@velajs/better-auth 0.6.0 → 1.0.0

package/dist/better-auth.module.js

@@ -1,138 +0,0 @@
-import { defineModule, lazyProvider, provideGlobal, stableHash } from "@velajs/vela";
-import { createBetterAuthCatchallController } from "./better-auth.controller.js";
-import { BetterAuthService, BETTER_AUTH_BUILDER } from "./better-auth.service.js";
-import { BETTER_AUTH_OPTIONS } from "./better-auth.tokens.js";
-import { AuthGuard } from "./guards/auth.guard.js";
-import { RolesGuard } from "./guards/roles.guard.js";
-const DEFAULT_BASE_PATH = '/api/auth';
-function normalize(options) {
-    return {
-        basePath: options.basePath ?? DEFAULT_BASE_PATH,
-        isGlobal: options.isGlobal ?? false,
-        defaultPolicy: options.defaultPolicy ?? 'deny',
-        mountHandler: options.mountHandler ?? true
-    };
-}
-/** Providers, controllers, and exports shared by both entry points. */ function commonContributions(n) {
-    return {
-        providers: [
-            BetterAuthService,
-            AuthGuard,
-            RolesGuard
-        ],
-        controllers: n.mountHandler ? [
-            createBetterAuthCatchallController(n.basePath)
-        ] : [],
-        exports: [
-            BetterAuthService,
-            BETTER_AUTH_OPTIONS,
-            AuthGuard,
-            RolesGuard
-        ]
-    };
-}
-/**
- * The blessed engine generates `forRoot`. `setup` runs once per instance at
- * call time: it re-provides {@link BETTER_AUTH_OPTIONS} with defaults applied,
- * derives the auth builder from those options, mounts the catch-all controller,
- * and — via the `global:` slot — registers the app-wide guard when `isGlobal`.
- *
- * `isGlobal` here means "apply AuthGuard app-wide", NOT "make this a global
- * module", so the default `isGlobal → global: true` extras transform is
- * replaced with identity; the flag reaches `setup` through the options bag.
- */ const authModuleHost = defineModule({
-    name: 'BetterAuth',
-    optionsToken: BETTER_AUTH_OPTIONS,
-    transform: (definition)=>definition,
-    // The auth instance is a stateful value — key off the structural subset only.
-    key: (options)=>stableHash(normalize(options)),
-    setup: ({ OPTIONS, options })=>{
-        const n = normalize(options);
-        const common = commonContributions(n);
-        const auth = options.auth;
-        return {
-            providers: [
-                // Override the auto-provided raw bag with the normalized shape so
-                // BETTER_AUTH_OPTIONS consumers always see defaults + the auth instance.
-                {
-                    provide: OPTIONS,
-                    useValue: {
-                        ...n,
-                        auth
-                    }
-                },
-                // Eager auth: the builder hands back the instance the caller passed in.
-                lazyProvider({
-                    provide: BETTER_AUTH_BUILDER,
-                    inject: [
-                        OPTIONS
-                    ],
-                    useFactory: (o)=>o.auth
-                }),
-                ...common.providers
-            ],
-            controllers: common.controllers,
-            exports: common.exports,
-            global: n.isGlobal ? {
-                guards: [
-                    AuthGuard
-                ]
-            } : undefined
-        };
-    }
-});
-export class BetterAuthModule {
-    /**
-   * Synchronous registration. The auth instance is constructed by the consumer
-   * at module-load time and passed in directly. Use this when the inputs to
-   * `betterAuth({...})` are available at startup (Node apps with a static DB
-   * connection, in-memory adapters, etc.).
-   */ static forRoot(options) {
-        // Delegate to the generated static, then rebrand the module identity so the
-        // public `BetterAuthModule` class is the one registered (consistent with
-        // `forRootAsync` and better diagnostics).
-        return {
-            ...authModuleHost.ConfigurableModuleClass.forRoot(options),
-            module: BetterAuthModule
-        };
-    }
-    /**
-   * Deferred / DI-driven registration. The user factory runs **lazily**, on the
-   * first time anything reads `BetterAuthService.auth` (or `.api` / `.handler`).
-   * In normal request handling that's `AuthGuard.canActivate` or the catch-all
-   * controller's `.handle`. At module load the factory does NOT run — it's only
-   * captured behind {@link lazyProvider}'s memoized thunk. This is what makes
-   * Cloudflare bindings (D1, KV, R2) work: the binding isn't ready at boot, but
-   * it IS by the time a request flows through and the guard / catch-all reads
-   * the service. Inject deps resolve at module load (cheap BindingRef wrappers);
-   * their *values* are read at first auth use, inside your factory body.
-   */ static forRootAsync(options) {
-        const n = normalize(options);
-        const common = commonContributions(n);
-        return {
-            module: BetterAuthModule,
-            key: options.key ?? stableHash({
-                ...n,
-                inject: options.inject
-            }),
-            imports: options.imports ?? [],
-            providers: [
-                {
-                    provide: BETTER_AUTH_OPTIONS,
-                    useValue: n
-                },
-                // The deferred auth builder: `lazyProvider` wraps the user factory in a
-                // memoized thunk, replacing the hand-rolled `(...deps) => () => f(...deps)`.
-                lazyProvider({
-                    provide: BETTER_AUTH_BUILDER,
-                    inject: options.inject,
-                    useFactory: options.useFactory
-                }),
-                ...common.providers,
-                ...n.isGlobal ? provideGlobal('guard', AuthGuard) : []
-            ],
-            controllers: common.controllers,
-            exports: common.exports
-        };
-    }
-}

