@vonall/auth 0.0.0-stage → 0.1.0

package/dist/templates/VerifyEmailEmail.svelte

@@ -0,0 +1,16 @@
+<script lang="ts">
+	import { EmailLayout } from "@vonall/mail";
+	import { m } from "../messages.js";
+
+	let { recipientName, link, appName, appLink }: {
+		recipientName: string;
+		link: string;
+		appName: string;
+		appLink: string;
+	} = $props();
+</script>
+
+<EmailLayout title={m().hello(recipientName)} {link} buttonLabel={m().verifyButton} {appName} {appLink}>
+	<p>{m().verifyBody(appName)}</p>
+	<p>{m().verifyNotYou}</p>
+</EmailLayout>

package/dist/templates/VerifyEmailEmail.svelte.d.ts

@@ -0,0 +1,9 @@
+type $$ComponentProps = {
+    recipientName: string;
+    link: string;
+    appName: string;
+    appLink: string;
+};
+declare const VerifyEmailEmail: import("svelte").Component<$$ComponentProps, {}, "">;
+type VerifyEmailEmail = ReturnType<typeof VerifyEmailEmail>;
+export default VerifyEmailEmail;

package/dist/testing/index.d.ts

@@ -0,0 +1,6 @@
+import { type CreateAuthOptions, type CreatedAuth } from "../server/create.js";
+import type { Db } from "../server/registry.js";
+/** Creates a user directly (the first one becomes admin, as in the app) and returns its id. */
+export declare function createUser(email?: string): Promise<string>;
+/** `createAuth()` with test values: every option on, mail off, unless overridden. */
+export declare function testAuth(db: Db, overrides?: Partial<CreateAuthOptions>): CreatedAuth;

package/dist/testing/index.js

@@ -0,0 +1,26 @@
+/** Helpers for a Product's db tests (`tests/db/fixtures.ts`) and this package's own. */
+import { createMailer } from "@vonall/mail";
+import { authSchema } from "../schema/index.js";
+import { createAuth } from "../server/create.js";
+import { UserRepo } from "../server/repositories/UserRepo.js";
+/** Creates a user directly (the first one becomes admin, as in the app) and returns its id. */
+export async function createUser(email = "user@example.com") {
+    const id = crypto.randomUUID();
+    await UserRepo.insertUser({ id, email, name: "", emailVerified: true, createdAt: new Date(), updatedAt: new Date() });
+    return id;
+}
+/** `createAuth()` with test values: every option on, mail off, unless overridden. */
+export function testAuth(db, overrides = {}) {
+    return createAuth({
+        db,
+        schema: authSchema({ admin: true, mcp: true }),
+        secret: "test-secret-for-the-db-tests-only",
+        origin: "http://localhost:5173",
+        appName: "Test",
+        locale: "en-GB",
+        signupMode: "invite",
+        mailer: createMailer({ smtp: null }),
+        admin: true,
+        ...overrides,
+    });
+}

package/dist/types.d.ts

@@ -0,0 +1,38 @@
+import type { InferInsertModel, InferSelectModel } from "drizzle-orm";
+import { z } from "zod";
+import type { FullSchema } from "./schema/index.js";
+/**
+ * How people get an account (the Factory's GLOSSARY, "Signup mode"); a Product sets it in its `config.ts`.
+ * - `invite`: anyone with an account can create an Einladung, and signup needs one
+ * - `open`: anyone can sign up and confirms their email address first (needs mail)
+ * - `admin`: only admins create Einladungen
+ * The first account needs neither an Einladung nor a confirmation in any mode.
+ */
+export declare const SIGNUP_MODES: readonly ["invite", "open", "admin"];
+export type SignupMode = (typeof SIGNUP_MODES)[number];
+/** Whether someone may create an account now, and if not, why. */
+export declare const SIGNUP_STATES: readonly ["allowed", "needs_einladung", "no_mail"];
+export type SignupState = (typeof SIGNUP_STATES)[number];
+export declare const MIN_PASSWORD_LENGTH = 8;
+/** The user row with every option on; an option that is off leaves its columns unused. */
+export type UserSelect = InferSelectModel<FullSchema["user"]>;
+export type UserInsert = InferInsertModel<FullSchema["user"]>;
+/** The user as the client sees it (no secrets live on the user row, so it is the full row). */
+export type AppUserClient = UserSelect;
+/** The logged-in user of the current request, as better-auth puts it into `locals`. */
+export type SessionUser = NonNullable<App.Locals["user"]>;
+/** What an Einladung link offers, shown before signing up. */
+export type EinladungInfo = {
+    id: string;
+    inviterName: string;
+    expiresAt: Date;
+};
+export type OffeneEinladung = {
+    id: string;
+    email: string | null;
+    expiresAt: Date;
+    createdAt: Date;
+};
+export declare const emailSchema: z.ZodEmail;
+export declare const passwordSchema: z.ZodString;
+export declare const nameSchema: z.ZodString;

