@velajs/better-auth 0.6.0 → 0.6.1

package/dist/guards/auth.guard.js

@@ -1,68 +0,0 @@
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { Inject, Injectable, REQUEST_CONTEXT, Reflector, UnauthorizedException } from "@velajs/vela";
-import { AUTH_SESSION_KEY, AUTH_USER_KEY, BETTER_AUTH_OPTIONS } from "../better-auth.tokens.js";
-import { BetterAuthService } from "../better-auth.service.js";
-import { OptionalAuth } from "../decorators/optional-auth.decorator.js";
-import { Public } from "../decorators/public.decorator.js";
-export class AuthGuard {
-    auth;
-    opts;
-    reflector = new Reflector();
-    constructor(// Inject BetterAuthService rather than the raw better-auth instance.
-    // The service's lazy `.auth` getter defers construction to first use, so
-    // forRootAsync factories that depend on values only available at
-    // request time (Cloudflare D1/KV bindings, etc.) build safely on the
-    // first canActivate — not at module-load bootstrap.
-    auth, opts){
-        this.auth = auth;
-        this.opts = opts;
-    }
-    async canActivate(context) {
-        if (this.reflector.getAllAndOverride(Public, context)) return true;
-        const request = context.getRequest();
-        const path = new URL(request.url).pathname;
-        const basePath = this.opts.basePath ?? '/api/auth';
-        if (path === basePath || path.startsWith(`${basePath}/`)) return true;
-        const data = await this.auth.api.getSession({
-            headers: request.headers
-        });
-        if (data) {
-            const reqCtx = resolveRequestContext(context);
-            reqCtx.set(AUTH_USER_KEY, data.user);
-            reqCtx.set(AUTH_SESSION_KEY, data.session);
-            return true;
-        }
-        if (this.opts.defaultPolicy === 'allow' || this.reflector.getAllAndOverride(OptionalAuth, context)) {
-            return true;
-        }
-        throw new UnauthorizedException('Authentication required');
-    }
-}
-AuthGuard = _ts_decorate([
-    Injectable(),
-    _ts_param(0, Inject(BetterAuthService)),
-    _ts_param(1, Inject(BETTER_AUTH_OPTIONS)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof BetterAuthService === "undefined" ? Object : BetterAuthService,
-        typeof BetterAuthModuleOptions === "undefined" ? Object : BetterAuthModuleOptions
-    ])
-], AuthGuard);
-function resolveRequestContext(context) {
-    const honoCtx = context.getContext();
-    const container = honoCtx.get('container');
-    return container.resolve(REQUEST_CONTEXT);
-}

package/dist/guards/roles.guard.d.ts

@@ -1,5 +0,0 @@
-import { type CanActivate, type ExecutionContext } from '@velajs/vela';
-export declare class RolesGuard implements CanActivate {
-    private readonly reflector;
-    canActivate(context: ExecutionContext): boolean;
-}

package/dist/guards/roles.guard.js

@@ -1,36 +0,0 @@
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-import { ForbiddenException, Injectable, REQUEST_CONTEXT, Reflector } from "@velajs/vela";
-import { AUTH_USER_KEY } from "../better-auth.tokens.js";
-import { Roles } from "../decorators/roles.decorator.js";
-export class RolesGuard {
-    reflector = new Reflector();
-    canActivate(context) {
-        const required = this.reflector.getAllAndOverride(Roles, context);
-        if (!required || required.length === 0) return true;
-        const honoCtx = context.getContext();
-        const reqCtx = honoCtx.get('container').resolve(REQUEST_CONTEXT);
-        const user = reqCtx.get(AUTH_USER_KEY);
-        if (!user) {
-            throw new ForbiddenException('Role check requires authentication');
-        }
-        const userRoles = normalizeRoles(user.role);
-        const ok = required.some((r)=>userRoles.includes(r));
-        if (!ok) {
-            throw new ForbiddenException(`Insufficient role; one of [${required.join(', ')}] required`);
-        }
-        return true;
-    }
-}
-RolesGuard = _ts_decorate([
-    Injectable()
-], RolesGuard);
-function normalizeRoles(role) {
-    if (!role) return [];
-    if (Array.isArray(role)) return role;
-    return role.split(',').map((r)=>r.trim()).filter(Boolean);
-}

