@vonall/auth 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @vonall/auth
 
+## 0.6.0
+
+### Minor Changes
+
+- [#17](https://github.com/SebastianvonAllmen/vonall-libs/pull/17) [`f1d99ba`](https://github.com/SebastianvonAllmen/vonall-libs/commit/f1d99ba19b46d4f3a0eb8dd7ed595c9a513b6d0f) Thanks [@SebastianvonAllmen](https://github.com/SebastianvonAllmen)! - An explicit context instead of the registry singleton. `@vonall/auth`: `createAuth(options)` returns `{ options, register }`; `register(auth)` gives `{ ctx, sessionHandle, apiHandler }` and checks the instance's plugins against the schema's options (`admin` is read off the schema, no longer an option). The repositories, services and mails are functions of the context (`userRepo(ctx)`, `einladungRepo(ctx)`, `einladungService(ctx)`, `authMails(ctx)`); remote functions read it with `authContext()`, loads with `contextOf(locals)`; the session handle puts it into `event.locals.auth`. `setAuthUi({ authClient })` takes only the client: the app's name, locale and signup mode come through the page data of the package's loads. `testAuth(db)` returns the context, `createUser(ctx, email)`. `@vonall/mcp`: `createMcp({ auth: ctx, … })`, `mcpPlugins(origin)` replaces `mcpPluginOptions`/`CIMD_OPTIONS`, `agentRepo(ctx)`, `mcpContext()`, `agentsTab()` with its own strings; `ConsentPage` and `AgentsTab` take no `appName`/`locale`; `@vonall/auth` is a peer dependency.
+
 ## 0.5.0
 
 ### Minor Changes

package/README.md

@@ -13,16 +13,19 @@ export const { user, session, account, verification, twoFactor, rateLimit, einla
 
 // src/lib/auth.ts: the wiring, once; the instance is built here so its types (every plugin's) are inferred here
 import { ac, roles } from "@vonall/auth";
-import { authOptions, registerAuth } from "@vonall/auth/server";
+import { createAuth } from "@vonall/auth/server";
 import { betterAuth } from "better-auth";
 import { admin } from "better-auth/plugins";
 import { twoFactor } from "better-auth/plugins/two-factor";
 import { sveltekitCookies } from "better-auth/svelte-kit";
+const wiring = createAuth({ db, schema, secret: BETTER_AUTH_SECRET, origin: ORIGIN, appName: APP_NAME, locale: LOCALE, signupMode: SIGNUP_MODE, mailer, social: { github: { clientId, clientSecret } }, log: logger });
 export const auth = betterAuth({
-	...authOptions({ db, schema, secret: BETTER_AUTH_SECRET, origin: ORIGIN, appName: APP_NAME, locale: LOCALE, signupMode: SIGNUP_MODE, mailer, admin: true, social: { github: { clientId, clientSecret } }, log: logger }),
+	...wiring.options,
 	plugins: [twoFactor(), admin({ ac, roles }), /* the MCP endpoint's, from @vonall/mcp */ sveltekitCookies(getRequestEvent)],
 });
-export const { handle: sessionHandle, apiHandler, providers } = registerAuth(auth);
+// The context: everything with accounts outside a request takes it (createMcp, scripts, tests); inside a request it is
+// `event.locals.auth`. register() checks the instance's plugins against the schema's options (admin, mcp).
+export const { ctx, sessionHandle, apiHandler } = wiring.register(auth);
 
 // src/lib/auth-client.ts       createAuthClient({ baseURL: PUBLIC_ORIGIN, plugins: [twoFactorClient(), adminClient({ ac, roles })] })  (from "better-auth/svelte")
 // src/hooks.server.ts            sequence(securityHeaders, sessionHandle)
@@ -33,10 +36,13 @@ export const { handle: sessionHandle, apiHandler, providers } = registerAuth(aut
 
 Entry points: `@vonall/auth` (types, validation schemas, `ac`/`roles` for the admin plugins, `isAdmin`, `mayInvite`, the
 fresh-session helpers, the messages), `@vonall/auth/schema`, `@vonall/auth/server`, `@vonall/auth/remote` (the remote
-functions a Product's components call), `@vonall/auth/testing` (`createUser`, `testAuth` for db tests). `better-auth` is
+functions a Product's components call), `@vonall/auth/testing` (`testAuth(db)` gives the context, `createUser(ctx)` an account, for db tests). `better-auth` is
 this package's dependency; the Product imports its plugins from the same version. `@node-rs/argon2` (the password
 hash, a native module) is a peer dependency: the Product lists it, so its server bundle can leave it external.
 
