __decorate([
+		Public(true),
+		Controller(basePath),
+		Injectable(),
+		__decorateParam(0, Inject(BetterAuthService)),
+		__decorateMetadata("design:paramtypes", [typeof BetterAuthService === "undefined" ? Object : BetterAuthService])
+	], BetterAuthCatchallController);
+	return BetterAuthCatchallController;
+}
+/**
+* Default-path (`/api/auth`) catch-all controller. Retained for back-compat;
+* `BetterAuthModule` now mounts {@link createBetterAuthCatchallController} with
+* the configured `basePath`. Prefer the factory for a custom base path.
+*/
+const BetterAuthCatchallController = createBetterAuthCatchallController();
+//#endregion
+//#region src/better-auth.tokens.ts
+const BETTER_AUTH_OPTIONS = new InjectionToken("vela.BetterAuthOptions");
+const AUTH_USER_KEY = Symbol.for("vela.better-auth.user");
+const AUTH_SESSION_KEY = Symbol.for("vela.better-auth.session");
+//#endregion
+//#region src/decorators/optional-auth.decorator.ts
+const OptionalAuth = Reflector.createDecorator({ key: "vela.auth.optional" });
+const OPTIONAL_AUTH_KEY = OptionalAuth.KEY;
+//#endregion
+//#region src/guards/auth.guard.ts
+let AuthGuard = class AuthGuard {
+	auth;
+	opts;
+	reflector = new Reflector();
+	constructor(auth, opts) {
+		this.auth = auth;
+		this.opts = opts;
+	}
+	async canActivate(context) {
+		if (this.reflector.getAllAndOverride(Public, context)) return true;
+		const request = context.getRequest();
+		const path = new URL(request.url).pathname;
+		const basePath = this.opts.basePath ?? "/api/auth";
+		if (path === basePath || path.startsWith(`${basePath}/`)) return true;
+		const data = await this.auth.api.getSession({ headers: request.headers });
+		if (data) {
+			const reqCtx = resolveRequestContext(context);
+			reqCtx.set(AUTH_USER_KEY, data.user);
+			reqCtx.set(AUTH_SESSION_KEY, data.session);
+			return true;
+		}
+		if (this.opts.defaultPolicy === "allow" || this.reflector.getAllAndOverride(OptionalAuth, context)) return true;
+		throw new UnauthorizedException("Authentication required");
+	}
+};
+AuthGuard = __decorate([
+	Injectable(),
+	__decorateParam(0, Inject(BetterAuthService)),
+	__decorateParam(1, Inject(BETTER_AUTH_OPTIONS)),
+	__decorateMetadata("design:paramtypes", [typeof BetterAuthService === "undefined" ? Object : BetterAuthService, Object])
+], AuthGuard);
+function resolveRequestContext(context) {
+	return context.getContext().get("container").resolve(REQUEST_CONTEXT);
+}
+//#endregion
+//#region src/decorators/roles.decorator.ts
+const Roles = Reflector.createDecorator({ key: "vela.auth.roles" });
+const ROLES_KEY = Roles.KEY;
+//#endregion
+//#region src/guards/roles.guard.ts
+let RolesGuard = class RolesGuard {
+	reflector = new Reflector();
+	canActivate(context) {
+		const required = this.reflector.getAllAndOverride(Roles, context);
+		if (!required || required.length === 0) return true;
+		const user = context.getContext().get("container").resolve(REQUEST_CONTEXT).get(AUTH_USER_KEY);
+		if (!user) throw new ForbiddenException("Role check requires authentication");
+		const userRoles = normalizeRoles$1(user.role);
+		if (!required.some((r) => userRoles.includes(r))) throw new ForbiddenException(`Insufficient role; one of [${required.join(", ")}] required`);
+		return true;
+	}
+};
+RolesGuard = __decorate([Injectable()], RolesGuard);
+function normalizeRoles$1(role) {
+	if (!role) return [];
+	if (Array.isArray(role)) return role;
+	return role.split(",").map((r) => r.trim()).filter(Boolean);
+}
+//#endregion
+//#region src/authz-bridge.ts
+const normalizeRoles = (role) => {
+	if (!role) return [];
+	if (Array.isArray(role)) return role.filter(Boolean);
+	return role.split(",").map((r) => r.trim()).filter(Boolean);
+};
+/**
+* Adapts a better-auth user into a `@velajs/authz` {@link Identity}. Maps
+* `user.id` → `userId` and the admin-plugin `role` field → `roles`.
+*
+* Fail-closed: a missing user (`null`/`undefined`, i.e. an unauthenticated
+* request) maps to the zero-privilege identity `{ roles: [] }`, so downstream
+* `can()` checks grant nothing.
+*/
+const identityFromUser = (user) => {
+	if (!user) return { roles: [] };
+	return {
+		userId: user.id,
+		roles: normalizeRoles(user.role)
+	};
+};
+/**
+* Flattens a better-auth AC role's `statements` into `resource:action`
+* permission strings — the granted-side format `@velajs/authz` matches
+* (wildcards included).
+*/
+const permissionsFromAcRole = (role) => {
+	const permissions = [];
+	for (const [resource, actions] of Object.entries(role.statements ?? {})) for (const action of actions ?? []) permissions.push(`${resource}:${action}`);
+	return permissions;
+};
+/**
+* Builds a fail-closed `@velajs/authz` {@link PermissionResolver} from a
+* better-auth access-control role table (`{ roleName: acRole }` — the same map
+* shape passed to better-auth's admin/organization plugins). An identity's
+* `roles` are unioned into their granted permission strings; unknown roles
+* contribute nothing.
+*
+* ```ts
+* const ac = createAccessControl({ posts: ['read', 'write'] });
+* const authz = createAuthz({
+*   resolver: betterAuthAcResolver({ editor: ac.newRole({ posts: ['write'] }) }),
+* });
+* await authz.can(identityFromUser(user), 'posts:write');
+* ```
+*/
+const betterAuthAcResolver = (roles) => {
+	const grantsByRole = /* @__PURE__ */ new Map();
+	for (const [name, role] of Object.entries(roles)) grantsByRole.set(name, permissionsFromAcRole(role));
+	return { grants(identity) {
+		const out = /* @__PURE__ */ new Set();
+		for (const name of identity.roles ?? []) for (const permission of grantsByRole.get(name) ?? []) out.add(permission);
+		return out;
+	} };
+};
+//#endregion
+//#region src/decorators/require-permission.decorator.ts
+/**
+* Declares the `@velajs/authz` permission(s) required to reach a controller or
+* route handler. Read via `Reflector` in an authorization guard, then checked
+* against the caller's `Identity` with `authz.can(...)`.
+*
+* ```ts
+* @RequirePermission(['posts:write'])
+* @Post()
+* create() { ... }
+* ```
+*
+* The metadata is a plain `string[]` of permission strings in the granted-side
+* format `@velajs/authz` matches (`resource:action`, or wildcards like
+* `posts:*`). Handler-level metadata overrides class-level (standard
+* `Reflector.getAllAndOverride` precedence).
+*
+* Semantics are **require-ALL** (AND): every listed permission must be granted
+* for access — the `PermissionGuard` denies if any one is missing. This
+* contrasts with `@Roles`, which is **OR** (any one of the listed roles
+* suffices).
