@voyant-travel/auth 0.133.1 → 0.133.2

package/dist/node-runtime.js

@@ -17,7 +17,7 @@ import { eq, sql } from "drizzle-orm";
 import { Hono } from "hono";
 import { createVoyantCloudAdminAuthPlugin, revalidateVoyantCloudAdminAuthSession, revalidateVoyantCloudAdminAuthUser, } from "./cloud-admin-session.js";
 import { buildClearCloudAdminAuthStateCookie, createCloudAdminAuthStart } from "./cloud-broker.js";
-import { createBetterAuth, handleApiTokenManagementRequest, handleOrganizationMembersRequest, } from "./server.js";
+import { createAdminBetterAuth, createCustomerBetterAuth, handleApiTokenManagementRequest, handleOrganizationMembersRequest, } from "./server.js";
 import { ensureCurrentUserProfile } from "./workspace.js";
 /** Resolve Better Auth's standard cross-subdomain cookie policy for Node hosts. */
 export function buildBetterAuthCookieAdvancedOptions(env) {
@@ -29,6 +29,48 @@ export function buildBetterAuthCookieAdvancedOptions(env) {
         defaultCookieAttributes: { domain },
     };
 }
+/**
+ * Better Auth is dispatched internally without the hosting `/api` prefix, but
+ * OAuth providers must return to the browser-visible route. Keep explicit
+ * merchant overrides and supply the canonical public callback otherwise.
+ */
+export function withCustomerSocialRedirectUris(methods, publicApiBaseUrl) {
+    const providers = methods.socialProviders;
+    if (!providers)
+        return methods;
+    const normalizedPublicApiBaseUrl = publicApiBaseUrl.replace(/\/+$/, "");
+    const callback = (provider) => `${normalizedPublicApiBaseUrl}/auth/customer/callback/${provider}`;
+    const withRedirectUri = (provider, redirectURI) => {
+        if (!provider || typeof provider !== "object")
+            return provider;
+        const configured = provider;
+        return {
+            ...configured,
+            redirectURI: configured.redirectURI?.trim() || redirectURI,
+        };
+    };
+    return {
+        ...methods,
+        socialProviders: {
+            ...providers,
+            ...(providers.google
+                ? {
+                    google: withRedirectUri(providers.google, callback("google")),
+                }
+                : {}),
+            ...(providers.facebook
+                ? {
+                    facebook: withRedirectUri(providers.facebook, callback("facebook")),
+                }
+                : {}),
+            ...(providers.apple
+                ? {
+                    apple: withRedirectUri(providers.apple, callback("apple")),
+                }
+                : {}),
+        },
+    };
+}
 export function createOperatorAuthNodeRuntime(runtimeOptions) {
     const openDatabase = runtimeOptions.openDatabase ??
         ((env) => {
@@ -77,7 +119,7 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
     }
     function isCloudAllowedBetterAuthRoute(request) {
         const url = new URL(request.url);
-        const pathname = url.pathname.replace(/\/+$/, "") || "/";
+        const pathname = url.pathname.replace("/auth/admin", "/auth").replace(/\/+$/, "") || "/";
         return CLOUD_BETTER_AUTH_ALLOWLIST.has(pathname);
     }
     function localAuthDisabledResponse(c) {
@@ -143,7 +185,7 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
         return {
             cloudAuthStartUrl,
             deploymentId,
-            adminCallbackUrl: `${getPublicApiBaseUrl(env)}/auth/cloud/callback`,
+            adminCallbackUrl: `${getPublicApiBaseUrl(env)}/auth/admin/cloud/callback`,
             cookieSecret: env.SESSION_CLAIMS_SECRET,
             appId: env.VOYANT_CLOUD_APP_ID?.trim() || undefined,
             environment: env.VOYANT_CLOUD_ENVIRONMENT?.trim() || undefined,
@@ -186,12 +228,151 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
     function allowAuthSecretLogging(env) {
         return env.VOYANT_AUTH_LOG_SECRET_FALLBACKS === "1";
     }
-    function buildBetterAuth(env, db, options = {}) {
+    /**
+     * Build a Better Auth instance backed by a caller-provided drizzle
+     * client. The caller owns the Pool lifecycle (open before, dispose
+     * after) so the same Pool can serve both the auth lookup and any
+     * subsequent queries the route does — without spinning up a second
+     * connection per request.
+     *
+     * The deployment decides whether this is a request-scoped or resident Node
+     * pool. The Better Auth instance is not cached independently of that owner.