+The server side is functions of the context: `userRepo(ctx)`, `einladungRepo(ctx)`, `einladungService(ctx)`, `authMails(ctx)`;
+a remote function gets it with `authContext()`, a load with `contextOf(locals)`.
+
 Strings come in English and German: `configureAuthMessages({ locale, overrides })`. A Product's own user-owned tables
 reference `user.id` with `onDelete: "cascade"`, so deleting a Konto takes everything with it. The MCP endpoint's
 better-auth plugins and rate limit rule come from `@vonall/mcp` through `plugins` and `rateLimitRules`.
@@ -44,17 +50,18 @@ better-auth plugins and rate limit rule come from `@vonall/mcp` through `plugins
 ## The pages and the settings (`@vonall/auth/ui`)
 
 ```svelte
-<!-- src/routes/+layout.svelte: once, so the components know the client, the app and its language -->
+<!-- src/routes/+layout.svelte: once, so the components know the client; the app's name, locale and signup mode
+     reach them through the page data of this package's loads (authLayoutLoad, homeLayoutLoad, einladungLoad) -->
 <script lang="ts">
 	import { setAuthUi } from "@vonall/auth/ui";
-	setAuthUi({ authClient, appName: APP_NAME, locale: LOCALE, signupMode: SIGNUP_MODE });
+	setAuthUi({ authClient });
 </script>
 
 <!-- src/routes/auth/login/+page.svelte -->   <LoginForm>{#snippet footer()}…the privacy line…{/snippet}</LoginForm>
 <!-- src/routes/auth/signup/+page.svelte -->  <RegisterForm />
 <!-- src/routes/auth/reset-password -->       <ResetPasswordForm />
 <!-- src/routes/einladung/[token] -->         <EinladungPage {data} tagline={APP_TAGLINE} />
-<!-- src/routes/home/settings -->             <SettingsPage extraTabs={[{ id: "agents", label, hint, icon: Bot }]}>{#snippet extra(id)}…{/snippet}</SettingsPage>
+<!-- src/routes/home/settings -->             <SettingsPage extraTabs={[agentsTab()]}>{#snippet extra(id)}…{/snippet}</SettingsPage>
 <!-- src/routes/home/manage_user -->          <AdminView currentUserId={data.currentUserId} />
 ```
 