+*/
+const RequirePermission = Reflector.createDecorator({ key: "vela.authz.permissions" });
+const REQUIRE_PERMISSION_KEY = RequirePermission.KEY;
+//#endregion
+//#region src/guards/permission.guard.ts
+const AUTHZ_TOKEN = AUTHZ;
+let PermissionGuard = class PermissionGuard {
+	reflector = new Reflector();
+	async canActivate(context) {
+		const required = this.reflector.getAllAndOverride(RequirePermission, context);
+		if (!required || required.length === 0) return true;
+		const container = context.getContext().get("container");
+		let authz;
+		try {
+			authz = container.resolve(AUTHZ_TOKEN);
+		} catch {
+			authz = void 0;
+		}
+		if (!authz) throw new ForbiddenException("Authorization is not configured");
+		const user = container.resolve(REQUEST_CONTEXT).get(AUTH_USER_KEY);
+		if (!user) throw new ForbiddenException("Permission check requires authentication");
+		const identity = identityFromUser(user);
+		for (const permission of required) if (!await authz.can(identity, permission)) throw new ForbiddenException(`Missing permission: ${permission}`);
+		return true;
+	}
+};
+PermissionGuard = __decorate([Injectable()], PermissionGuard);
+//#endregion
+//#region src/better-auth.module.ts
+const DEFAULT_BASE_PATH = "/api/auth";
+function normalize(options) {
+	return {
+		basePath: options.basePath ?? DEFAULT_BASE_PATH,
+		isGlobal: options.isGlobal ?? false,
+		defaultPolicy: options.defaultPolicy ?? "deny",
+		mountHandler: options.mountHandler ?? true
+	};
+}
+/** Providers, controllers, and exports shared by both entry points. */
+function commonContributions(n) {
+	return {
+		providers: [
+			BetterAuthService,
+			AuthGuard,
+			RolesGuard,
+			PermissionGuard
+		],
+		controllers: n.mountHandler ? [createBetterAuthCatchallController(n.basePath)] : [],
+		exports: [
+			BetterAuthService,
+			BETTER_AUTH_OPTIONS,
+			AuthGuard,
+			RolesGuard,
+			PermissionGuard
+		]
+	};
+}
+/**
+* The blessed engine generates `forRoot`. `setup` runs once per instance at
+* call time: it re-provides {@link BETTER_AUTH_OPTIONS} with defaults applied,
+* derives the auth builder from those options, mounts the catch-all controller,
+* and — via the `global:` slot — registers the app-wide guard when `isGlobal`.
+*
+* `isGlobal` here means "apply AuthGuard app-wide", NOT "make this a global
+* module", so the default `isGlobal → global: true` extras transform is
+* replaced with identity; the flag reaches `setup` through the options bag.
+*/
+const authModuleHost = defineModule({
+	name: "BetterAuth",
+	optionsToken: BETTER_AUTH_OPTIONS,
+	transform: (definition) => definition,
+	key: (options) => stableHash(normalize(options)),
+	setup: ({ OPTIONS, options }) => {
+		const n = normalize(options);
+		const common = commonContributions(n);
+		const auth = options.auth;
+		return {
+			providers: [
+				{
+					provide: OPTIONS,
+					useValue: {
+						...n,
+						auth
+					}
+				},
+				lazyProvider({
+					provide: BETTER_AUTH_BUILDER,
+					inject: [OPTIONS],
+					useFactory: (o) => o.auth
+				}),
+				...common.providers
+			],
+			controllers: common.controllers,
+			exports: common.exports,
+			global: n.isGlobal ? { guards: [AuthGuard] } : void 0
+		};
+	}
+});
+var BetterAuthModule = class BetterAuthModule {
+	/**
+	* Synchronous registration. The auth instance is constructed by the consumer
+	* at module-load time and passed in directly. Use this when the inputs to
+	* `betterAuth({...})` are available at startup (Node apps with a static DB
+	* connection, in-memory adapters, etc.).
+	*/
+	static forRoot(options) {
+		return {
+			...authModuleHost.ConfigurableModuleClass.forRoot(options),
+			module: BetterAuthModule
+		};
+	}
+	/**
+	* Deferred / DI-driven registration. The user factory runs **lazily**, on the
+	* first time anything reads `BetterAuthService.auth` (or `.api` / `.handler`).
+	* In normal request handling that's `AuthGuard.canActivate` or the catch-all
+	* controller's `.handle`. At module load the factory does NOT run — it's only
+	* captured behind {@link lazyProvider}'s memoized thunk. This is what makes
+	* Cloudflare bindings (D1, KV, R2) work: the binding isn't ready at boot, but
+	* it IS by the time a request flows through and the guard / catch-all reads
+	* the service. Inject deps resolve at module load (cheap BindingRef wrappers);
+	* their *values* are read at first auth use, inside your factory body.
+	*/
+	static forRootAsync(options) {
+		const n = normalize(options);
+		const common = commonContributions(n);
+		return {
+			module: BetterAuthModule,
+			key: options.key ?? stableHash({
+				...n,
+				inject: options.inject
+			}),
+			imports: options.imports ?? [],
+			providers: [
+				{
+					provide: BETTER_AUTH_OPTIONS,
+					useValue: n
+				},
+				lazyProvider({
+					provide: BETTER_AUTH_BUILDER,
+					inject: options.inject,
+					useFactory: options.useFactory
+				}),
+				...common.providers,
+				...n.isGlobal ? provideGlobal("guard", AuthGuard) : []
+			],
+			controllers: common.controllers,
+			exports: common.exports
+		};
+	}
+};
+//#endregion
+//#region src/decorators/current-user.decorator.ts
+const CurrentUser = createLazyParamDecorator((_data, ctx) => {
+	return ctx.getContext().get("container").resolve(REQUEST_CONTEXT).get(AUTH_USER_KEY);
+});
+//#endregion
+//#region src/decorators/current-session.decorator.ts
+const CurrentSession = createLazyParamDecorator((_data, ctx) => {
+	return ctx.getContext().get("container").resolve(REQUEST_CONTEXT).get(AUTH_SESSION_KEY);
+});
+//#endregion
