@vonall/auth 0.1.1 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @vonall/auth
 
+## 0.2.0
+
+### Minor Changes
+
+- The Product builds the better-auth instance and client itself, so their types are inferred where they are used: `betterAuth({ ...authOptions({…}), plugins: [twoFactor(), admin({ ac, roles }), …, sveltekitCookies(getRequestEvent)] })`, then `registerAuth(auth)` for the session handle and the API handler; `createAuth()`, `createAuthClient()` and the `./client` entry are gone.
+
+## 0.1.2
+
+### Patch Changes
+
+- The plugins passed to `createAuth()` and `createAuthClient()` are inferred as tuples, so `authClient.twoFactor`, `authClient.admin` and the MCP plugins' members type-check in a Product.
+
 ## 0.1.1
 
 ### Patch Changes

package/README.md

@@ -11,23 +11,30 @@ import { authSchema } from "@vonall/auth/schema";
 export const schema = authSchema({ admin: true, mcp: true });
 export const { user, session, account, verification, twoFactor, rateLimit, einladung } = schema;
 
-// src/lib/auth.ts: the wiring, once
-import { createAuth } from "@vonall/auth/server";
-export const { auth, handle: sessionHandle, apiHandler } = createAuth({
-	db, schema, secret: BETTER_AUTH_SECRET, origin: ORIGIN, appName: APP_NAME, locale: LOCALE, signupMode: SIGNUP_MODE,
-	mailer, admin: true, social: { github: { clientId, clientSecret } }, log: logger,
+// src/lib/auth.ts: the wiring, once; the instance is built here so its types (every plugin's) are inferred here
+import { ac, roles } from "@vonall/auth";
+import { authOptions, registerAuth } from "@vonall/auth/server";
+import { betterAuth } from "better-auth";
+import { admin } from "better-auth/plugins";
+import { twoFactor } from "better-auth/plugins/two-factor";
+import { sveltekitCookies } from "better-auth/svelte-kit";
+export const auth = betterAuth({
+	...authOptions({ db, schema, secret: BETTER_AUTH_SECRET, origin: ORIGIN, appName: APP_NAME, locale: LOCALE, signupMode: SIGNUP_MODE, mailer, admin: true, social: { github: { clientId, clientSecret } }, log: logger }),
+	plugins: [twoFactor(), admin({ ac, roles }), /* the MCP endpoint's, from @vonall/mcp */ sveltekitCookies(getRequestEvent)],
 });
+export const { handle: sessionHandle, apiHandler, providers } = registerAuth(auth);
 
+// src/lib/auth-client.ts       createAuthClient({ baseURL: PUBLIC_ORIGIN, plugins: [twoFactorClient(), adminClient({ ac, roles })] })  (from "better-auth/svelte")
 // src/hooks.server.ts            sequence(securityHeaders, sessionHandle)
 // src/routes/api/auth/[...auth]  export const GET = apiHandler, POST = apiHandler
 // src/routes/auth/login          export { loginLoad as load } from "@vonall/auth/server"
-// src/app.d.ts                   user: AuthUser | null; session: AuthSession | null  (from "@vonall/auth/server")
-// src/lib/auth-client.ts         createAuthClient({ baseURL: PUBLIC_ORIGIN, admin: true })  (from "@vonall/auth/client")
+// src/app.d.ts                   user: typeof auth.$Infer.Session.user | null; session: typeof auth.$Infer.Session.session | null
 ```
 
-Entry points: `@vonall/auth` (types, validation schemas, `isAdmin`, `mayInvite`, the fresh-session helpers, the
-messages), `@vonall/auth/schema`, `@vonall/auth/server`, `@vonall/auth/client`, `@vonall/auth/remote` (the remote
-functions a Product's components call), `@vonall/auth/testing` (`createUser`, `testAuth` for db tests).