package/dist/remote/app_user.remote.js

@@ -3,16 +3,16 @@ import { getRequestEvent } from "$app/server";
 import { z } from "zod";
 import { m } from "../messages.js";
 import { adminQuery, adminSchemaCommand, protectedCommand, protectedForm, protectedQuery, protectedSchemaCommand } from "../server/helpers.js";
-import { authInstance } from "../server/registry.js";
-import { UserRepo } from "../server/repositories/UserRepo.js";
+import { authContext } from "../server/context.js";
+import { userRepo } from "../server/repositories/UserRepo.js";
 import { emailSchema, nameSchema, passwordSchema } from "../types.js";
 import { isSessionNotFresh, reauthPath } from "../util/fresh.js";
 /** The Admin option: every account. */
 export const getAllUsers = adminQuery(async () => {
-    return await UserRepo.getAllUsers();
+    return await userRepo(authContext()).getAllUsers();
 });
 export const updateUserProfile = protectedForm(z.object({ name: nameSchema, email: emailSchema }), async (data, _issue, user) => {
-    const auth = authInstance();
+    const { auth } = authContext();
     const event = getRequestEvent();
     if (data.email !== user.email) {
         await auth.api.changeEmail({ body: { newEmail: data.email }, headers: event.request.headers });
@@ -24,7 +24,7 @@ const passwordPair = { newPassword: passwordSchema, confirmPassword: z.string()
 const passwordsMatch = { error: () => m().passwordsMismatch, path: ["confirmPassword"] };
 export const changePassword = protectedForm(z.object({ currentPassword: passwordSchema, ...passwordPair }).refine((d) => d.newPassword === d.confirmPassword, passwordsMatch), async (data) => {
     const event = getRequestEvent();
-    await authInstance().api.changePassword({
+    await authContext().auth.api.changePassword({
         body: { currentPassword: data.currentPassword, newPassword: data.newPassword, revokeOtherSessions: true },
         headers: event.request.headers,
     });
@@ -32,13 +32,13 @@ export const changePassword = protectedForm(z.object({ currentPassword: password
 });
 export const setPassword = protectedForm(z.object(passwordPair).refine((d) => d.newPassword === d.confirmPassword, passwordsMatch), async (data) => {
     const event = getRequestEvent();
-    await authInstance().api.setPassword({ body: { newPassword: data.newPassword }, headers: event.request.headers });
+    await authContext().auth.api.setPassword({ body: { newPassword: data.newPassword }, headers: event.request.headers });
     return { success: true };
 });
 export const getSessions = protectedQuery(async () => {
     const event = getRequestEvent();
     try {
-        return await authInstance().api.listSessions({ headers: event.request.headers });
+        return await authContext().auth.api.listSessions({ headers: event.request.headers });
     }
     catch (e) {
         // Only a login from the last day may list the sessions; the sessions are in the settings
@@ -50,7 +50,7 @@ export const getSessions = protectedQuery(async () => {
 export const revokeSessionById = protectedSchemaCommand(z.object({ sessionId: z.string() }), async (data) => {
     const event = getRequestEvent();
     const currentSessionToken = event.locals.session?.token;
-    await authInstance().api.revokeSession({ body: { token: data.sessionId }, headers: event.request.headers });
+    await authContext().auth.api.revokeSession({ body: { token: data.sessionId }, headers: event.request.headers });
     const isCurrentSession = data.sessionId === currentSessionToken;
     if (!isCurrentSession)
         await getSessions().refresh();
@@ -58,19 +58,19 @@ export const revokeSessionById = protectedSchemaCommand(z.object({ sessionId: z.
 });
 export const revokeOthers = protectedCommand(async () => {
     const event = getRequestEvent();
-    await authInstance().api.revokeOtherSessions({ headers: event.request.headers });
+    await authContext().auth.api.revokeOtherSessions({ headers: event.request.headers });
     await getSessions().refresh();
     return { success: true };
 });
 export const getLinkedAccounts = protectedQuery(async (user) => {
-    return await UserRepo.getUserAccounts(user.id);
+    return await userRepo(authContext()).getUserAccounts(user.id);
 });
 /** The Admin option. */
 export const setUserRole = adminSchemaCommand(z.object({ userId: z.string(), role: z.enum(["admin", "user"]) }), async ({ userId, role }, admin) => {
     if (userId === admin.id) {
         throw error(400, { message: m().ownRole, id: "own_role", timestamp: new Date().toISOString() });
     }
-    await UserRepo.setRole(userId, role);
+    await userRepo(authContext()).setRole(userId, role);
     await getAllUsers().refresh();
     return { success: true };
 });
@@ -79,12 +79,12 @@ export const deleteUser = adminSchemaCommand(z.object({ userId: z.string() }), a
     if (userId === admin.id) {
         throw error(400, { message: m().ownAccount, id: "own_account", timestamp: new Date().toISOString() });
     }
-    await UserRepo.kontoLoeschen(userId);
+    await userRepo(authContext()).kontoLoeschen(userId);
     await getAllUsers().refresh();
     return { success: true };
 });
 /** Deletes the user's own account with all its data. */
 export const deleteOwnAccount = protectedCommand(async (user) => {
-    await UserRepo.kontoLoeschen(user.id);
+    await userRepo(authContext()).kontoLoeschen(user.id);
     return { success: true };
 });