package/dist/types.js

@@ -0,0 +1,21 @@
+import { z } from "zod";
+import { m } from "./messages.js";
+/**
+ * How people get an account (the Factory's GLOSSARY, "Signup mode"); a Product sets it in its `config.ts`.
+ * - `invite`: anyone with an account can create an Einladung, and signup needs one
+ * - `open`: anyone can sign up and confirms their email address first (needs mail)
+ * - `admin`: only admins create Einladungen
+ * The first account needs neither an Einladung nor a confirmation in any mode.
+ */
+export const SIGNUP_MODES = ["invite", "open", "admin"];
+/** Whether someone may create an account now, and if not, why. */
+export const SIGNUP_STATES = ["allowed", "needs_einladung", "no_mail"];
+export const MIN_PASSWORD_LENGTH = 8;
+// The messages are read when a value is checked, not when the module loads, so the Product's configure… call comes first
+export const emailSchema = z.email({ error: () => m().invalidEmail });
+export const passwordSchema = z.string().min(MIN_PASSWORD_LENGTH, { error: () => m().passwordTooShort(MIN_PASSWORD_LENGTH) });
+export const nameSchema = z
+    .string()
+    .trim()
+    .min(1, { error: () => m().nameRequired })
+    .max(80, { error: () => m().nameTooLong(80) });

package/dist/util/fresh.d.ts

@@ -0,0 +1,11 @@
+/**
+ * better-auth refuses some endpoints (listing the sessions, unlinking an account) for a session created longer than
+ * `freshAge` ago; the app then sends the user to log in again, which needs that stale session signed out first.
+ */
+export declare const SESSION_NOT_FRESH = "SESSION_NOT_FRESH";
+/** Whether an error from better-auth (server or client) is its "Session is not fresh". */
+export declare function isSessionNotFresh(e: unknown): boolean;
+/** The login page that signs out a stale session and then returns to `redirectTo`. */
+export declare function reauthPath(redirectTo: string): string;
+/** better-auth's own check: a `freshAge` of 0 turns it off. */
+export declare function isStale(createdAt: Date, freshAgeSeconds: number, now?: Date): boolean;

package/dist/util/fresh.js

@@ -0,0 +1,20 @@
+/**
+ * better-auth refuses some endpoints (listing the sessions, unlinking an account) for a session created longer than
+ * `freshAge` ago; the app then sends the user to log in again, which needs that stale session signed out first.
+ */
+export const SESSION_NOT_FRESH = "SESSION_NOT_FRESH";
+/** Whether an error from better-auth (server or client) is its "Session is not fresh". */
+export function isSessionNotFresh(e) {
+    if (!e || typeof e !== "object")
+        return false;
+    const body = "body" in e ? e.body : e;
+    return !!body && typeof body === "object" && "code" in body && body.code === SESSION_NOT_FRESH;
+}
+/** The login page that signs out a stale session and then returns to `redirectTo`. */
+export function reauthPath(redirectTo) {
+    return `/auth/login?error=${SESSION_NOT_FRESH.toLowerCase()}&redirectTo=${encodeURIComponent(redirectTo)}`;
+}
+/** better-auth's own check: a `freshAge` of 0 turns it off. */
+export function isStale(createdAt, freshAgeSeconds, now = new Date()) {
+    return freshAgeSeconds !== 0 && now.getTime() - createdAt.getTime() >= freshAgeSeconds * 1000;
+}