+export { AUTH_SESSION_KEY, AUTH_USER_KEY, AuthGuard, BETTER_AUTH_OPTIONS, BetterAuthCatchallController, BetterAuthModule, BetterAuthService, CurrentSession, CurrentUser, OPTIONAL_AUTH_KEY, OptionalAuth, PUBLIC_KEY, PermissionGuard, Public, REQUIRE_PERMISSION_KEY, ROLES_KEY, RequirePermission, Roles, RolesGuard, betterAuthAcResolver, createBetterAuthCatchallController, identityFromUser, permissionsFromAcRole };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":["normalizeRoles"],"sources":["../src/decorators/public.decorator.ts","../src/better-auth.controller.ts","../src/better-auth.tokens.ts","../src/decorators/optional-auth.decorator.ts","../src/guards/auth.guard.ts","../src/decorators/roles.decorator.ts","../src/guards/roles.guard.ts","../src/authz-bridge.ts","../src/decorators/require-permission.decorator.ts","../src/guards/permission.guard.ts","../src/better-auth.module.ts","../src/decorators/current-user.decorator.ts","../src/decorators/current-session.decorator.ts"],"sourcesContent":["import { Reflector } from '@velajs/vela';\n\nexport const Public = Reflector.createDecorator<boolean>({ key: 'vela.auth.public' });\nexport const PUBLIC_KEY = Public.KEY;\n","import { All, Controller, Inject, Injectable, Req, type Type } from '@velajs/vela';\nimport type { Context } from 'hono';\nimport { BetterAuthService } from './better-auth.service';\nimport { Public } from './decorators/public.decorator';\n\n/**\n * Build a catch-all controller that mounts better-auth's handler at `basePath`\n * (default `/api/auth`). This is a factory because vela reads a controller's\n * route off the class at decoration time, so a custom base path needs its own\n * decorated class — the path can't be parametrized on a single shared class.\n *\n * Two base paths to keep consistent:\n * - this `basePath` is RELATIVE to vela's `globalPrefix` (always prepended);\n * - better-auth routes against its OWN absolute `basePath` (the one you pass to\n *   `betterAuth({ basePath })`), which must equal `globalPrefix + basePath`.\n *\n * Both default to `/api/auth`, so the no-prefix / no-config case just works.\n */\nexport function createBetterAuthCatchallController(basePath: string = '/api/auth'): Type {\n  @Public(true)\n  @Controller(basePath)\n  @Injectable()\n  class BetterAuthCatchallController {\n    // Inject the service — its `.handler` getter triggers lazy construction\n    // of the underlying betterAuth() instance on first access, AFTER any\n    // runtime adapter middleware (Cloudflare env capture) has run.\n    constructor(@Inject(BetterAuthService) private readonly auth: BetterAuthService) {}\n\n    @All('/*')\n    async handle(@Req() c: Context): Promise<Response> {\n      return this.auth.handler(c.req.raw);\n    }\n  }\n  return BetterAuthCatchallController;\n}\n\n/**\n * Default-path (`/api/auth`) catch-all controller. Retained for back-compat;\n * `BetterAuthModule` now mounts {@link createBetterAuthCatchallController} with\n * the configured `basePath`. Prefer the factory for a custom base path.\n */\nexport const BetterAuthCatchallController = createBetterAuthCatchallController();\n","import { InjectionToken } from '@velajs/vela';\nimport type { BetterAuthModuleOptions } from './better-auth.types';\n\nexport const BETTER_AUTH_OPTIONS = new InjectionToken<BetterAuthModuleOptions>(\n  'vela.BetterAuthOptions',\n);\n\nexport const AUTH_USER_KEY = Symbol.for('vela.better-auth.user');\nexport const AUTH_SESSION_KEY = Symbol.for('vela.better-auth.session');\n","import { Reflector } from '@velajs/vela';\n\nexport const OptionalAuth = Reflector.createDecorator<boolean>({ key: 'vela.auth.optional' });\nexport const OPTIONAL_AUTH_KEY = OptionalAuth.KEY;\n","import {\n  Inject,\n  Injectable,\n  REQUEST_CONTEXT,\n  Reflector,\n  UnauthorizedException,\n  type CanActivate,\n  type ExecutionContext,\n  type RequestContext,\n} from '@velajs/vela';\nimport { AUTH_SESSION_KEY, AUTH_USER_KEY, BETTER_AUTH_OPTIONS } from '../better-auth.tokens';\nimport { BetterAuthService } from '../better-auth.service';\nimport type { BetterAuthModuleOptions } from '../better-auth.types';\nimport { OptionalAuth } from '../decorators/optional-auth.decorator';\nimport { Public } from '../decorators/public.decorator';\n\n@Injectable()\nexport class AuthGuard implements CanActivate {\n  private readonly reflector = new Reflector();\n\n  constructor(\n    // Inject BetterAuthService rather than the raw better-auth instance.\n    // The service's lazy `.auth` getter defers construction to first use, so\n    // forRootAsync factories that depend on values only available at\n    // request time (Cloudflare D1/KV bindings, etc.) build safely on the\n    // first canActivate — not at module-load bootstrap.\n    @Inject(BetterAuthService) private readonly auth: BetterAuthService,\n    @Inject(BETTER_AUTH_OPTIONS) private readonly opts: BetterAuthModuleOptions,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    if (this.reflector.getAllAndOverride(Public, context)) return true;\n\n    const request = context.getRequest();\n    const path = new URL(request.url).pathname;\n    const basePath = this.opts.basePath ?? '/api/auth';\n    if (path === basePath || path.startsWith(`${basePath}/`)) return true;\n\n    const data = await this.auth.api.getSession({ headers: request.headers });\n\n    if (data) {\n      const reqCtx = resolveRequestContext(context);\n      reqCtx.set(AUTH_USER_KEY, data.user);\n      reqCtx.set(AUTH_SESSION_KEY, data.session);\n      return true;\n    }\n\n    if (\n      this.opts.defaultPolicy === 'allow' ||\n      this.reflector.getAllAndOverride(OptionalAuth, context)\n    ) {\n      return true;\n    }\n\n    throw new UnauthorizedException('Authentication required');\n  }\n}\n\ninterface ContainerLike {\n  resolve<T>(token: unknown): T;\n}\n\nfunction resolveRequestContext(context: ExecutionContext): RequestContext {\n  const honoCtx = context.getContext() as { get: (k: string) => ContainerLike };\n  const container = honoCtx.get('container');\n  return container.resolve<RequestContext>(REQUEST_CONTEXT);\n}\n","import { Reflector } from '@velajs/vela';\n\nexport const Roles = Reflector.createDecorator<string[]>({ key: 'vela.auth.roles' });\nexport const ROLES_KEY = Roles.KEY;\n","import {\n  ForbiddenException,\n  Injectable,\n  REQUEST_CONTEXT,\n  Reflector,\n  type CanActivate,\n  type ExecutionContext,\n  type RequestContext,\n} from '@velajs/vela';\nimport { AUTH_USER_KEY } from '../better-auth.tokens';\nimport type { User } from '../better-auth.types';\nimport { Roles } from '../decorators/roles.decorator';\n\n@Injectable()\nexport class RolesGuard implements CanActivate {\n  private readonly reflector = new Reflector();\n\n  canActivate(context: ExecutionContext): boolean {\n    const required = this.reflector.getAllAndOverride(Roles, context);\n    if (!required || required.length === 0) return true;\n\n    const honoCtx = context.getContext() as {\n      get: (k: string) => { resolve<T>(t: unknown): T };\n    };\n    const reqCtx = honoCtx.get('container').resolve<RequestContext>(REQUEST_CONTEXT);\n    const user = reqCtx.get<User & { role?: string | string[] }>(AUTH_USER_KEY);\n    if (!user) {\n      throw new ForbiddenException('Role check requires authentication');\n    }\n\n    const userRoles = normalizeRoles(user.role);\n    const ok = required.some((r) => userRoles.includes(r));\n    if (!ok) {\n      throw new ForbiddenException(`Insufficient role; one of [${required.join(', ')}] required`);\n    }\n    return true;\n  }\n}\n\nfunction normalizeRoles(role: string | string[] | undefined): string[] {\n  if (!role) return [];\n  if (Array.isArray(role)) return role;\n  return role\n    .split(',')\n    .map((r) => r.trim())\n    .filter(Boolean);\n}\n","import type { Identity, PermissionResolver } from '@velajs/authz';\nimport type { User } from './better-auth.types';\n\n/**\n * A better-auth user carrying the optional `role` field contributed by the\n * admin plugin. `role` may be a single role, a comma-separated list, or an\n * array — {@link identityFromUser} normalizes all three.