package/dist/remote/einladung.remote.js

@@ -2,10 +2,10 @@ import { error } from "@sveltejs/kit";
 import { z } from "zod";
 import { m } from "../messages.js";
 import { adminQuery, adminSchemaCommand, protectedQuery, protectedSchemaCommand } from "../server/helpers.js";
-import { registry } from "../server/registry.js";
-import { EinladungRepo } from "../server/repositories/EinladungRepo.js";
-import { EinladungService } from "../server/service/einladung.service.js";
-import { sendEinladungEmail } from "../server/service/mail.js";
+import { authContext } from "../server/context.js";
+import { einladungRepo } from "../server/repositories/EinladungRepo.js";
+import { einladungService } from "../server/service/einladung.service.js";
+import { authMails } from "../server/service/mail.js";
 import { emailSchema } from "../types.js";
 import { messageOf } from "../util/messageOf.js";
 import { isAdmin, mayInvite } from "../util/signup.js";
@@ -16,20 +16,22 @@ function unwrap(result) {
 }
 /** The user's open Einladungen, and whether the server can send them by email. */
 export const getOffeneEinladungen = protectedQuery(async (user) => {
-    return { einladungen: await EinladungRepo.listOpenBy(user.id, new Date()), mail: registry().mailer.enabled };
+    const ctx = authContext();
+    return { einladungen: await einladungRepo(ctx).listOpenBy(user.id, new Date()), mail: ctx.mailer.enabled };
 });
 /** Creates an Einladung; the link is returned only here. With an email, it is also sent (if mail is set up). */
 export const createEinladung = protectedSchemaCommand(z.object({ email: emailSchema.nullable() }), async ({ email }, user) => {
-    const { origin, signupMode, admin, locale } = registry();
+    const ctx = authContext();
+    const { origin, signupMode, admin } = ctx;
     if (!mayInvite(signupMode, isAdmin(user))) {
         throw error(403, { message: m().onlyAdminsInvite, id: "forbidden", timestamp: new Date().toISOString() });
     }
-    const einladung = await EinladungService.erstellen(user.id, { email });
+    const einladung = await einladungService(ctx).erstellen(user.id, { email });
     const link = `${origin}/einladung/${einladung.token}`;
     let mailFehler = null;
     if (email) {
         try {
-            await sendEinladungEmail(user.name, email, { link, expiresAt: einladung.expiresAt }, locale);
+            await authMails(ctx).einladung(user.name, email, { link, expiresAt: einladung.expiresAt });
         }
         catch (e) {
             mailFehler = messageOf(e, m().mailFailed);
@@ -41,17 +43,18 @@ export const createEinladung = protectedSchemaCommand(z.object({ email: emailSch
     return { link, expiresAt: einladung.expiresAt, mailFehler };
 });
 export const withdrawEinladung = protectedSchemaCommand(z.object({ einladungId: z.string() }), async ({ einladungId }, user) => {
-    unwrap(await EinladungService.zurueckziehen(user.id, einladungId));
+    const ctx = authContext();
+    unwrap(await einladungService(ctx).zurueckziehen(user.id, einladungId));
     await getOffeneEinladungen().refresh();
-    if (registry().admin && isAdmin(user))
+    if (ctx.admin && isAdmin(user))
         await getAlleEinladungen().refresh();
 });
 /** The Admin option: every open Einladung, and withdrawing any of them. */
 export const getAlleEinladungen = adminQuery(async () => {
-    return await EinladungRepo.listAllOpen(new Date());
+    return await einladungRepo(authContext()).listAllOpen(new Date());
 });
 export const adminWithdrawEinladung = adminSchemaCommand(z.object({ einladungId: z.string() }), async ({ einladungId }) => {
-    unwrap(await EinladungService.zurueckziehen(null, einladungId));
+    unwrap(await einladungService(authContext()).zurueckziehen(null, einladungId));
     await getAlleEinladungen().refresh();
     await getOffeneEinladungen().refresh();
 });

package/dist/server/{registry.d.ts → context.d.ts}

@@ -1,11 +1,6 @@
-/**
- * What `createAuth()` set up, for the package's repositories, services and remote functions: the Product's database,
- * its tables, the options and the better-auth instance. One app per process, so a module-level value; the Product's
- * wiring (`src/lib/auth.ts`) runs before any request.
- */
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { Mailer } from "@vonall/mail";
-import type { FullSchema } from "../schema/index.js";
+import type { AuthSchema } from "../schema/index.js";
 import type { Auth } from "./create.js";
 import type { SignupMode } from "../types.js";
 export type Db = NodePgDatabase<any>;
@@ -16,27 +11,29 @@ export type AuthLog = {
     warn(message: string, context?: Record<string, unknown>): void;
     error(message: string, context?: Record<string, unknown>, error?: unknown): void;
 };
-export type Registry = {
+export type AuthContext<S extends AuthSchema = AuthSchema> = {
     db: Db;
-    schema: FullSchema;
+    schema: S;
     appName: string;
     origin: string;
-    /** The app's locale for dates in mails, e.g. "de-CH". */
+    /** The app's locale, e.g. "de-CH": dates in mails and on the pages. */
     locale: string;
     signupMode: SignupMode;
     mailer: Mailer;
-    admin: boolean;
     log: AuthLog;
-    /** The Product's instance, from `registerAuth()`; null between `authOptions()` and that call. */
-    auth: Auth | null;
+    /** The Admin option: `schema` has the role columns (and the instance the admin plugin, `register()` checks). */
+    admin: boolean;
+    /** Whether `schema` has the OAuth provider's tables (`@vonall/mcp`). */
+    mcp: boolean;
     /** The social logins that have keys. */
     providers: {
         github: boolean;
         google: boolean;
     };
+    /** The Product's instance; reading it before `register()` throws. */
+    readonly auth: Auth;
 };
-export declare function setRegistry(registry: Registry): void;
-export declare function registry(): Registry;
-/** The Product's better-auth instance. */
-export declare function authInstance(): Auth;
+/** The context of the current request: `event.locals.auth`, which the session handle set. */
+export declare function authContext(): AuthContext;
+export declare function contextOf(locals: object): AuthContext;
 export declare const consoleLog: AuthLog;