package/dist/util/messageOf.d.ts

@@ -0,0 +1,5 @@
+/**
+ * The message of a caught error, for showing it to the user. Remote functions reject with plain objects that carry a
+ * `message`, so anything with a non-empty string `message` counts.
+ */
+export declare function messageOf(error: unknown, fallback: string): string;

package/dist/util/messageOf.js

@@ -0,0 +1,12 @@
+/**
+ * The message of a caught error, for showing it to the user. Remote functions reject with plain objects that carry a
+ * `message`, so anything with a non-empty string `message` counts.
+ */
+export function messageOf(error, fallback) {
+    if (typeof error === "object" && error !== null && "message" in error) {
+        const { message } = error;
+        if (typeof message === "string" && message)
+            return message;
+    }
+    return fallback;
+}

package/dist/util/names.d.ts

@@ -0,0 +1,10 @@
+export declare function displayName(user: {
+    name?: string | null;
+    email: string;
+} | null | undefined): string;
+export declare function displayInitials(user: {
+    name?: string | null;
+    email: string;
+}): string;
+/** A readable name from an email address ("lena.meier@…" → "Lena Meier"), for accounts created without one. */
+export declare function nameFromEmail(email: string): string;

package/dist/util/names.js

@@ -0,0 +1,19 @@
+export function displayName(user) {
+    if (!user)
+        return "";
+    return user.name?.trim() || user.email;
+}
+export function displayInitials(user) {
+    const words = (user.name ?? "").trim().split(/\s+/).filter(Boolean);
+    if (words.length > 0)
+        return words.slice(0, 2).map((w) => w.charAt(0).toUpperCase()).join("");
+    return user.email.charAt(0).toUpperCase() || "?";
+}
+/** A readable name from an email address ("lena.meier@…" → "Lena Meier"), for accounts created without one. */
+export function nameFromEmail(email) {
+    const local = email.split("@")[0] ?? "";
+    const words = local.split(/[._\-+]+/).filter(Boolean);
+    if (words.length === 0)
+        return email;
+    return words.map((w) => w.charAt(0).toUpperCase() + w.slice(1).toLowerCase()).join(" ");
+}

package/dist/util/sameSite.d.ts

@@ -0,0 +1,5 @@
+/**
+ * The path of `ziel` if it stays on `origin`, else null. Browsers read "/\\evil.com" or "/\t/evil.com" as another host,
+ * so the target is resolved against the origin instead of checking its first characters.
+ */
+export declare function sameSitePath(ziel: string | null, origin: string): string | null;

package/dist/util/sameSite.js

@@ -0,0 +1,15 @@
+/**
+ * The path of `ziel` if it stays on `origin`, else null. Browsers read "/\\evil.com" or "/\t/evil.com" as another host,
+ * so the target is resolved against the origin instead of checking its first characters.
+ */
+export function sameSitePath(ziel, origin) {
+    if (!ziel || !ziel.startsWith("/"))
+        return null;
+    try {
+        const url = new URL(ziel, origin);
+        return url.origin === origin ? `${url.pathname}${url.search}${url.hash}` : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/util/signup.d.ts