package/dist/better-auth.service.d.ts

@@ -1,42 +0,0 @@
-import { InjectionToken } from '@velajs/vela';
-import type { BetterAuthInstance } from './better-auth.types';
-/**
- * Internal token holding the auth-construction closure with its inject deps
- * closed over. Resolves cheaply at module load (just captures references);
- * the inner call happens lazily on first auth use (see `BetterAuthService`).
- *
- * Not exported from the public surface — only the service consumes it.
- */
-export declare const BETTER_AUTH_BUILDER: InjectionToken<() => BetterAuthInstance>;
-/**
- * The single injectable consumers reach for to interact with better-auth.
- * Wraps the underlying `betterAuth({...})` instance with lazy construction:
- *
- * - `forRoot({ auth })` — the builder returns the eagerly-provided instance,
- *   so the first `.auth` / `.api` / `.handler` access is effectively a
- *   read-and-cache.
- * - `forRootAsync({ inject, useFactory })` — the builder wraps the user's
- *   factory + inject deps. First access triggers `useFactory(...deps)`. This
- *   is what makes Cloudflare D1/KV bindings work: at module load the factory
- *   doesn't run; on first request (when AuthGuard or the catch-all calls
- *   `service.api` / `service.handler`), the bindings are populated and the
- *   factory can read them safely.
- *
- * Used directly by AuthGuard and the catch-all controller. Consumers in
- * application code inject the same way: `@Inject(BetterAuthService)`.
- */
-export declare class BetterAuthService {
-    private readonly build;
-    private cached;
-    constructor(build: () => BetterAuthInstance);
-    /**
-     * The underlying better-auth instance. Constructed once on first access.
-     * Safe to call from any request-time code path (guards, controllers,
-     * services invoked from handlers).
-     */
-    get auth(): BetterAuthInstance;
-    /** Convenience accessor — equivalent to `service.auth.api`. */
-    get api(): BetterAuthInstance['api'];
-    /** Convenience accessor — equivalent to `service.auth.handler`. */
-    get handler(): BetterAuthInstance['handler'];
-}