package/dist/testing/acting-as.d.ts

@@ -1,46 +0,0 @@
-/**
- * The slice of `@velajs/testing`'s `TestingModule` this resolver depends on.
- * Declared structurally so `@velajs/better-auth/testing` carries NO runtime
- * (or type) dependency on `@velajs/testing` — a real `TestingModule` satisfies
- * it, and the resolver stays assignable to `@velajs/testing`'s `ActingAsResolver`.
- */
-export interface TestModuleLike {
-    get<T>(token: unknown): T;
-}
-/**
- * A test principal. Opaque `Record<string, unknown>` to stay compatible with
- * `@velajs/testing`'s `TestPrincipal`. Recognized fields:
- *
- * - `id`    — reuse the user with this id if it already exists.
- * - `email` — reuse the user with this email, else create one.
- * - `name`  — display name for a created user (defaults to the email).
- *
- * Any other fields are forwarded to `internalAdapter.createUser` (e.g. `role`)
- * when a new user is minted, so role-guarded routes can be exercised.
- */
-export type ActingAsPrincipal = Record<string, unknown>;
-/**
- * actingAs — a `@velajs/testing` auth resolver for better-auth.
- *
- * Resolves {@link BetterAuthService} from the module, mints a REAL better-auth
- * session for `principal` through `auth.$context.internalAdapter`, and returns
- * a `Headers` carrying a properly signed session cookie. Guarded routes
- * (`AuthGuard`) then accept requests carrying those headers because
- * `auth.api.getSession` validates the cookie against the same session store.
- *
- * The signature `(module, principal) => Promise<Headers>` is exactly
- * `@velajs/testing`'s `ActingAsResolver`, so it plugs straight in:
- *
- * @example
- * ```ts
- * import { actingAs } from '@velajs/better-auth/testing';
- *
- * // As the default resolver for the module:
- * module.setAuthResolver(actingAs);
- * await module.http.get('/me').actingAs({ email: 'ada@example.com' }).send();
- *
- * // Or passed per-request:
- * await module.http.get('/me').actingAs({ id: existingUserId }, actingAs).send();
- * ```
- */
-export declare function actingAs(module: TestModuleLike, principal: ActingAsPrincipal): Promise<Headers>;

package/dist/testing/acting-as.js

@@ -1,70 +0,0 @@
-// Mechanics adapted from @stratal/testing (MIT, © Temitayo Fadojutimi):
-// mint a real better-auth session via `$context.internalAdapter` and hand back
-// a signed session-cookie header. Adapted to better-auth >=1.6: the session
-// cookie is signed with the package's own `makeSignature` (better-auth/crypto)
-// — the same primitive better-auth's built-in test cookie builder uses — so no
-// endpoint-context shim or `setSessionCookie` mock is needed.
-import { makeSignature } from "better-auth/crypto";
-import { BetterAuthService } from "../better-auth.service.js";
-/**
- * actingAs — a `@velajs/testing` auth resolver for better-auth.
- *
- * Resolves {@link BetterAuthService} from the module, mints a REAL better-auth
- * session for `principal` through `auth.$context.internalAdapter`, and returns
- * a `Headers` carrying a properly signed session cookie. Guarded routes
- * (`AuthGuard`) then accept requests carrying those headers because
- * `auth.api.getSession` validates the cookie against the same session store.
- *
- * The signature `(module, principal) => Promise<Headers>` is exactly
- * `@velajs/testing`'s `ActingAsResolver`, so it plugs straight in:
- *
- * @example
- * ```ts
- * import { actingAs } from '@velajs/better-auth/testing';
- *
- * // As the default resolver for the module:
- * module.setAuthResolver(actingAs);
- * await module.http.get('/me').actingAs({ email: 'ada@example.com' }).send();
- *
- * // Or passed per-request:
- * await module.http.get('/me').actingAs({ id: existingUserId }, actingAs).send();
- * ```
- */ export async function actingAs(module, principal) {
-    const auth = module.get(BetterAuthService).auth;
-    const ctx = await auth.$context;
-    const internalAdapter = ctx.internalAdapter;
-    const id = typeof principal.id === 'string' ? principal.id : undefined;
-    const email = typeof principal.email === 'string' ? principal.email : undefined;
-    const name = typeof principal.name === 'string' ? principal.name : undefined;
-    // `findUserById`/`createUser` yield a bare user; `findUserByEmail` nests it
-    // under `{ user, accounts }` — normalize to the id we need.
-    let user = null;
-    if (id) user = await internalAdapter.findUserById(id);
-    if (!user && email) {
-        const found = await internalAdapter.findUserByEmail(email);
-        user = found?.user ?? null;
-    }
-    if (!user) {
-        if (!email) {
-            throw new Error('actingAs: principal must carry an `email` (to create a user) or an ' + '`id` matching an existing user.');
-        }
-        const { id: _id, email: _email, name: _name, ...extra } = principal;
-        user = await internalAdapter.createUser({
-            ...extra,
-            email,
-            name: name ?? email,
-            ...id ? {
-                id
-            } : {}
-        });
-    }
-    const session = await internalAdapter.createSession(user.id, false, {
-        ipAddress: '127.0.0.1',
-        userAgent: 'vela-test'
-    });
-    const cookieName = ctx.authCookies.sessionToken.name;
-    const signedToken = `${session.token}.${await makeSignature(session.token, ctx.secret)}`;
-    const headers = new Headers();
-    headers.set('Cookie', `${cookieName}=${signedToken}`);
-    return headers;
-}