+Entry points: `@vonall/auth` (types, validation schemas, `ac`/`roles` for the admin plugins, `isAdmin`, `mayInvite`, the
+fresh-session helpers, the messages), `@vonall/auth/schema`, `@vonall/auth/server`, `@vonall/auth/remote` (the remote
+functions a Product's components call), `@vonall/auth/testing` (`createUser`, `testAuth` for db tests). `better-auth` is
+this package's dependency; the Product imports its plugins from the same version.
 
 Strings come in English and German: `configureAuthMessages({ locale, overrides })`. A Product's own user-owned tables
 reference `user.id` with `onDelete: "cascade"`, so deleting a Konto takes everything with it. The MCP endpoint's

package/dist/permissions.d.ts

@@ -1,8 +1,8 @@
 export declare const ac: {
-    newRole<const TRoleStatements extends import("better-auth/client").Statements>(statements: import("better-auth/client").RoleInput<{
+    newRole<const TRoleStatements extends import("better-auth/plugins").Statements>(statements: import("better-auth/plugins").RoleInput<{
         readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
         readonly session: readonly ["list", "revoke", "delete"];
-    }, TRoleStatements>): import("better-auth/client").Role<import("better-auth/client").ExactRoleStatements<TRoleStatements>, {
+    }, TRoleStatements>): import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<TRoleStatements>, {
         readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
         readonly session: readonly ["list", "revoke", "delete"];
     }>;
@@ -15,14 +15,14 @@ export declare const ac: {
  * The app admin manages accounts but can't act as or take over a friend's account: no impersonation, no setting a
  * password or an email, no creating accounts (signup only through an Einladung).
  */
-export declare const adminRole: import("better-auth/client").Role<import("better-auth/client").ExactRoleStatements<{
+export declare const adminRole: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
     readonly user: ["list", "get", "set-role", "ban", "delete"];
     readonly session: ["list", "revoke"];
 }>, {
     readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
     readonly session: readonly ["list", "revoke", "delete"];
 }>;
-export declare const userRole: import("better-auth/client").Role<import("better-auth/client").ExactRoleStatements<{
+export declare const userRole: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
     readonly user: [];
     readonly session: [];
 }>, {
@@ -31,14 +31,14 @@ export declare const userRole: import("better-auth/client").Role<import("better-
 }>;
 /** The roles as better-auth's admin plugin and client take them. */
 export declare const roles: {
-    admin: import("better-auth/client").Role<import("better-auth/client").ExactRoleStatements<{
+    admin: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
         readonly user: ["list", "get", "set-role", "ban", "delete"];
         readonly session: ["list", "revoke"];
     }>, {
         readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
         readonly session: readonly ["list", "revoke", "delete"];
     }>;
-    user: import("better-auth/client").Role<import("better-auth/client").ExactRoleStatements<{
+    user: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
         readonly user: [];
         readonly session: [];
     }>, {

package/dist/remote/app_user.remote.js

@@ -3,7 +3,7 @@ import { getRequestEvent } from "$app/server";
 import { z } from "zod";
 import { m } from "../messages.js";
 import { adminQuery, adminSchemaCommand, protectedCommand, protectedForm, protectedQuery, protectedSchemaCommand } from "../server/helpers.js";
-import { registry } from "../server/registry.js";
+import { authInstance } from "../server/registry.js";
 import { UserRepo } from "../server/repositories/UserRepo.js";
 import { KontoService } from "../server/service/konto.service.js";