+     */
+    function requireAdminAuthSecret(env) {
+        const secret = env.BETTER_AUTH_ADMIN_SECRET?.trim() || env.BETTER_AUTH_SECRET?.trim();
+        if (!secret)
+            throw new Error("Admin auth requires BETTER_AUTH_ADMIN_SECRET");
+        return secret;
+    }
+    function requireCustomerAuthSecret(env) {
+        const secret = env.BETTER_AUTH_CUSTOMER_SECRET?.trim();
+        if (secret)
+            return secret;
+        // Compatibility bridge for deployments created before realm-specific
+        // secrets. The suffix gives the customer cookie an independent signature.
+        return `${requireAdminAuthSecret(env)}:voyant-customer-realm`;
+    }
+    function envEnabled(value, fallback) {
+        const normalized = value?.trim().toLowerCase();
+        if (!normalized)
+            return fallback;
+        return normalized === "1" || normalized === "true" || normalized === "yes";
+    }
+    function parseCustomerAuthPolicy(env) {
+        const fallback = {
+            methods: {
+                emailCode: envEnabled(env.VOYANT_CUSTOMER_AUTH_EMAIL_CODE, true),
+                emailPassword: envEnabled(env.VOYANT_CUSTOMER_AUTH_EMAIL_PASSWORD, true),
+                google: { enabled: false, credentialRef: null },
+                facebook: { enabled: false, credentialRef: null },
+                apple: { enabled: false, credentialRef: null },
+            },
+        };
+        const raw = env.VOYANT_CUSTOMER_AUTH_CONFIG_JSON?.trim();
+        if (!raw)
+            return fallback;
+        try {
+            const parsed = JSON.parse(raw);
+            const methods = parsed.methods ?? {};
+            const social = (value) => {
+                if (!value || typeof value !== "object" || Array.isArray(value)) {
+                    return { enabled: false, credentialRef: null };
+                }
+                const record = value;
+                return {
+                    enabled: record.enabled === true,
+                    credentialRef: typeof record.credentialRef === "string" && record.credentialRef.trim()
+                        ? record.credentialRef.trim()
+                        : null,
+                };
+            };
+            return {
+                methods: {
+                    emailCode: typeof methods.emailCode === "boolean" ? methods.emailCode : fallback.methods.emailCode,
+                    emailPassword: typeof methods.emailPassword === "boolean"
+                        ? methods.emailPassword
+                        : fallback.methods.emailPassword,
+                    google: social(methods.google),
+                    facebook: social(methods.facebook),
+                    apple: social(methods.apple),
+                },
+            };
+        }
+        catch {
+            console.error("[auth/customer] Invalid VOYANT_CUSTOMER_AUTH_CONFIG_JSON; failing social auth closed");
+            return fallback;
+        }
+    }
+    function defaultCustomerAuthContext(env, policy) {
+        const hasCanonicalPolicy = Boolean(env.VOYANT_CUSTOMER_AUTH_CONFIG_JSON?.trim());
+        const google = Boolean(env.CUSTOMER_AUTH_GOOGLE_CLIENT_ID?.trim() &&
+            env.CUSTOMER_AUTH_GOOGLE_CLIENT_SECRET?.trim() &&
+            (!hasCanonicalPolicy || policy.methods.google.enabled));
+        const facebook = Boolean(env.CUSTOMER_AUTH_FACEBOOK_CLIENT_ID?.trim() &&
+            env.CUSTOMER_AUTH_FACEBOOK_CLIENT_SECRET?.trim() &&
+            (!hasCanonicalPolicy || policy.methods.facebook.enabled));
+        const apple = Boolean(env.CUSTOMER_AUTH_APPLE_CLIENT_ID?.trim() &&
+            env.CUSTOMER_AUTH_APPLE_CLIENT_SECRET?.trim() &&
+            (!hasCanonicalPolicy || policy.methods.apple.enabled));
+        return {
+            baseURL: getAuthBaseUrl(env),
+            trustedOrigins: getTrustedOrigins(env),
+            methods: {
+                emailCode: policy.methods.emailCode,
+                emailPassword: policy.methods.emailPassword,
+                socialProviders: {
+                    ...(google
+                        ? {
+                            google: {
+                                clientId: env.CUSTOMER_AUTH_GOOGLE_CLIENT_ID.trim(),
+                                clientSecret: env.CUSTOMER_AUTH_GOOGLE_CLIENT_SECRET.trim(),
+                            },
+                        }
+                        : {}),
+                    ...(facebook
+                        ? {
+                            facebook: {
+                                clientId: env.CUSTOMER_AUTH_FACEBOOK_CLIENT_ID.trim(),
+                                clientSecret: env.CUSTOMER_AUTH_FACEBOOK_CLIENT_SECRET.trim(),
+                            },
+                        }
+                        : {}),
+                    ...(apple
+                        ? {
+                            apple: {
+                                clientId: env.CUSTOMER_AUTH_APPLE_CLIENT_ID.trim(),
+                                clientSecret: env.CUSTOMER_AUTH_APPLE_CLIENT_SECRET.trim(),
+                            },
+                        }
+                        : {}),
+                },
+            },
+        };
+    }
+    function resolveCustomerAuthContext(env, request) {
+        const policy = parseCustomerAuthPolicy(env);
+        return (runtimeOptions.resolveCustomerAuthContext?.(env, policy, request) ??