\n */\nexport type AuthUser = User & { role?: string | string[] | null };\n\nconst normalizeRoles = (role: string | string[] | null | undefined): string[] => {\n  if (!role) return [];\n  // Strip empty entries and return a fresh array (never alias the caller's\n  // input), matching the comma-string path below.\n  if (Array.isArray(role)) return role.filter(Boolean);\n  return role\n    .split(',')\n    .map((r) => r.trim())\n    .filter(Boolean);\n};\n\n/**\n * Adapts a better-auth user into a `@velajs/authz` {@link Identity}. Maps\n * `user.id` → `userId` and the admin-plugin `role` field → `roles`.\n *\n * Fail-closed: a missing user (`null`/`undefined`, i.e. an unauthenticated\n * request) maps to the zero-privilege identity `{ roles: [] }`, so downstream\n * `can()` checks grant nothing.\n */\nexport const identityFromUser = (user: AuthUser | null | undefined): Identity => {\n  if (!user) return { roles: [] };\n  return {\n    userId: user.id,\n    roles: normalizeRoles(user.role),\n  };\n};\n\n/**\n * The minimal slice of a better-auth access-control role consumed here. Both\n * `createAccessControl(...).newRole(...)` and the standalone `role(...)` return\n * `{ authorize, statements }`; `statements` is the `{ resource: actions[] }`\n * grant map for that role — the only accessor {@link betterAuthAcResolver}\n * reads.\n */\nexport interface BetterAuthAcRole {\n  readonly statements: Readonly<Record<string, readonly string[]>>;\n}\n\n/**\n * Flattens a better-auth AC role's `statements` into `resource:action`\n * permission strings — the granted-side format `@velajs/authz` matches\n * (wildcards included).\n */\nexport const permissionsFromAcRole = (role: BetterAuthAcRole): string[] => {\n  const permissions: string[] = [];\n  for (const [resource, actions] of Object.entries(role.statements ?? {})) {\n    for (const action of actions ?? []) permissions.push(`${resource}:${action}`);\n  }\n  return permissions;\n};\n\n/**\n * Builds a fail-closed `@velajs/authz` {@link PermissionResolver} from a\n * better-auth access-control role table (`{ roleName: acRole }` — the same map\n * shape passed to better-auth's admin/organization plugins). An identity's\n * `roles` are unioned into their granted permission strings; unknown roles\n * contribute nothing.\n *\n * ```ts\n * const ac = createAccessControl({ posts: ['read', 'write'] });\n * const authz = createAuthz({\n *   resolver: betterAuthAcResolver({ editor: ac.newRole({ posts: ['write'] }) }),\n * });\n * await authz.can(identityFromUser(user), 'posts:write');\n * ```\n */\nexport const betterAuthAcResolver = (\n  roles: Readonly<Record<string, BetterAuthAcRole>>,\n): PermissionResolver => {\n  const grantsByRole = new Map<string, string[]>();\n  for (const [name, role] of Object.entries(roles)) {\n    grantsByRole.set(name, permissionsFromAcRole(role));\n  }\n  return {\n    grants(identity: Identity): Set<string> {\n      const out = new Set<string>();\n      for (const name of identity.roles ?? []) {\n        for (const permission of grantsByRole.get(name) ?? []) out.add(permission);\n      }\n      return out;\n    },\n  };\n};\n","import { Reflector } from '@velajs/vela';\n\n/**\n * Declares the `@velajs/authz` permission(s) required to reach a controller or\n * route handler. Read via `Reflector` in an authorization guard, then checked\n * against the caller's `Identity` with `authz.can(...)`.\n *\n * ```ts\n * @RequirePermission(['posts:write'])\n * @Post()\n * create() { ... }\n * ```\n *\n * The metadata is a plain `string[]` of permission strings in the granted-side\n * format `@velajs/authz` matches (`resource:action`, or wildcards like\n * `posts:*`). Handler-level metadata overrides class-level (standard\n * `Reflector.getAllAndOverride` precedence).\n *\n * Semantics are **require-ALL** (AND): every listed permission must be granted\n * for access — the `PermissionGuard` denies if any one is missing. This\n * contrasts with `@Roles`, which is **OR** (any one of the listed roles\n * suffices).\n */\nexport const RequirePermission = Reflector.createDecorator<string[]>({\n  key: 'vela.authz.permissions',\n});\n\nexport const REQUIRE_PERMISSION_KEY = RequirePermission.KEY;\n","import {\n  ForbiddenException,\n  Injectable,\n  InjectionToken,\n  REQUEST_CONTEXT,\n  Reflector,\n  type CanActivate,\n  type ExecutionContext,\n  type RequestContext,\n} from '@velajs/vela';\nimport { AUTHZ } from '@velajs/authz/vela';\nimport type { Authz } from '@velajs/authz';\nimport { AUTH_USER_KEY } from '../better-auth.tokens';\nimport type { User } from '../better-auth.types';\nimport { identityFromUser } from '../authz-bridge';\nimport { RequirePermission } from '../decorators/require-permission.decorator';\n\n// The linked `@velajs/authz` is built against its own (newer) `@velajs/vela`\n// copy, so the `AUTHZ` token's `InjectionToken` type is nominally distinct from\n// this package's `InjectionToken` — even though it is the very same runtime\n// token object (the DI container matches tokens by object identity). Re-type it\n// to the local `InjectionToken` so the request-time `container.resolve(...)`\n// accepts it without a structural clash. This is purely a compile-time alias;\n// it changes nothing at runtime. (Version-skew workaround until both publish.)\nconst AUTHZ_TOKEN = AUTHZ as unknown as InjectionToken<Authz>;\n\n/**\n * Enforces the `@RequirePermission(...)` metadata against the `@velajs/authz`\n * engine. For each required permission it calls `authz.can(identity, perm)`,\n * requiring **all** of them (AND semantics — contrast {@link RolesGuard}, which\n * is OR over roles). The caller's `Identity` is derived from the better-auth\n * user that {@link AuthGuard} placed in the request context, so this guard must\n * run *after* `AuthGuard` (e.g. `@UseGuards(AuthGuard, PermissionGuard)`).