 import { emailSchema, nameSchema, passwordSchema } from "../types.js";
@@ -13,7 +13,7 @@ export const getAllUsers = adminQuery(async () => {
     return await UserRepo.getAllUsers();
 });
 export const updateUserProfile = protectedForm(z.object({ name: nameSchema, email: emailSchema }), async (data, _issue, user) => {
-    const { auth } = registry();
+    const auth = authInstance();
     const event = getRequestEvent();
     if (data.email !== user.email) {
         await auth.api.changeEmail({ body: { newEmail: data.email }, headers: event.request.headers });
@@ -25,7 +25,7 @@ const passwordPair = { newPassword: passwordSchema, confirmPassword: z.string()
 const passwordsMatch = { error: () => m().passwordsMismatch, path: ["confirmPassword"] };
 export const changePassword = protectedForm(z.object({ currentPassword: passwordSchema, ...passwordPair }).refine((d) => d.newPassword === d.confirmPassword, passwordsMatch), async (data) => {
     const event = getRequestEvent();
-    await registry().auth.api.changePassword({
+    await authInstance().api.changePassword({
         body: { currentPassword: data.currentPassword, newPassword: data.newPassword, revokeOtherSessions: true },
         headers: event.request.headers,
     });
@@ -33,13 +33,13 @@ export const changePassword = protectedForm(z.object({ currentPassword: password
 });
 export const setPassword = protectedForm(z.object(passwordPair).refine((d) => d.newPassword === d.confirmPassword, passwordsMatch), async (data) => {
     const event = getRequestEvent();
-    await registry().auth.api.setPassword({ body: { newPassword: data.newPassword }, headers: event.request.headers });
+    await authInstance().api.setPassword({ body: { newPassword: data.newPassword }, headers: event.request.headers });
     return { success: true };
 });
 export const getSessions = protectedQuery(async () => {
     const event = getRequestEvent();
     try {
-        return await registry().auth.api.listSessions({ headers: event.request.headers });
+        return await authInstance().api.listSessions({ headers: event.request.headers });
     }
     catch (e) {
         // Only a login from the last day may list the sessions; the sessions are in the settings
@@ -51,7 +51,7 @@ export const getSessions = protectedQuery(async () => {
 export const revokeSessionById = protectedSchemaCommand(z.object({ sessionId: z.string() }), async (data) => {
     const event = getRequestEvent();
     const currentSessionToken = event.locals.session?.token;
-    await registry().auth.api.revokeSession({ body: { token: data.sessionId }, headers: event.request.headers });
+    await authInstance().api.revokeSession({ body: { token: data.sessionId }, headers: event.request.headers });
     const isCurrentSession = data.sessionId === currentSessionToken;
     if (!isCurrentSession)
         await getSessions().refresh();
@@ -59,7 +59,7 @@ export const revokeSessionById = protectedSchemaCommand(z.object({ sessionId: z.
 });
 export const revokeOthers = protectedCommand(async () => {
     const event = getRequestEvent();
-    await registry().auth.api.revokeOtherSessions({ headers: event.request.headers });
+    await authInstance().api.revokeOtherSessions({ headers: event.request.headers });
     await getSessions().refresh();
     return { success: true };
 });

package/dist/server/create.d.ts

@@ -1,10 +1,11 @@
 /**
- * `createAuth()`: better-auth for a Product, from explicit options. The Product's `src/lib/auth.ts` calls it once with
- * its database, its tables (`authSchema`), its env and config; everything else in this package reads the result.
+ * better-auth for a Product, from explicit options. The Product's `src/lib/auth.ts` builds the instance itself, so its
+ * types are inferred in the Product (its plugins included): `betterAuth({ ...authOptions({…}), plugins: […] })`, then
+ * `registerAuth(auth)` for the session handle and the API handler; everything else in this package reads the result.