@@ -0,0 +1,15 @@
+import type { SignupMode, SignupState } from "../types.js";
+/** Whether a user is an admin. Works without the admin option too: the user then has no role and nobody is. */
+export declare function isAdmin(user: object | null | undefined): boolean;
+/** Whether a user may create Einladungen in this signup mode. */
+export declare function mayInvite(mode: SignupMode, admin: boolean): boolean;
+/**
+ * Whether someone may create an account now. The first account (the admin) always may; after that `open` needs mail
+ * (the confirmation link), `invite` and `admin` a usable Einladung.
+ */
+export declare function signupState(input: {
+    mode: SignupMode;
+    accounts: number;
+    einladungUsable: boolean;
+    mail: boolean;
+}): SignupState;

package/dist/util/signup.js

@@ -0,0 +1,23 @@
+/** Whether a user is an admin. Works without the admin option too: the user then has no role and nobody is. */
+export function isAdmin(user) {
+    return Boolean(user && "role" in user && user.role === "admin");
+}
+/** Whether a user may create Einladungen in this signup mode. */
+export function mayInvite(mode, admin) {
+    if (mode === "invite")
+        return true;
+    if (mode === "admin")
+        return admin;
+    return false; // open: nobody needs one
+}
+/**
+ * Whether someone may create an account now. The first account (the admin) always may; after that `open` needs mail
+ * (the confirmation link), `invite` and `admin` a usable Einladung.
+ */
+export function signupState(input) {
+    if (input.accounts === 0)
+        return "allowed";
+    if (input.mode === "open")
+        return input.mail ? "allowed" : "no_mail";
+    return input.einladungUsable ? "allowed" : "needs_einladung";
+}

package/package.json

@@ -1,6 +1,99 @@
 {
   "name": "@vonall/auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Accounts for a Web App Factory Product: better-auth with the hooks, the protected helpers, Einladungen, Konto, the auth pages and the settings; Admin as an option",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SebastianvonAllmen/vonall-libs.git",
+    "directory": "packages/auth"
+  },
+  "type": "module",
+  "files": [
+    "dist",
+    "!dist/**/*.test.*",
+    "CHANGELOG.md"
+  ],
+  "sideEffects": [
+    "**/*.css"
+  ],
+  "svelte": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "svelte": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./messages": {
+      "types": "./dist/messages.d.ts",
+      "default": "./dist/messages.js"
+    },
+    "./schema": {
+      "types": "./dist/schema/index.d.ts",
+      "default": "./dist/schema/index.js"
+    },
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "default": "./dist/server/index.js"
+    },
+    "./client": {
+      "types": "./dist/client/index.d.ts",
+      "default": "./dist/client/index.js"
+    },
+    "./remote": {
+      "types": "./dist/remote/index.d.ts",
+      "default": "./dist/remote/index.js"
+    },
+    "./testing": {
+      "types": "./dist/testing/index.d.ts",
+      "default": "./dist/testing/index.js"
+    }
+  },
+  "peerDependencies": {
+    "@sveltejs/kit": "^3.1.0",
+    "svelte": "^5.57.2",
+    "drizzle-orm": "^0.45.4",
+    "pg": "^8.23.1",
+    "zod": "^4.6.7",
+    "neverthrow": "^8.2.0"
+  },
+  "devDependencies": {
+    "@sveltejs/kit": "^3.1.0",
+    "@sveltejs/package": "^3.0.1",
+    "@sveltejs/vite-plugin-svelte": "7.3.1",
+    "@types/pg": "^8.23.1",
+    "drizzle-kit": "^0.31.11",
+    "drizzle-orm": "^0.45.4",
+    "neverthrow": "^8.2.0",
+    "pg": "^8.23.1",
+    "publint": "^0.3.25",
+    "svelte": "^5.57.2",
+    "svelte-check": "^4.7.7",
+    "typescript": "^6.0.3",
+    "vite": "8.3.4",
+    "vitest": "^5.0.5",
+    "zod": "^4.6.7"
+  },
+  "imports": {
+    "#lib": "./src/lib/index.js",
+    "#lib/*": "./src/lib/*"
+  },
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@node-rs/argon2": "^2.2.2",
+    "better-auth": "^1.7.12",
+    "@vonall/mail": "^0.1.1"
+  },
+  "scripts": {
+    "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
+    "test:unit": "vitest run --project unit --passWithNoTests",
+    "test:db": "vitest run --project db --passWithNoTests",
+    "build": "svelte-kit sync && svelte-package && publint"
+  }
 }