\n *\n * `AUTHZ` is resolved at **request time** from the per-request container (the\n * same container `REQUEST_CONTEXT` is resolved from), not constructor-injected.\n * This deliberately avoids DI visibility coupling: the guard works whether or\n * not `AuthzModule` is registered as global — a present-but-non-global\n * `AuthzModule` resolves fine and, crucially, never crashes bootstrap. If\n * `AuthzModule` is not registered at all the resolve fails and the guard fails\n * closed (403) rather than granting access.\n *\n * Fail-closed on every abnormal path — no branch grants access on missing\n * wiring or a missing caller:\n * - no required permissions → allow (nothing to enforce);\n * - `AUTHZ` unresolvable (`AuthzModule` not registered) → deny (`ForbiddenException`);\n * - no authenticated user in the request context → deny;\n * - any single required permission not granted → deny.\n *\n * The guard is stateless (no injected dependencies), so it is safe to register\n * as a plain provided guard.\n */\n@Injectable()\nexport class PermissionGuard implements CanActivate {\n  private readonly reflector = new Reflector();\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const required = this.reflector.getAllAndOverride(RequirePermission, context);\n    if (!required || required.length === 0) return true;\n\n    const honoCtx = context.getContext() as {\n      get: (k: string) => { resolve<T>(t: unknown): T };\n    };\n    const container = honoCtx.get('container');\n\n    // Resolve AUTHZ at request time from the per-request container — the SAME\n    // container REQUEST_CONTEXT resolves from. Because this lookup carries no\n    // requesting module, it matches AUTHZ by its exporter, so a non-global\n    // `AuthzModule` is reachable without forcing the app to declare it global.\n    // `resolve` throws (or, defensively, could yield undefined) for an\n    // unregistered token, so wrap it and fail closed on any failure.\n    let authz: Authz | undefined;\n    try {\n      authz = container.resolve<Authz>(AUTHZ_TOKEN);\n    } catch {\n      authz = undefined;\n    }\n    if (!authz) {\n      throw new ForbiddenException('Authorization is not configured');\n    }\n\n    const reqCtx = container.resolve<RequestContext>(REQUEST_CONTEXT);\n    const user = reqCtx.get<User & { id?: string; role?: string | string[] }>(AUTH_USER_KEY);\n    if (!user) {\n      throw new ForbiddenException('Permission check requires authentication');\n    }\n\n    const identity = identityFromUser(user);\n    for (const permission of required) {\n      if (!(await authz.can(identity, permission))) {\n        throw new ForbiddenException(`Missing permission: ${permission}`);\n      }\n    }\n    return true;\n  }\n}\n","import {\n  defineModule,\n  lazyProvider,\n  provideGlobal,\n  stableHash,\n  type DynamicModule,\n  type InferTokens,\n  type ProviderOptions,\n  type Token,\n  type Type,\n} from '@velajs/vela';\nimport { createBetterAuthCatchallController } from './better-auth.controller';\nimport { BetterAuthService, BETTER_AUTH_BUILDER } from './better-auth.service';\nimport { BETTER_AUTH_OPTIONS } from './better-auth.tokens';\nimport type { BetterAuthInstance, BetterAuthModuleOptions } from './better-auth.types';\nimport { AuthGuard } from './guards/auth.guard';\nimport { RolesGuard } from './guards/roles.guard';\nimport { PermissionGuard } from './guards/permission.guard';\n\nconst DEFAULT_BASE_PATH = '/api/auth';\n\n/** Structural options with defaults applied (everything but the auth instance). */\ninterface NormalizedOptions {\n  basePath: string;\n  isGlobal: boolean;\n  defaultPolicy: 'deny' | 'allow';\n  mountHandler: boolean;\n}\n\nfunction normalize(options: Partial<BetterAuthModuleOptions>): NormalizedOptions {\n  return {\n    basePath: options.basePath ?? DEFAULT_BASE_PATH,\n    isGlobal: options.isGlobal ?? false,\n    defaultPolicy: options.defaultPolicy ?? 'deny',\n    mountHandler: options.mountHandler ?? true,\n  };\n}\n\n/** Providers, controllers, and exports shared by both entry points. */\nfunction commonContributions(n: NormalizedOptions): {\n  providers: Array<Type | ProviderOptions>;\n  controllers: Type[];\n  exports: DynamicModule['exports'];\n} {\n  return {\n    providers: [BetterAuthService, AuthGuard, RolesGuard, PermissionGuard],\n    controllers: n.mountHandler ? [createBetterAuthCatchallController(n.basePath)] : [],\n    exports: [BetterAuthService, BETTER_AUTH_OPTIONS, AuthGuard, RolesGuard, PermissionGuard],\n  };\n}\n\n/**\n * The blessed engine generates `forRoot`. `setup` runs once per instance at\n * call time: it re-provides {@link BETTER_AUTH_OPTIONS} with defaults applied,\n * derives the auth builder from those options, mounts the catch-all controller,\n * and — via the `global:` slot — registers the app-wide guard when `isGlobal`.\n *\n * `isGlobal` here means \"apply AuthGuard app-wide\", NOT \"make this a global\n * module\", so the default `isGlobal → global: true` extras transform is\n * replaced with identity; the flag reaches `setup` through the options bag.\n */\nconst authModuleHost = defineModule<BetterAuthModuleOptions>({\n  name: 'BetterAuth',\n  optionsToken: BETTER_AUTH_OPTIONS,\n  transform: (definition) => definition,\n  // The auth instance is a stateful value — key off the structural subset only.\n  key: (options) => stableHash(normalize(options)),\n  setup: ({ OPTIONS, options }) => {\n    const n = normalize(options);\n    const common = commonContributions(n);\n    const auth = (options as BetterAuthModuleOptions).auth;\n    return {\n      providers: [\n        // Override the auto-provided raw bag with the normalized shape so\n        // BETTER_AUTH_OPTIONS consumers always see defaults + the auth instance.\n        { provide: OPTIONS, useValue: { ...n, auth } },\n        // Eager auth: the builder hands back the instance the caller passed in.\n        lazyProvider({\n          provide: BETTER_AUTH_BUILDER,\n          inject: [OPTIONS],\n          useFactory: (o: BetterAuthModuleOptions) => o.auth,\n        }),\n        ...common.providers,\n      ],\n      controllers: common.controllers,\n      exports: common.exports,\n      global: n.isGlobal ? { guards: [AuthGuard] } : undefined,\n    };\n  },\n});\n\n/**\n * Options for {@link BetterAuthModule.forRootAsync}.