  */
 import type { RequestHandler } from "@sveltejs/kit";
 import type { Handle } from "@sveltejs/kit/hooks";
-import { betterAuth, type BetterAuthPlugin } from "better-auth";
+import { betterAuth, type BetterAuthOptions, type BetterAuthPlugin } from "better-auth";
 import { admin as adminPlugin } from "better-auth/plugins";
 import { twoFactor } from "better-auth/plugins/two-factor";
 import { sveltekitCookies } from "better-auth/svelte-kit";
@@ -17,7 +18,7 @@ export type SocialProvider = {
     clientId: string;
     clientSecret: string;
 };
-export type CreateAuthOptions<P extends BetterAuthPlugin[] = []> = {
+export type CreateAuthOptions = {
     /** The Product's Drizzle database. */
     db: Db;
     /** The Product's tables from `authSchema()`, the same objects its `schema/` re-exports. */
@@ -39,8 +40,6 @@ export type CreateAuthOptions<P extends BetterAuthPlugin[] = []> = {
         github?: SocialProvider | null;
         google?: SocialProvider | null;
     };
-    /** More better-auth plugins, e.g. the MCP endpoint's (`@vonall/mcp`); they are part of the instance's type. */
-    plugins?: P;
     /** More rate limit rules, by path (`@vonall/mcp` adds `/oauth2/register`). */
     rateLimitRules?: Record<string, {
         window: number;
@@ -56,10 +55,19 @@ export type CreateAuthOptions<P extends BetterAuthPlugin[] = []> = {
 type BasePlugins = [ReturnType<typeof twoFactor>, ReturnType<typeof adminPlugin<{
     ac: typeof ac;
     roles: typeof roles;
-}>>];
+}>>, ReturnType<typeof sveltekitCookies>];
 export type Auth<P extends BetterAuthPlugin[] = []> = ReturnType<typeof betterAuth<{
-    plugins: [...BasePlugins, ...P, ReturnType<typeof sveltekitCookies>];
+    plugins: [...BasePlugins, ...P];
 }>>;
+/**
+ * The Product's instance as `registerAuth()` takes it: built on `authOptions()`, with any plugins (their types stay the
+ * Product's; this package uses the instance through its own `Auth` type).
+ */
+export type AuthLike = {
+    handler: (request: Request) => Promise<Response>;
+    api: object;
+    $context: Promise<object>;
+};
 /** The admin plugin's columns, named here because the plugin's type doesn't carry them into the session's user. */
 export type AdminFields = {
     role?: string | null;
@@ -70,9 +78,8 @@ export type AdminFields = {
 /** The user and the session as the hooks put them into `locals` (a Product's `app.d.ts` uses these). */
 export type AuthUser = Auth["$Infer"]["Session"]["user"] & AdminFields;
 export type AuthSession = Auth["$Infer"]["Session"]["session"];
-export type CreatedAuth<P extends BetterAuthPlugin[] = []> = {
-    /** The better-auth instance: `auth.api`, `auth.handler`, `auth.$context`. */
-    auth: Auth<P>;
+export declare function authOptions(options: CreateAuthOptions): BetterAuthOptions;
+export type RegisteredAuth = {
     /** The hooks handle: the session into `locals.user`/`locals.session`, and better-auth's own routes (/api/auth/*). */
     handle: Handle;
     /** For `src/routes/api/auth/[...auth]/+server.ts`: `export const GET = apiHandler, POST = apiHandler`. */
@@ -83,5 +90,6 @@ export type CreatedAuth<P extends BetterAuthPlugin[] = []> = {
         google: boolean;
     };
 };
-export declare function createAuth<P extends BetterAuthPlugin[] = []>(options: CreateAuthOptions<P>): CreatedAuth<P>;
+/** Hands the Product's instance to this package (after `authOptions()`) and returns the handles. */
+export declare function registerAuth(auth: AuthLike): RegisteredAuth;
 export {};

package/dist/server/create.js

@@ -8,7 +8,7 @@ import { sveltekitCookies, svelteKitHandler } from "better-auth/svelte-kit";
 import { m } from "../messages.js";
 import { roles, ac } from "../permissions.js";
 import { hashPassword, verifyPassword } from "./crypto.js";
-import { consoleLog, setRegistry } from "./registry.js";
+import { consoleLog, registry, setRegistry } from "./registry.js";
 import { UserRepo } from "./repositories/UserRepo.js";