package/dist/server/context.js

@@ -0,0 +1,22 @@
+/**
+ * What `createAuth()` set up, for everything else in this package and in `@vonall/mcp`: the Product's database and
+ * tables, its options and, after `register()`, its better-auth instance. It is passed explicitly; inside a request it
+ * is also in `event.locals.auth` (the session handle puts it there), where the remote functions and the loads find it.
+ */
+import { getRequestEvent } from "$app/server";
+/** The context of the current request: `event.locals.auth`, which the session handle set. */
+export function authContext() {
+    return contextOf(getRequestEvent().locals);
+}
+export function contextOf(locals) {
+    const ctx = locals.auth;
+    if (!ctx)
+        throw new Error("@vonall/auth: no auth context on this request; the session handle of createAuth().register() is not in hooks.server.ts");
+    return ctx;
+}
+export const consoleLog = {
+    debug: () => { },
+    info: (message, context) => console.info(message, context ?? ""),
+    warn: (message, context) => console.warn(message, context ?? ""),
+    error: (message, context, error) => console.error(message, context ?? "", error ?? ""),
+};

package/dist/server/create.d.ts

@@ -1,7 +1,8 @@
 /**
- * better-auth for a Product, from explicit options. The Product's `src/lib/auth.ts` builds the instance itself, so its
- * types are inferred in the Product (its plugins included): `betterAuth({ ...authOptions({…}), plugins: […] })`, then
- * `registerAuth(auth)` for the session handle and the API handler; everything else in this package reads the result.
+ * better-auth for a Product: `const wiring = createAuth({…})`, then the Product builds the instance itself, so its
+ * types are inferred there (its plugins included): `betterAuth({ ...wiring.options, plugins: […] })`, and
+ * `wiring.register(auth)` gives the context, the session handle and the API handler; everything else in this package
+ * takes the context.
  */
 import type { RequestHandler } from "@sveltejs/kit";
 import type { Handle } from "@sveltejs/kit/hooks";
@@ -12,29 +13,27 @@ import { sveltekitCookies } from "better-auth/svelte-kit";
 import type { Mailer } from "@vonall/mail";
 import { roles, ac } from "../permissions.js";
 import type { AuthSchema } from "../schema/index.js";
-import { type AuthLog, type Db } from "./registry.js";
+import { type AuthContext, type AuthLog, type Db } from "./context.js";
 import { type SignupMode } from "../types.js";
 export type SocialProvider = {
     clientId: string;
     clientSecret: string;
 };
-export type CreateAuthOptions = {
+export type CreateAuthOptions<S extends AuthSchema = AuthSchema> = {
     /** The Product's Drizzle database. */
     db: Db;
-    /** The Product's tables from `authSchema()`, the same objects its `schema/` re-exports. */
-    schema: AuthSchema;
+    /** The Product's tables from `authSchema()`, the same objects its `schema/` re-exports; its options are read off them. */
+    schema: S;
     /** BETTER_AUTH_SECRET. */
     secret: string;
     /** The app's own address (ORIGIN), e.g. https://blueprint.vonall.ch. */
     origin: string;
     appName: string;
-    /** LOCALE, e.g. "en-GB" or "de-CH": dates in mails. */
+    /** LOCALE, e.g. "en-GB" or "de-CH": dates in mails and on the pages. */
     locale: string;
     signupMode: SignupMode;
     /** The Product's mailer (`@vonall/mail`); off without SMTP, which the signup mode `open` and the reset respect. */
     mailer: Mailer;
-    /** The Admin option: the admin plugin and roles, the first account becomes admin. Matches `authSchema({ admin })`. */
-    admin?: boolean;
     /** Social logins with keys; a provider without keys is left out (its button never shows). */
     social?: {
         github?: SocialProvider | null;
@@ -60,13 +59,18 @@ export type Auth<P extends BetterAuthPlugin[] = []> = ReturnType<typeof betterAu
     plugins: [...BasePlugins, ...P];
 }>>;
 /**
- * The Product's instance as `registerAuth()` takes it: built on `authOptions()`, with any plugins (their types stay the
+ * The Product's instance as `register()` takes it: built on `wiring.options`, with any plugins (their types stay the
  * Product's; this package uses the instance through its own `Auth` type).
  */
 export type AuthLike = {
     handler: (request: Request) => Promise<Response>;
     api: object;
     $context: Promise<object>;
+    options: {
+        plugins?: {
+            id: string;
+        }[];
+    };
 };
 /** The admin plugin's columns, named here because the plugin's type doesn't carry them into the session's user. */
 export type AdminFields = {
@@ -78,18 +82,19 @@ export type AdminFields = {
 /** The user and the session as the hooks put them into `locals` (a Product's `app.d.ts` uses these). */
 export type AuthUser = Auth["$Infer"]["Session"]["user"] & AdminFields;
 export type AuthSession = Auth["$Infer"]["Session"]["session"];
-export declare function authOptions(options: CreateAuthOptions): BetterAuthOptions;
-export type RegisteredAuth = {
-    /** The hooks handle: the session into `locals.user`/`locals.session`, and better-auth's own routes (/api/auth/*). */
-    handle: Handle;
+export type RegisteredAuth<S extends AuthSchema = AuthSchema> = {
+    /** For everything that works with accounts outside a request: `createMcp`, scripts, tests. */
+    ctx: AuthContext<S>;
+    /** The hooks handle: the context into `locals.auth`, the session into `locals.user`/`locals.session`, and better-auth's own routes (/api/auth/*). */
+    sessionHandle: Handle;
     /** For `src/routes/api/auth/[...auth]/+server.ts`: `export const GET = apiHandler, POST = apiHandler`. */
     apiHandler: RequestHandler;
-    /** The social logins that have keys; the login, signup and settings pages show only these. */
-    providers: {
-        github: boolean;
-        google: boolean;
-    };
 };
-/** Hands the Product's instance to this package (after `authOptions()`) and returns the handles. */
-export declare function registerAuth(auth: AuthLike): RegisteredAuth;
+export type AuthWiring<S extends AuthSchema = AuthSchema> = {
+    /** For `betterAuth({ ...options, plugins: […] })`. */
+    options: BetterAuthOptions;
+    /** Hands the Product's instance to this package; checks its plugins against the schema's options. */
+    register(auth: AuthLike): RegisteredAuth<S>;
+};
+export declare function createAuth<S extends AuthSchema>(options: CreateAuthOptions<S>): AuthWiring<S>;
 export {};