\n *\n * The `Inject` type parameter captures the literal `inject` tuple at the call\n * site (via `const` inference) so `useFactory` parameters are typed from the\n * inject array, position-by-position — no `as const`, no `(...deps: any[])`:\n *\n * ```ts\n * BetterAuthModule.forRootAsync({\n *   inject: [D1Service, ConfigService],   // captured as readonly tuple\n *   useFactory: (d1, config) =>            // d1: D1Service, config: ConfigService\n *     betterAuth({ database: drizzleAdapter(drizzle(d1.database), ...) }),\n * });\n * ```\n */\ninterface ForRootAsyncOptions<\n  Inject extends readonly Token<unknown>[] = readonly Token<unknown>[],\n> {\n  inject?: Inject;\n  imports?: DynamicModule['imports'];\n  useFactory: (...deps: InferTokens<Inject>) => BetterAuthInstance;\n  isGlobal?: boolean;\n  mountHandler?: boolean;\n  basePath?: string;\n  defaultPolicy?: 'deny' | 'allow';\n  key?: string;\n}\n\nexport class BetterAuthModule {\n  /**\n   * Synchronous registration. The auth instance is constructed by the consumer\n   * at module-load time and passed in directly. Use this when the inputs to\n   * `betterAuth({...})` are available at startup (Node apps with a static DB\n   * connection, in-memory adapters, etc.).\n   */\n  static forRoot(\n    options: BetterAuthModuleOptions & { isGlobal?: boolean; key?: string },\n  ): DynamicModule {\n    // Delegate to the generated static, then rebrand the module identity so the\n    // public `BetterAuthModule` class is the one registered (consistent with\n    // `forRootAsync` and better diagnostics).\n    return { ...authModuleHost.ConfigurableModuleClass.forRoot(options), module: BetterAuthModule };\n  }\n\n  /**\n   * Deferred / DI-driven registration. The user factory runs **lazily**, on the\n   * first time anything reads `BetterAuthService.auth` (or `.api` / `.handler`).\n   * In normal request handling that's `AuthGuard.canActivate` or the catch-all\n   * controller's `.handle`. At module load the factory does NOT run — it's only\n   * captured behind {@link lazyProvider}'s memoized thunk. This is what makes\n   * Cloudflare bindings (D1, KV, R2) work: the binding isn't ready at boot, but\n   * it IS by the time a request flows through and the guard / catch-all reads\n   * the service. Inject deps resolve at module load (cheap BindingRef wrappers);\n   * their *values* are read at first auth use, inside your factory body.\n   */\n  static forRootAsync<const Inject extends readonly Token<unknown>[] = readonly Token<unknown>[]>(\n    options: ForRootAsyncOptions<Inject>,\n  ): DynamicModule {\n    const n = normalize(options);\n    const common = commonContributions(n);\n    return {\n      module: BetterAuthModule,\n      key: options.key ?? stableHash({ ...n, inject: options.inject }),\n      imports: options.imports ?? [],\n      providers: [\n        { provide: BETTER_AUTH_OPTIONS, useValue: n },\n        // The deferred auth builder: `lazyProvider` wraps the user factory in a\n        // memoized thunk, replacing the hand-rolled `(...deps) => () => f(...deps)`.\n        lazyProvider({\n          provide: BETTER_AUTH_BUILDER,\n          inject: options.inject,\n          useFactory: options.useFactory,\n        }),\n        ...common.providers,\n        ...(n.isGlobal ? provideGlobal('guard', AuthGuard) : []),\n      ],\n      controllers: common.controllers,\n      exports: common.exports,\n    };\n  }\n}\n","import {\n  createLazyParamDecorator,\n  REQUEST_CONTEXT,\n  type ExecutionContext,\n  type RequestContext,\n} from '@velajs/vela';\nimport { AUTH_USER_KEY } from '../better-auth.tokens';\nimport type { User } from '../better-auth.types';\n\nexport const CurrentUser = createLazyParamDecorator((_data: unknown, ctx: ExecutionContext) => {\n  const honoCtx = ctx.getContext() as { get: (k: string) => { resolve<T>(t: unknown): T } };\n  const reqCtx = honoCtx.get('container').resolve<RequestContext>(REQUEST_CONTEXT);\n  return reqCtx.get<User>(AUTH_USER_KEY);\n});\n","import {\n  createLazyParamDecorator,\n  REQUEST_CONTEXT,\n  type ExecutionContext,\n  type RequestContext,\n} from '@velajs/vela';\nimport { AUTH_SESSION_KEY } from '../better-auth.tokens';\nimport type { Session } from '../better-auth.types';\n\nexport const CurrentSession = createLazyParamDecorator((_data: unknown, ctx: ExecutionContext) => {\n  const honoCtx = ctx.getContext() as { get: (k: string) => { resolve<T>(t: unknown): T } };\n  const reqCtx = honoCtx.get('container').resolve<RequestContext>(REQUEST_CONTEXT);\n  return reqCtx.get<Session>(AUTH_SESSION_KEY);\n});\n"],"mappings":";;;;AAEA,MAAa,SAAS,UAAU,gBAAyB,EAAE,KAAK,mBAAmB,CAAC;AACpF,MAAa,aAAa,OAAO;;;;;;;;;;;;;;;;ACejC,SAAgB,mCAAmC,WAAmB,aAAmB;CACvF,IAAA,+BAAA,MAGM,6BAA6B;EAIuB;EAAxD,YAAY,MAAqE;GAAzB,KAAA,OAAA;EAA0B;EAElF,MACM,OAAO,GAAsC;GACjD,OAAO,KAAK,KAAK,QAAQ,EAAE,IAAI,GAAG;EACpC;CACF;;EAJG,IAAI,IAAI;qBACK,IAAI,CAAA;;;;;;EAVnB,OAAO,IAAI;EACX,WAAW,QAAQ;EACnB,WAAW;qBAKG,OAAO,iBAAiB,CAAA;;;CAOvC,OAAO;AACT;;;;;;AAOA,MAAa,+BAA+B,mCAAmC;;;ACtC/E,MAAa,sBAAsB,IAAI,eACrC,wBACF;AAEA,MAAa,gBAAgB,OAAO,IAAI,uBAAuB;AAC/D,MAAa,mBAAmB,OAAO,IAAI,0BAA0B;;;ACNrE,MAAa,eAAe,UAAU,gBAAyB,EAAE,KAAK,qBAAqB,CAAC;AAC5F,MAAa,oBAAoB,aAAa;;;ACcvC,IAAA,YAAA,MAAM,UAAiC;CASE;CACE;CAThD,YAA6B,IAAI,UAAU;CAE3C,YAME,MACA,MACA;EAF4C,KAAA,OAAA;EACE,KAAA,OAAA;CAC7C;CAEH,MAAM,YAAY,SAA6C;EAC7D,IAAI,KAAK,UAAU,kBAAkB,QAAQ,OAAO,GAAG,OAAO;EAE9D,MAAM,UAAU,QAAQ,WAAW;EACnC,MAAM,OAAO,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC;EAClC,MAAM,WAAW,KAAK,KAAK,YAAY;EACvC,IAAI,SAAS,YAAY,KAAK,WAAW,GAAG,SAAS,EAAE,GAAG,OAAO;EAEjE,MAAM,OAAO,MAAM,KAAK,KAAK,IAAI,WAAW,EAAE,SAAS,QAAQ,QAAQ,CAAC;EAExE,IAAI,MAAM;GACR,MAAM,SAAS,sBAAsB,OAAO;GAC5C,OAAO,IAAI,eAAe,KAAK,IAAI;GACnC,OAAO,IAAI,kBAAkB,KAAK,OAAO;GACzC,OAAO;EACT;EAEA,IACE,KAAK,KAAK,kBAAkB,WAC5B,KAAK,UAAU,kBAAkB,cAAc,OAAO,GAEtD,OAAO;EAGT,MAAM,IAAI,sBAAsB,yBAAyB;CAC3D;AACF;;CAxCC,WAAW;oBAUP,OAAO,iBAAiB,CAAA;oBACxB,OAAO,mBAAmB,CAAA;;;AAmC/B,SAAS,sBAAsB,SAA2C;CAGxE,OAFgB,QAAQ,WACA,CAAC,CAAC,IAAI,WACf,CAAC,CAAC,QAAwB,eAAe;AAC1D;;;AChEA,MAAa,QAAQ,UAAU,gBAA0B,EAAE,KAAK,kBAAkB,CAAC;AACnF,MAAa,YAAY,MAAM;;;ACWxB,IAAA,aAAA,MAAM,WAAkC;CAC7C,YAA6B,IAAI,UAAU;CAE3C,YAAY,SAAoC;EAC9C,MAAM,WAAW,KAAK,UAAU,kBAAkB,OAAO,OAAO;EAChE,IAAI,CAAC,YAAY,SAAS,WAAW,GAAG,OAAO;EAM/C,MAAM,OAJU,QAAQ,WAGH,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,QAAwB,eAC9C,CAAC,CAAC,IAAyC,aAAa;EAC1E,IAAI,CAAC,MACH,MAAM,IAAI,mBAAmB,oCAAoC;EAGnE,MAAM,YAAYA,iBAAe,KAAK,IAAI;EAE1C,IAAI,CADO,SAAS,MAAM,MAAM,UAAU,SAAS,CAAC,CAC9C,GACJ,MAAM,IAAI,mBAAmB,8BAA8B,SAAS,KAAK,IAAI,EAAE,WAAW;EAE