 import { EINLADUNG_COOKIE, EinladungService } from "./service/einladung.service.js";
 import { sendPasswordResetEmail, sendVerifyEmail } from "./service/mail.js";
@@ -24,10 +24,23 @@ function einladungAusCookie() {
     }
 }
 const hasKeys = (p) => Boolean(p?.clientId && p.clientSecret && p.clientId !== "dummy");
-function build(options) {
-    const { secret, origin, appName, signupMode, admin = false, social = {}, plugins, rateLimitRules = {}, log = consoleLog } = options;
+export function authOptions(options) {
+    const { secret, origin, appName, signupMode, admin = false, social = {}, rateLimitRules = {}, log = consoleLog } = options;
+    setRegistry({
+        db: options.db,
+        schema: options.schema,
+        appName,
+        origin,
+        locale: options.locale,
+        signupMode,
+        mailer: options.mailer,
+        admin,
+        log,
+        auth: null,
+        providers: { github: hasKeys(social.github), google: hasKeys(social.google) },
+    });
     const baseURL = origin || "http://localhost";
-    return betterAuth({
+    return {
         appName,
         baseURL,
         secret: secret || "dummy-secret-for-build-purposes-only",
@@ -120,40 +133,22 @@ function build(options) {
             // an admin) and a ban count at once instead of after up to 5 minutes; for a small app that one query is nothing
             cookieCache: { enabled: false },
         },
-        plugins: [
-            twoFactor(),
-            ...(admin ? [adminPlugin({ ac, roles })] : []),
-            ...(plugins ?? []),
-            sveltekitCookies(getRequestEvent), // Ensure cookies are populated in SvelteKit
-        ],
-    });
+    };
 }
-export function createAuth(options) {
-    // Inside, the instance is used with this package's plugins only; the Product gets it with its own plugins' types too
-    const auth = build(options);
-    const { social = {} } = options;
-    setRegistry({
-        db: options.db,
-        schema: options.schema,
-        appName: options.appName,
-        origin: options.origin,
-        locale: options.locale,
-        signupMode: options.signupMode,
-        mailer: options.mailer,
-        admin: options.admin ?? false,
-        log: options.log ?? consoleLog,
-        auth,
-        providers: { github: hasKeys(social.github), google: hasKeys(social.google) },
-    });
+/** Hands the Product's instance to this package (after `authOptions()`) and returns the handles. */
+export function registerAuth(auth) {
+    const current = registry();
+    setRegistry({ ...current, auth: auth });
+    const instance = auth;
     const handle = async ({ event, resolve }) => {
-        const current = await auth.api.getSession({ headers: event.request.headers });
-        if (current) {
-            event.locals.session = current.session;
-            event.locals.user = current.user;
+        const session = await instance.api.getSession({ headers: event.request.headers });
+        if (session) {
+            event.locals.session = session.session;
+            event.locals.user = session.user;
         }
         const { building } = await import("$app/env");
-        return svelteKitHandler({ event, resolve, auth, building });
+        return svelteKitHandler({ event, resolve, auth: instance, building });
     };
     const apiHandler = ({ request }) => auth.handler(request);
-    return { auth: auth, handle, apiHandler, providers: { github: hasKeys(social.github), google: hasKeys(social.google) } };
+    return { handle, apiHandler, providers: current.providers };
 }

package/dist/server/index.d.ts

@@ -1,7 +1,7 @@
-export { createAuth, type AdminFields, type Auth, type AuthSession, type AuthUser, type CreateAuthOptions, type CreatedAuth, type SocialProvider } from "./create.js";
+export { authOptions, registerAuth, type AdminFields, type Auth, type AuthLike, type AuthSession, type AuthUser, type CreateAuthOptions, type RegisteredAuth, type SocialProvider } from "./create.js";