package/dist/server/create.js

@@ -7,11 +7,11 @@ import { twoFactor } from "better-auth/plugins/two-factor";
 import { sveltekitCookies, svelteKitHandler } from "better-auth/svelte-kit";
 import { m } from "../messages.js";
 import { roles, ac } from "../permissions.js";
+import { consoleLog } from "./context.js";
 import { hashPassword, verifyPassword } from "./crypto.js";
-import { consoleLog, registry, setRegistry } from "./registry.js";
-import { UserRepo } from "./repositories/UserRepo.js";
-import { EINLADUNG_COOKIE, EinladungService } from "./service/einladung.service.js";
-import { sendPasswordResetEmail, sendVerifyEmail } from "./service/mail.js";
+import { userRepo } from "./repositories/UserRepo.js";
+import { EINLADUNG_COOKIE, einladungService } from "./service/einladung.service.js";
+import { authMails } from "./service/mail.js";
 import { MIN_PASSWORD_LENGTH } from "../types.js";
 import { nameFromEmail } from "../util/names.js";
 /** The Einladung token the browser carries from its link (`/einladung/[token]`), if any. */
@@ -24,9 +24,10 @@ function einladungAusCookie() {
     }
 }
 const hasKeys = (p) => Boolean(p?.clientId && p.clientSecret && p.clientId !== "dummy");
-export function authOptions(options) {
-    const { secret, origin, appName, signupMode, admin = false, social = {}, rateLimitRules = {}, log = consoleLog } = options;
-    setRegistry({
+export function createAuth(options) {
+    const { secret, origin, appName, signupMode, social = {}, rateLimitRules = {}, log = consoleLog } = options;
+    let instance = null;
+    const ctx = {
         db: options.db,
         schema: options.schema,
         appName,
@@ -34,13 +35,21 @@ export function authOptions(options) {
         locale: options.locale,
         signupMode,
         mailer: options.mailer,
-        admin,
         log,
-        auth: null,
+        admin: "role" in options.schema.user,
+        mcp: "oauthClient" in options.schema,
         providers: { github: hasKeys(social.github), google: hasKeys(social.google) },
-    });
+        get auth() {
+            if (!instance)
+                throw new Error("@vonall/auth: createAuth().register(auth) has not run; the app's auth wiring (src/lib/auth.ts) calls it after betterAuth()");
+            return instance;
+        },
+    };
+    const users = userRepo(ctx);
+    const einladungen = einladungService(ctx);
+    const mails = authMails(ctx);
     const baseURL = origin || "http://localhost";
-    return {
+    const betterAuthOptions = {
         appName,
         baseURL,
         secret: secret || "dummy-secret-for-build-purposes-only",
@@ -73,7 +82,7 @@ export function authOptions(options) {
                     before: async (user) => {
                         // The signup mode decides: an Einladung, or (open) mail for the confirmation link. The very first account
                         // (the admin) needs neither and counts as confirmed.
-                        const { state, firstAccount } = await EinladungService.signup(einladungAusCookie());
+                        const { state, firstAccount } = await einladungen.signup(einladungAusCookie());
                         if (state === "needs_einladung")
                             throw new APIError("FORBIDDEN", { message: m().needsEinladung });
                         if (state === "no_mail")
@@ -87,14 +96,14 @@ export function authOptions(options) {
                     },
                     after: async (user) => {
                         // The first user becomes admin
-                        if (admin && (await UserRepo.countUsers()) === 1) {
+                        if (ctx.admin && (await users.countUsers()) === 1) {
                             log.info("First user created, bootstrapping global role to admin");
-                            await UserRepo.setRole(user.id, "admin");
+                            await users.setRole(user.id, "admin");