+            defaultCustomerAuthContext(env, policy));
+    }
+    function publicCustomerAuthConfiguration(env, request) {
+        const methods = resolveCustomerAuthContext(env, request).methods;
+        const providers = methods.socialProviders ?? {};
+        return {
+            methods: {
+                emailCode: methods.emailCode ?? true,
+                emailPassword: methods.emailPassword ?? true,
+                google: Boolean(providers.google),
+                facebook: Boolean(providers.facebook),
+                apple: Boolean(providers.apple),
+            },
+        };
+    }
+    function buildAdminBetterAuth(env, db) {
         const emailSender = runtimeOptions.resolveEmailSender?.(env);
         const cloudAuthExchange = isVoyantCloudAuthMode(env) ? getCloudAuthExchangeConfig(env) : null;
         const authDb = db;
         const cloudAuthDb = db;
-        return createBetterAuth({
+        return createAdminBetterAuth({
             // `db` is a `NeonDatabase` (neon-serverless WebSocket); the
             // `CreateBetterAuthOptions.db` type still references the older
             // `getDb` return union (postgres-js + neon-http). Drizzle's
@@ -199,12 +380,11 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
             // the cast is structurally safe — better-auth's drizzleAdapter
             // works on any PgDatabase. See #500 for context.
             db: authDb,
-            secret: env.BETTER_AUTH_SECRET,
+            secret: requireAdminAuthSecret(env),
             baseURL: getAuthBaseUrl(env),
-            basePath: "/auth",
+            basePath: "/auth/admin",
             trustedOrigins: getTrustedOrigins(env),
             advanced: (runtimeOptions.cookieAdvanced ?? buildBetterAuthCookieAdvancedOptions)(env),
-            customerSignupSurfaces: options.customerSignup ? ["customer"] : undefined,
             plugins: cloudAuthExchange
                 ? [
                     createVoyantCloudAdminAuthPlugin({
@@ -242,9 +422,42 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
             },
         });
     }
-    function rewriteCustomerAuthRequest(request) {
+    function buildCustomerBetterAuth(env, db, request) {
+        const emailSender = runtimeOptions.resolveEmailSender?.(env);
+        const context = resolveCustomerAuthContext(env, request);
+        const authDb = db;
+        return createCustomerBetterAuth({
+            db: authDb,
+            secret: requireCustomerAuthSecret(env),
+            baseURL: context.baseURL,
+            basePath: "/auth/customer",
+            trustedOrigins: context.trustedOrigins,
+            methods: withCustomerSocialRedirectUris(context.methods, getPublicApiBaseUrl(env)),
+            sendResetPassword: async ({ user, url }) => {
+                if (!emailSender) {
+                    if (allowAuthSecretLogging(env)) {
+                        console.info(`[auth/customer] reset-password (debug fallback) -> ${user.email}: ${url}`);
+                        return;
+                    }
+                    throw new Error("Password reset email provider is not configured");
+                }
+                await emailSender.sendResetPassword({ user, url });
+            },
+            sendVerificationOTP: async ({ email, otp, type }) => {
+                if (!emailSender) {
+                    if (allowAuthSecretLogging(env)) {
+                        console.info(`[auth/customer] verification-otp (debug fallback) [${type}] -> ${email}: ${otp}`);
+                        return;
+                    }
+                    throw new Error("Verification OTP email provider is not configured");
+                }
+                await emailSender.sendVerificationOtp({ email, otp, type });
+            },
+        });
+    }
+    function rewriteLegacyAdminAuthRequest(request) {
         const url = new URL(request.url);
-        url.pathname = url.pathname.replace("/auth/customer", "/auth");
+        url.pathname = url.pathname.replace("/auth", "/auth/admin");
         return new Request(url, request);
     }
     const FULL_ACCESS_SCOPES = ["*"];
@@ -294,12 +507,15 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
     async function resolveAuthRequest(request, env) {
         const { db, dispose } = openDatabase(env);
         try {
-            const auth = buildBetterAuth(env, db);
+            const customerSurface = new URL(request.url).pathname.includes("/v1/public/");
+            const auth = customerSurface
+                ? buildCustomerBetterAuth(env, db, request)