5F,OAAO;CACT;AACF;yBAxBC,WAAW,CAAA,GAAA,UAAA;AA0BZ,SAASA,iBAAe,MAA+C;CACrE,IAAI,CAAC,MAAM,OAAO,CAAC;CACnB,IAAI,MAAM,QAAQ,IAAI,GAAG,OAAO;CAChC,OAAO,KACJ,MAAM,GAAG,CAAC,CACV,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,CACpB,OAAO,OAAO;AACnB;;;ACpCA,MAAM,kBAAkB,SAAyD;CAC/E,IAAI,CAAC,MAAM,OAAO,CAAC;CAGnB,IAAI,MAAM,QAAQ,IAAI,GAAG,OAAO,KAAK,OAAO,OAAO;CACnD,OAAO,KACJ,MAAM,GAAG,CAAC,CACV,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,CACpB,OAAO,OAAO;AACnB;;;;;;;;;AAUA,MAAa,oBAAoB,SAAgD;CAC/E,IAAI,CAAC,MAAM,OAAO,EAAE,OAAO,CAAC,EAAE;CAC9B,OAAO;EACL,QAAQ,KAAK;EACb,OAAO,eAAe,KAAK,IAAI;CACjC;AACF;;;;;;AAkBA,MAAa,yBAAyB,SAAqC;CACzE,MAAM,cAAwB,CAAC;CAC/B,KAAK,MAAM,CAAC,UAAU,YAAY,OAAO,QAAQ,KAAK,cAAc,CAAC,CAAC,GACpE,KAAK,MAAM,UAAU,WAAW,CAAC,GAAG,YAAY,KAAK,GAAG,SAAS,GAAG,QAAQ;CAE9E,OAAO;AACT;;;;;;;;;;;;;;;;AAiBA,MAAa,wBACX,UACuB;CACvB,MAAM,+BAAe,IAAI,IAAsB;CAC/C,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,KAAK,GAC7C,aAAa,IAAI,MAAM,sBAAsB,IAAI,CAAC;CAEpD,OAAO,EACL,OAAO,UAAiC;EACtC,MAAM,sBAAM,IAAI,IAAY;EAC5B,KAAK,MAAM,QAAQ,SAAS,SAAS,CAAC,GACpC,KAAK,MAAM,cAAc,aAAa,IAAI,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,UAAU;EAE3E,OAAO;CACT,EACF;AACF;;;;;;;;;;;;;;;;;;;;;;;;ACrEA,MAAa,oBAAoB,UAAU,gBAA0B,EACnE,KAAK,yBACP,CAAC;AAED,MAAa,yBAAyB,kBAAkB;;;ACHxD,MAAM,cAAc;AA6Bb,IAAA,kBAAA,MAAM,gBAAuC;CAClD,YAA6B,IAAI,UAAU;CAE3C,MAAM,YAAY,SAA6C;EAC7D,MAAM,WAAW,KAAK,UAAU,kBAAkB,mBAAmB,OAAO;EAC5E,IAAI,CAAC,YAAY,SAAS,WAAW,GAAG,OAAO;EAK/C,MAAM,YAHU,QAAQ,WAGA,CAAC,CAAC,IAAI,WAAW;EAQzC,IAAI;EACJ,IAAI;GACF,QAAQ,UAAU,QAAe,WAAW;EAC9C,QAAQ;GACN,QAAQ,KAAA;EACV;EACA,IAAI,CAAC,OACH,MAAM,IAAI,mBAAmB,iCAAiC;EAIhE,MAAM,OADS,UAAU,QAAwB,eAC/B,CAAC,CAAC,IAAsD,aAAa;EACvF,IAAI,CAAC,MACH,MAAM,IAAI,mBAAmB,0CAA0C;EAGzE,MAAM,WAAW,iBAAiB,IAAI;EACtC,KAAK,MAAM,cAAc,UACvB,IAAI,CAAE,MAAM,MAAM,IAAI,UAAU,UAAU,GACxC,MAAM,IAAI,mBAAmB,uBAAuB,YAAY;EAGpE,OAAO;CACT;AACF;8BA3CC,WAAW,CAAA,GAAA,eAAA;;;ACjCZ,MAAM,oBAAoB;AAU1B,SAAS,UAAU,SAA8D;CAC/E,OAAO;EACL,UAAU,QAAQ,YAAY;EAC9B,UAAU,QAAQ,YAAY;EAC9B,eAAe,QAAQ,iBAAiB;EACxC,cAAc,QAAQ,gBAAgB;CACxC;AACF;;AAGA,SAAS,oBAAoB,GAI3B;CACA,OAAO;EACL,WAAW;GAAC;GAAmB;GAAW;GAAY;EAAe;EACrE,aAAa,EAAE,eAAe,CAAC,mCAAmC,EAAE,QAAQ,CAAC,IAAI,CAAC;EAClF,SAAS;GAAC;GAAmB;GAAqB;GAAW;GAAY;EAAe;CAC1F;AACF;;;;;;;;;;;AAYA,MAAM,iBAAiB,aAAsC;CAC3D,MAAM;CACN,cAAc;CACd,YAAY,eAAe;CAE3B,MAAM,YAAY,WAAW,UAAU,OAAO,CAAC;CAC/C,QAAQ,EAAE,SAAS,cAAc;EAC/B,MAAM,IAAI,UAAU,OAAO;EAC3B,MAAM,SAAS,oBAAoB,CAAC;EACpC,MAAM,OAAQ,QAAoC;EAClD,OAAO;GACL,WAAW;IAGT;KAAE,SAAS;KAAS,UAAU;MAAE,GAAG;MAAG;KAAK;IAAE;IAE7C,aAAa;KACX,SAAS;KACT,QAAQ,CAAC,OAAO;KAChB,aAAa,MAA+B,EAAE;IAChD,CAAC;IACD,GAAG,OAAO;GACZ;GACA,aAAa,OAAO;GACpB,SAAS,OAAO;GAChB,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,KAAA;EACjD;CACF;AACF,CAAC;AA8BD,IAAa,mBAAb,MAAa,iBAAiB;;;;;;;CAO5B,OAAO,QACL,SACe;EAIf,OAAO;GAAE,GAAG,eAAe,wBAAwB,QAAQ,OAAO;GAAG,QAAQ;EAAiB;CAChG;;;;;;;;;;;;CAaA,OAAO,aACL,SACe;EACf,MAAM,IAAI,UAAU,OAAO;EAC3B,MAAM,SAAS,oBAAoB,CAAC;EACpC,OAAO;GACL,QAAQ;GACR,KAAK,QAAQ,OAAO,WAAW;IAAE,GAAG;IAAG,QAAQ,QAAQ;GAAO,CAAC;GAC/D,SAAS,QAAQ,WAAW,CAAC;GAC7B,WAAW;IACT;KAAE,SAAS;KAAqB,UAAU;IAAE;IAG5C,aAAa;KACX,SAAS;KACT,QAAQ,QAAQ;KAChB,YAAY,QAAQ;IACtB,CAAC;IACD,GAAG,OAAO;IACV,GAAI,EAAE,WAAW,cAAc,SAAS,SAAS,IAAI,CAAC;GACxD;GACA,aAAa,OAAO;GACpB,SAAS,OAAO;EAClB;CACF;AACF;;;AClKA,MAAa,cAAc,0BAA0B,OAAgB,QAA0B;CAG7F,OAFgB,IAAI,WACC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,QAAwB,eACpD,CAAC,CAAC,IAAU,aAAa;AACvC,CAAC;;;ACJD,MAAa,iBAAiB,0BAA0B,OAAgB,QAA0B;CAGhG,OAFgB,IAAI,WACC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,QAAwB,eACpD,CAAC,CAAC,IAAa,gBAAgB;AAC7C,CAAC"}

package/dist/testing/index.d.ts

@@ -0,0 +1,50 @@
+//#region src/testing/acting-as.d.ts
+/**
+ * The slice of `@velajs/testing`'s `TestingModule` this resolver depends on.
+ * Declared structurally so `@velajs/better-auth/testing` carries NO runtime
+ * (or type) dependency on `@velajs/testing` — a real `TestingModule` satisfies
+ * it, and the resolver stays assignable to `@velajs/testing`'s `ActingAsResolver`.
+ */
+interface TestModuleLike {
+  get<T>(token: unknown): T;
+}
+/**
+ * A test principal. Opaque `Record<string, unknown>` to stay compatible with
+ * `@velajs/testing`'s `TestPrincipal`. Recognized fields:
+ *
+ * - `id`    — reuse the user with this id if it already exists.
+ * - `email` — reuse the user with this email, else create one.
+ * - `name`  — display name for a created user (defaults to the email).
+ *
+ * Any other fields are forwarded to `internalAdapter.createUser` (e.g. `role`)
+ * when a new user is minted, so role-guarded routes can be exercised.
+ */
+type ActingAsPrincipal = Record<string, unknown>;
+/**
+ * actingAs — a `@velajs/testing` auth resolver for better-auth.
+ *
+ * Resolves {@link BetterAuthService} from the module, mints a REAL better-auth
+ * session for `principal` through `auth.$context.internalAdapter`, and returns
+ * a `Headers` carrying a properly signed session cookie. Guarded routes
+ * (`AuthGuard`) then accept requests carrying those headers because
+ * `auth.api.getSession` validates the cookie against the same session store.
+ *
+ * The signature `(module, principal) => Promise<Headers>` is exactly
+ * `@velajs/testing`'s `ActingAsResolver`, so it plugs straight in:
+ *
+ * @example
+ * ```ts
+ * import { actingAs } from '@velajs/better-auth/testing';
+ *
+ * // As the default resolver for the module:
+ * module.setAuthResolver(actingAs);
+ * await module.http.get('/me').actingAs({ email: 'ada@example.com' }).send();
+ *
+ * // Or passed per-request:
+ * await module.http.get('/me').actingAs({ id: existingUserId }, actingAs).send();
+ * ```
+ */
+declare function actingAs(module: TestModuleLike, principal: ActingAsPrincipal): Promise<Headers>;
+//#endregion
+export { type ActingAsPrincipal, type TestModuleLike, actingAs };
+//# sourceMappingURL=index.d.ts.map

package/dist/testing/index.js

@@ -0,0 +1,60 @@
+import { n as BetterAuthService } from "../better-auth.service-BMkyFX-w.js";
+import { makeSignature } from "better-auth/crypto";
+//#region src/testing/acting-as.ts
+/**
+* actingAs — a `@velajs/testing` auth resolver for better-auth.
+*
+* Resolves {@link BetterAuthService} from the module, mints a REAL better-auth
+* session for `principal` through `auth.$context.internalAdapter`, and returns
+* a `Headers` carrying a properly signed session cookie. Guarded routes
+* (`AuthGuard`) then accept requests carrying those headers because
+* `auth.api.getSession` validates the cookie against the same session store.