                         }
                         const token = einladungAusCookie();
                         if (!token)
                             return;
-                        const angenommen = await EinladungService.annehmen(user.id, token);
+                        const angenommen = await einladungen.annehmen(user.id, token);
                         if (angenommen.isErr())
                             log.warn("Einladung could not be accepted after signup", { userId: user.id, kind: angenommen.error.kind });
                         getRequestEvent().cookies.delete(EINLADUNG_COOKIE, { path: "/" });
@@ -109,7 +118,7 @@ export function authOptions(options) {
             // Signup mode open: anyone may sign up, so the email address is confirmed before the account can be used
             requireEmailVerification: signupMode === "open",
             sendResetPassword: async ({ user, url }) => {
-                await sendPasswordResetEmail(user, url);
+                await mails.passwordReset(user, url);
             },
         },
         emailVerification: {
@@ -118,7 +127,7 @@ export function authOptions(options) {
             autoSignInAfterVerification: true,
             sendVerificationEmail: async ({ user, url }) => {
                 if (!user.emailVerified)
-                    await sendVerifyEmail(user, url);
+                    await mails.verify(user, url);
             },
         },
         socialProviders: {
@@ -134,21 +143,29 @@ export function authOptions(options) {
             cookieCache: { enabled: false },
         },
     };
-}
-/** Hands the Product's instance to this package (after `authOptions()`) and returns the handles. */
-export function registerAuth(auth) {
-    const current = registry();
-    setRegistry({ ...current, auth: auth });
-    const instance = auth;
-    const handle = async ({ event, resolve }) => {
-        const session = await instance.api.getSession({ headers: event.request.headers });
-        if (session) {
-            event.locals.session = session.session;
-            event.locals.user = session.user;
-        }
-        const { building } = await import("$app/env");
-        return svelteKitHandler({ event, resolve, auth: instance, building });
+    return {
+        options: betterAuthOptions,
+        register(auth) {
+            // The instance's plugins must match the schema's options, or the columns and the plugin disagree at runtime
+            const plugins = new Set((auth.options.plugins ?? []).map((p) => p.id));
+            if (plugins.has("admin") !== ctx.admin) {
+                throw new Error(`@vonall/auth: ${ctx.admin ? "authSchema({ admin: true }) but the instance has no admin plugin" : "the instance has the admin plugin but authSchema() was built without admin"}`);
+            }
+            if (plugins.has("oauth-provider") && !ctx.mcp)
+                throw new Error("@vonall/auth: the instance has the MCP plugin but authSchema() was built without mcp (its tables are missing)");
+            instance = auth;
+            const sessionHandle = async ({ event, resolve }) => {
+                event.locals.auth = ctx;
+                const session = await ctx.auth.api.getSession({ headers: event.request.headers });
+                if (session) {
+                    event.locals.session = session.session;
+                    event.locals.user = session.user;
+                }
+                const { building } = await import("$app/env");
+                return svelteKitHandler({ event, resolve, auth: ctx.auth, building });
+            };
+            const apiHandler = ({ request }) => auth.handler(request);
+            return { ctx, sessionHandle, apiHandler };
+        },
     };
-    const apiHandler = ({ request }) => auth.handler(request);
-    return { handle, apiHandler, providers: current.providers };
 }