+                : buildAdminBetterAuth(env, db);
             const session = await auth.api.getSession({ headers: request.headers });
             if (!session) {
                 return null;
             }
-            if (isVoyantCloudAuthMode(env)) {
+            if (!customerSurface && isVoyantCloudAuthMode(env)) {
                 const revalidateConfig = getCloudAuthRevalidateConfig(env);
                 if (!revalidateConfig) {
                     return null;
@@ -319,12 +535,25 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
                     return null;
                 }
             }
+            if (customerSurface) {
+                return {
+                    userId: session.user.id,
+                    sessionId: session.session.id,
+                    organizationId: null,
+                    callerType: "session",
+                    actor: "customer",
+                    realm: "customer",
+                    scopes: [],
+                    email: session.user.email ?? null,
+                };
+            }
             return {
                 userId: session.user.id,
                 sessionId: session.session.id,
                 organizationId: null,
                 callerType: "session",
                 actor: "staff",
+                realm: "admin",
                 // Member RBAC scope set (RFC voyant#2085). Defaults to full access until
                 // an admin assigns permissions, so existing deployments are unchanged.
                 // `actor: "staff"` is retained, so actor-gated paths (incl. the
@@ -362,7 +591,7 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
         }
         const { db, dispose } = openDatabase(env);
         try {
-            const betterAuth = buildBetterAuth(env, db);
+            const betterAuth = buildAdminBetterAuth(env, db);
             const session = await betterAuth.api.getSession({ headers: request.headers });
             if (!session) {
                 return null;
@@ -472,7 +701,7 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
         // middleware, so own the Pool here.
         const { db, dispose } = openDatabase(c.env);
         try {
-            const betterAuth = buildBetterAuth(c.env, db);
+            const betterAuth = buildAdminBetterAuth(c.env, db);
             const session = await betterAuth.api.getSession({ headers: c.req.raw.headers });
             if (!session) {
                 return c.json({ userExists: false, authenticated: false });
@@ -500,7 +729,7 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
     async function handleApiTokensFacade(c) {
         const { db, dispose } = openDatabase(c.env);
         try {
-            const betterAuth = buildBetterAuth(c.env, db);
+            const betterAuth = buildAdminBetterAuth(c.env, db);
             const cloudAuthDb = db;
             if (isVoyantCloudAuthMode(c.env)) {
                 const revalidateConfig = getCloudAuthRevalidateConfig(c.env);
@@ -538,7 +767,7 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
     async function handleOrganizationMembersFacade(c) {
         const { db, dispose } = openDatabase(c.env);
         try {
-            const betterAuth = buildBetterAuth(c.env, db);
+            const betterAuth = buildAdminBetterAuth(c.env, db);
             const cloudAuthDb = db;
             if (isVoyantCloudAuthMode(c.env)) {
                 const revalidateConfig = getCloudAuthRevalidateConfig(c.env);
@@ -573,7 +802,7 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
             c.executionCtx.waitUntil(dispose());
         }
     }
-    auth.get("/auth/cloud/start", async (c) => {
+    async function handleCloudAuthStart(c) {
         if (!isVoyantCloudAuthMode(c.env)) {
             return c.json({ error: "Not found" }, 404);
         }
@@ -599,8 +828,8 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
             console.error("[auth/cloud/start] Error:", error);
             return c.json({ error: "Voyant Cloud auth broker is misconfigured" }, 500);
         }
-    });
-    auth.get("/auth/cloud/callback", async (c) => {
+    }
+    async function handleCloudAuthCallback(c) {
         if (!isVoyantCloudAuthMode(c.env)) {
             return c.json({ error: "Not found" }, 404);
         }
@@ -613,8 +842,11 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
         }
         const { db, dispose } = openDatabase(c.env);
         try {
-            const betterAuth = buildBetterAuth(c.env, db);
-            return await betterAuth.handler(c.req.raw);