package/dist/better-auth.service.js

@@ -1,51 +0,0 @@
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { Inject, Injectable, InjectionToken } from "@velajs/vela";
-/**
- * Internal token holding the auth-construction closure with its inject deps
- * closed over. Resolves cheaply at module load (just captures references);
- * the inner call happens lazily on first auth use (see `BetterAuthService`).
- *
- * Not exported from the public surface — only the service consumes it.
- */ export const BETTER_AUTH_BUILDER = new InjectionToken('vela.better-auth.Builder');
-export class BetterAuthService {
-    build;
-    cached;
-    constructor(build){
-        this.build = build;
-    }
-    /**
-   * The underlying better-auth instance. Constructed once on first access.
-   * Safe to call from any request-time code path (guards, controllers,
-   * services invoked from handlers).
-   */ get auth() {
-        if (!this.cached) this.cached = this.build();
-        return this.cached;
-    }
-    /** Convenience accessor — equivalent to `service.auth.api`. */ get api() {
-        return this.auth.api;
-    }
-    /** Convenience accessor — equivalent to `service.auth.handler`. */ get handler() {
-        return this.auth.handler;
-    }
-}
-BetterAuthService = _ts_decorate([
-    Injectable(),
-    _ts_param(0, Inject(BETTER_AUTH_BUILDER)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        Function
-    ])
-], BetterAuthService);

package/dist/better-auth.tokens.d.ts

@@ -1,5 +0,0 @@
-import { InjectionToken } from '@velajs/vela';
-import type { BetterAuthModuleOptions } from './better-auth.types';
-export declare const BETTER_AUTH_OPTIONS: InjectionToken<BetterAuthModuleOptions>;
-export declare const AUTH_USER_KEY: unique symbol;
-export declare const AUTH_SESSION_KEY: unique symbol;

package/dist/better-auth.tokens.js

@@ -1,4 +0,0 @@
-import { InjectionToken } from "@velajs/vela";
-export const BETTER_AUTH_OPTIONS = new InjectionToken('vela.BetterAuthOptions');
-export const AUTH_USER_KEY = Symbol.for('vela.better-auth.user');
-export const AUTH_SESSION_KEY = Symbol.for('vela.better-auth.session');

package/dist/better-auth.types.d.ts

@@ -1,11 +0,0 @@
-import type { Auth, Session as BASession, User as BAUser } from 'better-auth';
-export type BetterAuthInstance = Auth<any>;
-export interface BetterAuthModuleOptions {
-    auth: BetterAuthInstance;
-    basePath?: string;
-    isGlobal?: boolean;
-    defaultPolicy?: 'deny' | 'allow';
-    mountHandler?: boolean;
-}
-export type User = BAUser;
-export type Session = BASession;

package/dist/better-auth.types.js

@@ -1 +0,0 @@
-export { };

package/dist/decorators/current-session.decorator.d.ts

@@ -1 +0,0 @@
-export declare const CurrentSession: (data?: unknown, ...pipes: import("@velajs/vela").PipeType[]) => ParameterDecorator;

package/dist/decorators/current-session.decorator.js

@@ -1,7 +0,0 @@
-import { createLazyParamDecorator, REQUEST_CONTEXT } from "@velajs/vela";
-import { AUTH_SESSION_KEY } from "../better-auth.tokens.js";
-export const CurrentSession = createLazyParamDecorator((_data, ctx)=>{
-    const honoCtx = ctx.getContext();
-    const reqCtx = honoCtx.get('container').resolve(REQUEST_CONTEXT);
-    return reqCtx.get(AUTH_SESSION_KEY);
-});

package/dist/decorators/current-user.decorator.d.ts

@@ -1 +0,0 @@
-export declare const CurrentUser: (data?: unknown, ...pipes: import("@velajs/vela").PipeType[]) => ParameterDecorator;

package/dist/decorators/current-user.decorator.js

@@ -1,7 +0,0 @@
-import { createLazyParamDecorator, REQUEST_CONTEXT } from "@velajs/vela";
-import { AUTH_USER_KEY } from "../better-auth.tokens.js";
-export const CurrentUser = createLazyParamDecorator((_data, ctx)=>{
-    const honoCtx = ctx.getContext();
-    const reqCtx = honoCtx.get('container').resolve(REQUEST_CONTEXT);
-    return reqCtx.get(AUTH_USER_KEY);
-});