 export { adminCommand, adminQuery, adminSchemaCommand, adminSchemaQuery, protectedCommand, protectedForm, protectedQuery, protectedSchemaCommand, protectedSchemaQuery, requireAdmin, requireUser, } from "./helpers.js";
 export { authLayoutLoad, einladungLoad, homeLayoutLoad, loginLoad, manageUserLoad, signupLoad } from "./loads.js";
-export { registry as authRegistry, type AuthLog, type Db } from "./registry.js";
+export { authInstance, registry as authRegistry, type AuthLog, type Db } from "./registry.js";
 export { EinladungRepo } from "./repositories/EinladungRepo.js";
 export { UserRepo } from "./repositories/UserRepo.js";
 export { EINLADUNG_COOKIE, EINLADUNG_GUELTIG_TAGE, EinladungService, type EinladungError } from "./service/einladung.service.js";

package/dist/server/index.js

@@ -1,7 +1,7 @@
-export { createAuth } from "./create.js";
+export { authOptions, registerAuth } from "./create.js";
 export { adminCommand, adminQuery, adminSchemaCommand, adminSchemaQuery, protectedCommand, protectedForm, protectedQuery, protectedSchemaCommand, protectedSchemaQuery, requireAdmin, requireUser, } from "./helpers.js";
 export { authLayoutLoad, einladungLoad, homeLayoutLoad, loginLoad, manageUserLoad, signupLoad } from "./loads.js";
-export { registry as authRegistry } from "./registry.js";
+export { authInstance, registry as authRegistry } from "./registry.js";
 export { EinladungRepo } from "./repositories/EinladungRepo.js";
 export { UserRepo } from "./repositories/UserRepo.js";
 export { EINLADUNG_COOKIE, EINLADUNG_GUELTIG_TAGE, EinladungService } from "./service/einladung.service.js";

package/dist/server/loads.js

@@ -4,7 +4,7 @@
  */
 import { error, redirect } from "@sveltejs/kit";
 import { m } from "../messages.js";
-import { registry } from "./registry.js";
+import { authInstance, registry } from "./registry.js";
 import { EINLADUNG_COOKIE, EinladungService } from "./service/einladung.service.js";
 import { isStale, SESSION_NOT_FRESH } from "../util/fresh.js";
 import { sameSitePath } from "../util/sameSite.js";
@@ -16,7 +16,7 @@ export async function authLayoutLoad() {
 }
 /** `/auth/login`. */
 export async function loginLoad({ locals, url, request }) {
-    const { auth } = registry();
+    const auth = authInstance();
     // An action refused the session as too old to be trusted (reauthPath): sign it out, so the form shows. Only a session
     // that really is that old, so a link can't log anyone out.
     if (locals.session && url.searchParams.get("error") === SESSION_NOT_FRESH.toLowerCase()) {

package/dist/server/registry.d.ts

@@ -27,7 +27,8 @@ export type Registry = {
     mailer: Mailer;
     admin: boolean;
     log: AuthLog;
-    auth: Auth;
+    /** The Product's instance, from `registerAuth()`; null between `authOptions()` and that call. */
+    auth: Auth | null;
     /** The social logins that have keys. */
     providers: {
         github: boolean;
@@ -36,4 +37,6 @@ export type Registry = {
 };
 export declare function setRegistry(registry: Registry): void;
 export declare function registry(): Registry;
+/** The Product's better-auth instance. */
+export declare function authInstance(): Auth;
 export declare const consoleLog: AuthLog;

package/dist/server/registry.js

@@ -4,9 +4,16 @@ export function setRegistry(registry) {
 }
 export function registry() {
     if (!current)
-        throw new Error("@vonall/auth: createAuth() has not run; import the app's auth wiring (src/lib/auth.ts) first");
+        throw new Error("@vonall/auth: authOptions() has not run; import the app's auth wiring (src/lib/auth.ts) first");
     return current;
 }
+/** The Product's better-auth instance. */
+export function authInstance() {
+    const auth = registry().auth;
+    if (!auth)
+        throw new Error("@vonall/auth: registerAuth(auth) has not run; the app's auth wiring (src/lib/auth.ts) calls it after betterAuth()");
+    return auth;
+}
 export const consoleLog = {
     debug: () => { },
     info: (message, context) => console.info(message, context ?? ""),