package/dist/server/index.d.ts

@@ -1,8 +1,8 @@
-export { authOptions, registerAuth, type AdminFields, type Auth, type AuthLike, type AuthSession, type AuthUser, type CreateAuthOptions, type RegisteredAuth, type SocialProvider } from "./create.js";
+export { authContext, contextOf, type AuthContext, type AuthLog, type Db } from "./context.js";
+export { createAuth, type AdminFields, type Auth, type AuthLike, type AuthSession, type AuthUser, type AuthWiring, type CreateAuthOptions, type RegisteredAuth, type SocialProvider } from "./create.js";
 export { adminCommand, adminQuery, adminSchemaCommand, adminSchemaQuery, protectedCommand, protectedForm, protectedQuery, protectedSchemaCommand, protectedSchemaQuery, requireAdmin, requireUser, } from "./helpers.js";
-export { authLayoutLoad, einladungLoad, homeLayoutLoad, loginLoad, manageUserLoad, signupLoad } from "./loads.js";
-export { authInstance, registry as authRegistry, type AuthLog, type Db } from "./registry.js";
-export { EinladungRepo } from "./repositories/EinladungRepo.js";
-export { UserRepo } from "./repositories/UserRepo.js";
-export { EINLADUNG_COOKIE, EINLADUNG_GUELTIG_TAGE, EinladungService, type EinladungError } from "./service/einladung.service.js";
-export { sendEinladungEmail, sendPasswordResetEmail, sendVerifyEmail } from "./service/mail.js";
+export { authLayoutLoad, einladungLoad, homeLayoutLoad, loginLoad, manageUserLoad, signupLoad, type AuthUiData } from "./loads.js";
+export { einladungRepo, type EinladungRepo } from "./repositories/EinladungRepo.js";
+export { userRepo, type UserRepo } from "./repositories/UserRepo.js";
+export { EINLADUNG_COOKIE, EINLADUNG_GUELTIG_TAGE, einladungService, type EinladungError, type EinladungService } from "./service/einladung.service.js";
+export { authMails, type AuthMails } from "./service/mail.js";

package/dist/server/index.js

@@ -1,8 +1,8 @@
-export { authOptions, registerAuth } from "./create.js";
+export { authContext, contextOf } from "./context.js";
+export { createAuth } from "./create.js";
 export { adminCommand, adminQuery, adminSchemaCommand, adminSchemaQuery, protectedCommand, protectedForm, protectedQuery, protectedSchemaCommand, protectedSchemaQuery, requireAdmin, requireUser, } from "./helpers.js";
 export { authLayoutLoad, einladungLoad, homeLayoutLoad, loginLoad, manageUserLoad, signupLoad } from "./loads.js";
-export { authInstance, registry as authRegistry } from "./registry.js";
-export { EinladungRepo } from "./repositories/EinladungRepo.js";
-export { UserRepo } from "./repositories/UserRepo.js";
-export { EINLADUNG_COOKIE, EINLADUNG_GUELTIG_TAGE, EinladungService } from "./service/einladung.service.js";
-export { sendEinladungEmail, sendPasswordResetEmail, sendVerifyEmail } from "./service/mail.js";
+export { einladungRepo } from "./repositories/EinladungRepo.js";
+export { userRepo } from "./repositories/UserRepo.js";
+export { EINLADUNG_COOKIE, EINLADUNG_GUELTIG_TAGE, einladungService } from "./service/einladung.service.js";
+export { authMails } from "./service/mail.js";