package/dist/decorators/optional-auth.decorator.d.ts

@@ -1,2 +0,0 @@
-export declare const OptionalAuth: import("@velajs/vela").ReflectableDecorator<boolean>;
-export declare const OPTIONAL_AUTH_KEY: string;

package/dist/decorators/optional-auth.decorator.js

@@ -1,5 +0,0 @@
-import { Reflector } from "@velajs/vela";
-export const OptionalAuth = Reflector.createDecorator({
-    key: 'vela.auth.optional'
-});
-export const OPTIONAL_AUTH_KEY = OptionalAuth.KEY;

package/dist/decorators/public.decorator.d.ts

@@ -1,2 +0,0 @@
-export declare const Public: import("@velajs/vela").ReflectableDecorator<boolean>;
-export declare const PUBLIC_KEY: string;

package/dist/decorators/public.decorator.js

@@ -1,5 +0,0 @@
-import { Reflector } from "@velajs/vela";
-export const Public = Reflector.createDecorator({
-    key: 'vela.auth.public'
-});
-export const PUBLIC_KEY = Public.KEY;

package/dist/decorators/roles.decorator.d.ts

@@ -1,2 +0,0 @@
-export declare const Roles: import("@velajs/vela").ReflectableDecorator<string[]>;
-export declare const ROLES_KEY: string;

package/dist/decorators/roles.decorator.js

@@ -1,5 +0,0 @@
-import { Reflector } from "@velajs/vela";
-export const Roles = Reflector.createDecorator({
-    key: 'vela.auth.roles'
-});
-export const ROLES_KEY = Roles.KEY;

package/dist/guards/auth.guard.d.ts

@@ -1,10 +0,0 @@
-import { type CanActivate, type ExecutionContext } from '@velajs/vela';
-import { BetterAuthService } from '../better-auth.service';
-import type { BetterAuthModuleOptions } from '../better-auth.types';
-export declare class AuthGuard implements CanActivate {
-    private readonly auth;
-    private readonly opts;
-    private readonly reflector;
-    constructor(auth: BetterAuthService, opts: BetterAuthModuleOptions);
-    canActivate(context: ExecutionContext): Promise<boolean>;
-}

package/dist/guards/auth.guard.js

@@ -1,68 +0,0 @@
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { Inject, Injectable, REQUEST_CONTEXT, Reflector, UnauthorizedException } from "@velajs/vela";
-import { AUTH_SESSION_KEY, AUTH_USER_KEY, BETTER_AUTH_OPTIONS } from "../better-auth.tokens.js";
-import { BetterAuthService } from "../better-auth.service.js";
-import { OptionalAuth } from "../decorators/optional-auth.decorator.js";
-import { Public } from "../decorators/public.decorator.js";
-export class AuthGuard {
-    auth;
-    opts;
-    reflector = new Reflector();
-    constructor(// Inject BetterAuthService rather than the raw better-auth instance.
-    // The service's lazy `.auth` getter defers construction to first use, so
-    // forRootAsync factories that depend on values only available at
-    // request time (Cloudflare D1/KV bindings, etc.) build safely on the
-    // first canActivate — not at module-load bootstrap.
-    auth, opts){
-        this.auth = auth;
-        this.opts = opts;
-    }
-    async canActivate(context) {
-        if (this.reflector.getAllAndOverride(Public, context)) return true;
-        const request = context.getRequest();
-        const path = new URL(request.url).pathname;
-        const basePath = this.opts.basePath ?? '/api/auth';
-        if (path === basePath || path.startsWith(`${basePath}/`)) return true;
-        const data = await this.auth.api.getSession({
-            headers: request.headers
-        });
-        if (data) {
-            const reqCtx = resolveRequestContext(context);
-            reqCtx.set(AUTH_USER_KEY, data.user);
-            reqCtx.set(AUTH_SESSION_KEY, data.session);
-            return true;
-        }
-        if (this.opts.defaultPolicy === 'allow' || this.reflector.getAllAndOverride(OptionalAuth, context)) {
-            return true;
-        }
-        throw new UnauthorizedException('Authentication required');
-    }
-}
-AuthGuard = _ts_decorate([
-    Injectable(),
-    _ts_param(0, Inject(BetterAuthService)),
-    _ts_param(1, Inject(BETTER_AUTH_OPTIONS)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof BetterAuthService === "undefined" ? Object : BetterAuthService,
-        typeof BetterAuthModuleOptions === "undefined" ? Object : BetterAuthModuleOptions
-    ])
-], AuthGuard);
-function resolveRequestContext(context) {
-    const honoCtx = context.getContext();
-    const container = honoCtx.get('container');
-    return container.resolve(REQUEST_CONTEXT);
-}