+            const betterAuth = buildAdminBetterAuth(c.env, db);
+            const request = c.req.path.startsWith("/auth/admin/")
+                ? c.req.raw
+                : rewriteLegacyAdminAuthRequest(c.req.raw);
+            return await betterAuth.handler(request);
         }
         catch (error) {
             console.error("[auth/cloud/callback] Error:", error);
@@ -623,7 +855,12 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
         finally {
             c.executionCtx.waitUntil(dispose());
         }
-    });
+    }
+    auth.get("/auth/admin/cloud/start", handleCloudAuthStart);
+    auth.get("/auth/admin/cloud/callback", handleCloudAuthCallback);
+    /** @deprecated Use /auth/admin/cloud/*. */
+    auth.get("/auth/cloud/start", handleCloudAuthStart);
+    auth.get("/auth/cloud/callback", handleCloudAuthCallback);
     auth.all("/auth/api-tokens", handleApiTokensFacade);
     auth.all("/auth/api-tokens/:keyId", handleApiTokensFacade);
     auth.all("/auth/api-tokens/:keyId/rotate", handleApiTokensFacade);
@@ -631,7 +868,7 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
     auth.get("/auth/customer/status", async (c) => {
         const { db, dispose } = openDatabase(c.env);
         try {
-            const betterAuth = buildBetterAuth(c.env, db, { customerSignup: true });
+            const betterAuth = buildCustomerBetterAuth(c.env, db, c.req.raw);
             const session = await betterAuth.api.getSession({ headers: c.req.raw.headers });
             return c.json({ authenticated: Boolean(session) });
         }
@@ -639,15 +876,28 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
             c.executionCtx.waitUntil(dispose());
         }
     });
+    auth.get("/auth/customer/config", (c) => {
+        if (c.env.VOYANT_CUSTOMER_AUTH_MODE?.trim() === "disabled") {
+            return c.json({
+                methods: {
+                    emailCode: false,
+                    emailPassword: false,
+                    google: false,
+                    facebook: false,
+                    apple: false,
+                },
+            });
+        }
+        return c.json(publicCustomerAuthConfiguration(c.env, c.req.raw));
+    });
     auth.all("/auth/customer/*", async (c) => {
-        if (isVoyantCloudAuthMode(c.env) &&
-            !isCloudAllowedBetterAuthRoute(rewriteCustomerAuthRequest(c.req.raw))) {
-            return localAuthDisabledResponse(c);
+        if (c.env.VOYANT_CUSTOMER_AUTH_MODE?.trim() === "disabled") {
+            return c.json({ error: "Customer auth is disabled" }, 404);
         }
         const { db, dispose } = openDatabase(c.env);
         try {
-            const betterAuth = buildBetterAuth(c.env, db, { customerSignup: true });
-            return await betterAuth.handler(rewriteCustomerAuthRequest(c.req.raw));
+            const betterAuth = buildCustomerBetterAuth(c.env, db, c.req.raw);
+            return await betterAuth.handler(c.req.raw);
         }
         finally {
             c.executionCtx.waitUntil(dispose());
@@ -660,19 +910,33 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
      * Sign-up is gated by a `user.create.before` hook in @voyant-travel/auth — once a
      * user exists, the hook throws and BA returns an error to the client.
      */
-    auth.all("/auth/*", async (c) => {
+    auth.all("/auth/admin/*", async (c) => {
         if (isVoyantCloudAuthMode(c.env) && !isCloudAllowedBetterAuthRoute(c.req.raw)) {
             return localAuthDisabledResponse(c);
         }
         const { db, dispose } = openDatabase(c.env);
         try {
-            const betterAuth = buildBetterAuth(c.env, db);
+            const betterAuth = buildAdminBetterAuth(c.env, db);
             return await betterAuth.handler(c.req.raw);
         }
         finally {
             c.executionCtx.waitUntil(dispose());
         }
     });
+    /** @deprecated Admin Better Auth routes moved to /auth/admin/*. */
+    auth.all("/auth/*", async (c) => {
+        const rewritten = rewriteLegacyAdminAuthRequest(c.req.raw);
+        if (isVoyantCloudAuthMode(c.env) && !isCloudAllowedBetterAuthRoute(rewritten)) {
+            return localAuthDisabledResponse(c);
+        }
+        const { db, dispose } = openDatabase(c.env);
+        try {
+            return await buildAdminBetterAuth(c.env, db).handler(rewritten);
+        }
+        finally {
+            c.executionCtx.waitUntil(dispose());
+        }
+    });
     return {
         handler: auth,
         getBootstrapStatusForRequest,