+*
+* The signature `(module, principal) => Promise<Headers>` is exactly
+* `@velajs/testing`'s `ActingAsResolver`, so it plugs straight in:
+*
+* @example
+* ```ts
+* import { actingAs } from '@velajs/better-auth/testing';
+*
+* // As the default resolver for the module:
+* module.setAuthResolver(actingAs);
+* await module.http.get('/me').actingAs({ email: 'ada@example.com' }).send();
+*
+* // Or passed per-request:
+* await module.http.get('/me').actingAs({ id: existingUserId }, actingAs).send();
+* ```
+*/
+async function actingAs(module, principal) {
+	const ctx = await module.get(BetterAuthService).auth.$context;
+	const internalAdapter = ctx.internalAdapter;
+	const id = typeof principal.id === "string" ? principal.id : void 0;
+	const email = typeof principal.email === "string" ? principal.email : void 0;
+	const name = typeof principal.name === "string" ? principal.name : void 0;
+	let user = null;
+	if (id) user = await internalAdapter.findUserById(id);
+	if (!user && email) user = (await internalAdapter.findUserByEmail(email))?.user ?? null;
+	if (!user) {
+		if (!email) throw new Error("actingAs: principal must carry an `email` (to create a user) or an `id` matching an existing user.");
+		const { id: _id, email: _email, name: _name, ...extra } = principal;
+		user = await internalAdapter.createUser({
+			...extra,
+			email,
+			name: name ?? email,
+			...id ? { id } : {}
+		});
+	}
+	const session = await internalAdapter.createSession(user.id, false, {
+		ipAddress: "127.0.0.1",
+		userAgent: "vela-test"
+	});
+	const cookieName = ctx.authCookies.sessionToken.name;
+	const signedToken = `${session.token}.${await makeSignature(session.token, ctx.secret)}`;
+	const headers = new Headers();
+	headers.set("Cookie", `${cookieName}=${signedToken}`);
+	return headers;
+}
+//#endregion
+export { actingAs };
+
+//# sourceMappingURL=index.js.map

package/dist/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../src/testing/acting-as.ts"],"sourcesContent":["// Mechanics adapted from @stratal/testing (MIT, © Temitayo Fadojutimi):\n// mint a real better-auth session via `$context.internalAdapter` and hand back\n// a signed session-cookie header. Adapted to better-auth >=1.6: the session\n// cookie is signed with the package's own `makeSignature` (better-auth/crypto)\n// — the same primitive better-auth's built-in test cookie builder uses — so no\n// endpoint-context shim or `setSessionCookie` mock is needed.\nimport { makeSignature } from 'better-auth/crypto';\nimport { BetterAuthService } from '../better-auth.service';\n\n/**\n * The slice of `@velajs/testing`'s `TestingModule` this resolver depends on.\n * Declared structurally so `@velajs/better-auth/testing` carries NO runtime\n * (or type) dependency on `@velajs/testing` — a real `TestingModule` satisfies\n * it, and the resolver stays assignable to `@velajs/testing`'s `ActingAsResolver`.\n */\nexport interface TestModuleLike {\n  get<T>(token: unknown): T;\n}\n\n/**\n * A test principal. Opaque `Record<string, unknown>` to stay compatible with\n * `@velajs/testing`'s `TestPrincipal`. Recognized fields:\n *\n * - `id`    — reuse the user with this id if it already exists.\n * - `email` — reuse the user with this email, else create one.\n * - `name`  — display name for a created user (defaults to the email).\n *\n * Any other fields are forwarded to `internalAdapter.createUser` (e.g. `role`)\n * when a new user is minted, so role-guarded routes can be exercised.\n */\nexport type ActingAsPrincipal = Record<string, unknown>;\n\n/**\n * actingAs — a `@velajs/testing` auth resolver for better-auth.\n *\n * Resolves {@link BetterAuthService} from the module, mints a REAL better-auth\n * session for `principal` through `auth.$context.internalAdapter`, and returns\n * a `Headers` carrying a properly signed session cookie. Guarded routes\n * (`AuthGuard`) then accept requests carrying those headers because\n * `auth.api.getSession` validates the cookie against the same session store.\n *\n * The signature `(module, principal) => Promise<Headers>` is exactly\n * `@velajs/testing`'s `ActingAsResolver`, so it plugs straight in:\n *\n * @example\n * ```ts\n * import { actingAs } from '@velajs/better-auth/testing';\n *\n * // As the default resolver for the module:\n * module.setAuthResolver(actingAs);\n * await module.http.get('/me').actingAs({ email: 'ada@example.com' }).send();\n *\n * // Or passed per-request:\n * await module.http.get('/me').actingAs({ id: existingUserId }, actingAs).send();\n * ```\n */\nexport async function actingAs(\n  module: TestModuleLike,\n  principal: ActingAsPrincipal,\n): Promise<Headers> {\n  const auth = module.get<BetterAuthService>(BetterAuthService).auth;\n  const ctx = await auth.$context;\n  const internalAdapter = ctx.internalAdapter;\n\n  const id = typeof principal.id === 'string' ? principal.id : undefined;\n  const email = typeof principal.email === 'string' ? principal.email : undefined;\n  const name = typeof principal.name === 'string' ? principal.name : undefined;\n\n  // `findUserById`/`createUser` yield a bare user; `findUserByEmail` nests it\n  // under `{ user, accounts }` — normalize to the id we need.\n  let user: { id: string } | null = null;\n  if (id) user = await internalAdapter.findUserById(id);\n  if (!user && email) {\n    const found = await internalAdapter.findUserByEmail(email);\n    user = found?.user ?? null;\n  }\n  if (!user) {\n    if (!email) {\n      throw new Error(\n        'actingAs: principal must carry an `email` (to create a user) or an ' +\n          '`id` matching an existing user.',\n      );\n    }\n    const { id: _id, email: _email, name: _name, ...extra } = principal;\n    user = await internalAdapter.createUser({\n      ...extra,\n      email,\n      name: name ?? email,\n      ...(id ? { id } : {}),\n    });\n  }\n\n  const session = await internalAdapter.createSession(user.id, false, {\n    ipAddress: '127.0.0.1',\n    userAgent: 'vela-test',\n  });\n\n  const cookieName = ctx.authCookies.sessionToken.name;\n  const signedToken = `${session.token}.${await makeSignature(session.token, ctx.secret)}`;\n\n  const headers = new Headers();\n  headers.set('Cookie', `${cookieName}=${signedToken}`);\n  return headers;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAwDA,eAAsB,SACpB,QACA,WACkB;CAElB,MAAM,MAAM,MADC,OAAO,IAAuB,iBAAiB,CAAC,CAAC,KACvC;CACvB,MAAM,kBAAkB,IAAI;CAE5B,MAAM,KAAK,OAAO,UAAU,OAAO,WAAW,UAAU,KAAK,KAAA;CAC7D,MAAM,QAAQ,OAAO,UAAU,UAAU,WAAW,UAAU,QAAQ,KAAA;CACtE,MAAM,OAAO,OAAO,UAAU,SAAS,WAAW,UAAU,OAAO,KAAA;CAInE,IAAI,OAA8B;CAClC,IAAI,IAAI,OAAO,MAAM,gBAAgB,aAAa,EAAE;CACpD,IAAI,CAAC,QAAQ,OAEX,QAAO,MADa,gBAAgB,gBAAgB,KAAK,EAAA,EAC3C,QAAQ;CAExB,IAAI,CAAC,MAAM;EACT,IAAI,CAAC,OACH,MAAM,IAAI,MACR,oGAEF;EAEF,MAAM,EAAE,IAAI,KAAK,OAAO,QAAQ,MAAM,OAAO,GAAG,UAAU;EAC1D,OAAO,MAAM,gBAAgB,WAAW;GACtC,GAAG;GACH;GACA,MAAM,QAAQ;GACd,GAAI,KAAK,EAAE,GAAG,IAAI,CAAC;EACrB,CAAC;CACH;CAEA,MAAM,UAAU,MAAM,gBAAgB,cAAc,KAAK,IAAI,OAAO;EAClE,WAAW;EACX,WAAW;CACb,CAAC;CAED,MAAM,aAAa,IAAI,YAAY,aAAa;CAChD,MAAM,cAAc,GAAG,QAAQ,MAAM,GAAG,MAAM,cAAc,QAAQ,OAAO,IAAI,MAAM;CAErF,MAAM,UAAU,IAAI,QAAQ;CAC5B,QAAQ,IAAI,UAAU,GAAG,WAAW,GAAG,aAAa;CACpD,OAAO;AACT"}