package/dist/guards/roles.guard.d.ts

@@ -1,5 +0,0 @@
-import { type CanActivate, type ExecutionContext } from '@velajs/vela';
-export declare class RolesGuard implements CanActivate {
-    private readonly reflector;
-    canActivate(context: ExecutionContext): boolean;
-}

package/dist/guards/roles.guard.js

@@ -1,36 +0,0 @@
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-import { ForbiddenException, Injectable, REQUEST_CONTEXT, Reflector } from "@velajs/vela";
-import { AUTH_USER_KEY } from "../better-auth.tokens.js";
-import { Roles } from "../decorators/roles.decorator.js";
-export class RolesGuard {
-    reflector = new Reflector();
-    canActivate(context) {
-        const required = this.reflector.getAllAndOverride(Roles, context);
-        if (!required || required.length === 0) return true;
-        const honoCtx = context.getContext();
-        const reqCtx = honoCtx.get('container').resolve(REQUEST_CONTEXT);
-        const user = reqCtx.get(AUTH_USER_KEY);
-        if (!user) {
-            throw new ForbiddenException('Role check requires authentication');
-        }
-        const userRoles = normalizeRoles(user.role);
-        const ok = required.some((r)=>userRoles.includes(r));
-        if (!ok) {
-            throw new ForbiddenException(`Insufficient role; one of [${required.join(', ')}] required`);
-        }
-        return true;
-    }
-}
-RolesGuard = _ts_decorate([
-    Injectable()
-], RolesGuard);
-function normalizeRoles(role) {
-    if (!role) return [];
-    if (Array.isArray(role)) return role;
-    return role.split(',').map((r)=>r.trim()).filter(Boolean);
-}

package/dist/testing/acting-as.d.ts

@@ -1,46 +0,0 @@
-/**
- * The slice of `@velajs/testing`'s `TestingModule` this resolver depends on.
- * Declared structurally so `@velajs/better-auth/testing` carries NO runtime
- * (or type) dependency on `@velajs/testing` — a real `TestingModule` satisfies
- * it, and the resolver stays assignable to `@velajs/testing`'s `ActingAsResolver`.
- */
-export interface TestModuleLike {
-    get<T>(token: unknown): T;
-}
-/**
- * A test principal. Opaque `Record<string, unknown>` to stay compatible with
- * `@velajs/testing`'s `TestPrincipal`. Recognized fields:
- *
- * - `id`    — reuse the user with this id if it already exists.
- * - `email` — reuse the user with this email, else create one.
- * - `name`  — display name for a created user (defaults to the email).
- *
- * Any other fields are forwarded to `internalAdapter.createUser` (e.g. `role`)
- * when a new user is minted, so role-guarded routes can be exercised.
- */
-export type ActingAsPrincipal = Record<string, unknown>;
-/**
- * actingAs — a `@velajs/testing` auth resolver for better-auth.
- *
- * Resolves {@link BetterAuthService} from the module, mints a REAL better-auth
- * session for `principal` through `auth.$context.internalAdapter`, and returns
- * a `Headers` carrying a properly signed session cookie. Guarded routes
- * (`AuthGuard`) then accept requests carrying those headers because
- * `auth.api.getSession` validates the cookie against the same session store.
- *
- * The signature `(module, principal) => Promise<Headers>` is exactly
- * `@velajs/testing`'s `ActingAsResolver`, so it plugs straight in:
- *
- * @example
- * ```ts
- * import { actingAs } from '@velajs/better-auth/testing';
- *
- * // As the default resolver for the module:
- * module.setAuthResolver(actingAs);
- * await module.http.get('/me').actingAs({ email: 'ada@example.com' }).send();
- *
- * // Or passed per-request:
- * await module.http.get('/me').actingAs({ id: existingUserId }, actingAs).send();
- * ```
- */
-export declare function actingAs(module: TestModuleLike, principal: ActingAsPrincipal): Promise<Headers>;

package/dist/testing/acting-as.js

@@ -1,70 +0,0 @@
-// Mechanics adapted from @stratal/testing (MIT, © Temitayo Fadojutimi):
-// mint a real better-auth session via `$context.internalAdapter` and hand back
-// a signed session-cookie header. Adapted to better-auth >=1.6: the session
-// cookie is signed with the package's own `makeSignature` (better-auth/crypto)
-// — the same primitive better-auth's built-in test cookie builder uses — so no
-// endpoint-context shim or `setSessionCookie` mock is needed.
-import { makeSignature } from "better-auth/crypto";
-import { BetterAuthService } from "../better-auth.service.js";
-/**
- * actingAs — a `@velajs/testing` auth resolver for better-auth.
- *
- * Resolves {@link BetterAuthService} from the module, mints a REAL better-auth
- * session for `principal` through `auth.$context.internalAdapter`, and returns
- * a `Headers` carrying a properly signed session cookie. Guarded routes
- * (`AuthGuard`) then accept requests carrying those headers because
- * `auth.api.getSession` validates the cookie against the same session store.
- *
- * The signature `(module, principal) => Promise<Headers>` is exactly
- * `@velajs/testing`'s `ActingAsResolver`, so it plugs straight in:
- *
- * @example
- * ```ts
- * import { actingAs } from '@velajs/better-auth/testing';
- *
- * // As the default resolver for the module:
- * module.setAuthResolver(actingAs);
- * await module.http.get('/me').actingAs({ email: 'ada@example.com' }).send();
- *
- * // Or passed per-request:
- * await module.http.get('/me').actingAs({ id: existingUserId }, actingAs).send();
- * ```
- */ export async function actingAs(module, principal) {
-    const auth = module.get(BetterAuthService).auth;
-    const ctx = await auth.$context;
-    const internalAdapter = ctx.internalAdapter;
-    const id = typeof principal.id === 'string' ? principal.id : undefined;
-    const email = typeof principal.email === 'string' ? principal.email : undefined;
-    const name = typeof principal.name === 'string' ? principal.name : undefined;
-    // `findUserById`/`createUser` yield a bare user; `findUserByEmail` nests it
-    // under `{ user, accounts }` — normalize to the id we need.
-    let user = null;
-    if (id) user = await internalAdapter.findUserById(id);
-    if (!user && email) {
-        const found = await internalAdapter.findUserByEmail(email);
-        user = found?.user ?? null;
-    }
-    if (!user) {
-        if (!email) {
-            throw new Error('actingAs: principal must carry an `email` (to create a user) or an ' + '`id` matching an existing user.');
-        }
-        const { id: _id, email: _email, name: _name, ...extra } = principal;
-        user = await internalAdapter.createUser({
-            ...extra,
-            email,
-            name: name ?? email,
-            ...id ? {
-                id
-            } : {}
-        });
-    }
-    const session = await internalAdapter.createSession(user.id, false, {
-        ipAddress: '127.0.0.1',
-        userAgent: 'vela-test'
-    });
-    const cookieName = ctx.authCookies.sessionToken.name;
-    const signedToken = `${session.token}.${await makeSignature(session.token, ctx.secret)}`;
-    const headers = new Headers();
-    headers.set('Cookie', `${cookieName}=${signedToken}`);
-    return headers;
-}