@voyant-travel/auth 0.133.5 → 0.135.0

package/dist/node-runtime.js

@@ -3,7 +3,7 @@
  *
  * agent-quality: file-size exception -- Auth handler keeps local and Voyant Cloud auth flows co-located until the route surface is split by auth mode.
  *
- * Mounts Better Auth at /auth/* for authentication operations.
+ * Mounts Better Auth at /auth/admin/* and /auth/customer/*.
  * Same-origin — no CORS needed. Session cookies work naturally.
  *
  * Also provides /auth/status (user provisioning) and /auth/me (user info).
@@ -19,6 +19,15 @@ import { createVoyantCloudAdminAuthPlugin, revalidateVoyantCloudAdminAuthSession
 import { buildClearCloudAdminAuthStateCookie, createCloudAdminAuthStart } from "./cloud-broker.js";
 import { createAdminBetterAuth, createCustomerBetterAuth, handleApiTokenManagementRequest, handleOrganizationMembersRequest, } from "./server.js";
 import { ensureCurrentUserProfile } from "./workspace.js";
+function classifyOperatorApiAuthSurface(requestUrl) {
+    const pathname = new URL(requestUrl).pathname.replace(/\/+$/, "") || "/";
+    const normalized = pathname.startsWith("/api/") ? pathname.slice(4) : pathname;
+    if (normalized === "/v1/admin" || normalized.startsWith("/v1/admin/"))
+        return "admin";
+    if (normalized === "/v1/public" || normalized.startsWith("/v1/public/"))
+        return "customer";
+    return null;
+}
 /** Resolve Better Auth's standard cross-subdomain cookie policy for Node hosts. */
 export function buildBetterAuthCookieAdvancedOptions(env) {
     const domain = env.AUTH_COOKIE_DOMAIN?.trim();
@@ -71,6 +80,24 @@ export function withCustomerSocialRedirectUris(methods, publicApiBaseUrl) {
         },
     };
 }
+/**
+ * Rewrite Better Auth's internally generated customer password-reset URL to
+ * the browser-visible storefront/BFF API base.
+ */
+export function withCustomerPublicResetPasswordUrl(generatedUrl, publicApiBaseURL) {
+    try {
+        const generated = new URL(generatedUrl);
+        const publicApi = new URL(publicApiBaseURL);
+        const apiPath = publicApi.pathname.replace(/\/+$/, "");
+        publicApi.pathname = `${apiPath}${generated.pathname}`;
+        publicApi.search = generated.search;
+        publicApi.hash = generated.hash;
+        return publicApi.toString();
+    }
+    catch {
+        return generatedUrl;
+    }
+}
 export function createOperatorAuthNodeRuntime(runtimeOptions) {
     const openDatabase = runtimeOptions.openDatabase ??
         ((env) => {
@@ -186,7 +213,7 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
             cloudAuthStartUrl,
             deploymentId,
             adminCallbackUrl: `${getPublicApiBaseUrl(env)}/auth/admin/cloud/callback`,
-            cookieSecret: env.SESSION_CLAIMS_SECRET,
+            cookieSecret: env.SESSION_CLAIMS_ADMIN_SECRET,
             appId: env.VOYANT_CLOUD_APP_ID?.trim() || undefined,
             environment: env.VOYANT_CLOUD_ENVIRONMENT?.trim() || undefined,
         };
@@ -313,6 +340,7 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
             env.CUSTOMER_AUTH_APPLE_CLIENT_SECRET?.trim() &&
             (!hasCanonicalPolicy || policy.methods.apple.enabled));
         return {
+            publicApiBaseURL: getPublicApiBaseUrl(env),
             baseURL: getAuthBaseUrl(env),
             trustedOrigins: getTrustedOrigins(env),
             methods: {
@@ -347,13 +375,55 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
             },
         };
     }
-    function resolveCustomerAuthContext(env, request) {
-        const policy = parseCustomerAuthPolicy(env);
-        return (runtimeOptions.resolveCustomerAuthContext?.(env, policy, request) ??
-            defaultCustomerAuthContext(env, policy));
+    async function resolveCustomerAuthContext(env, request) {
+        const context = runtimeOptions.resolveCustomerAuthContext
+            ? await runtimeOptions.resolveCustomerAuthContext(env, request)
+            : defaultCustomerAuthContext(env, parseCustomerAuthPolicy(env));
+        const baseURL = requireCanonicalOrigin(context.baseURL, "customer auth baseURL");
+        const publicApiBaseURL = requirePublicApiBaseUrl(context.publicApiBaseURL ?? `${baseURL}/api`, baseURL);
+        const trustedOrigins = context.trustedOrigins.map((origin) => requireCanonicalOrigin(origin, "customer auth trusted origin"));
+        return { ...context, baseURL, publicApiBaseURL, trustedOrigins };
+    }
+    function requireCanonicalOrigin(value, label) {
+        let parsed;
+        try {
+            parsed = new URL(value);
+        }
+        catch {
+            throw new Error(`${label} must be an absolute HTTP(S) origin`);
+        }
+        if (!["http:", "https:"].includes(parsed.protocol) ||
+            parsed.username ||
+            parsed.password ||
+            (parsed.pathname !== "/" && parsed.pathname !== "") ||
+            parsed.search ||
+            parsed.hash) {
+            throw new Error(`${label} must be an absolute HTTP(S) origin`);
+        }
+        return parsed.origin;
     }
-    function publicCustomerAuthConfiguration(env, request) {
-        const methods = resolveCustomerAuthContext(env, request).methods;
+    function requirePublicApiBaseUrl(value, baseURL) {
+        let parsed;
+        try {
+            parsed = new URL(value);
+        }
+        catch {
+            throw new Error("customer auth publicApiBaseURL must be an absolute HTTP(S) URL");
+        }
+        if (!["http:", "https:"].includes(parsed.protocol) ||
+            parsed.username ||
+            parsed.password ||
+            parsed.search ||
+            parsed.hash ||
+            parsed.origin !== baseURL ||
+            parsed.pathname === "/") {
+            throw new Error("customer auth publicApiBaseURL must be an absolute HTTP(S) URL with a path");
+        }
+        parsed.pathname = parsed.pathname.replace(/\/+$/, "");
+        return parsed.toString().replace(/\/$/, "");
+    }
+    async function publicCustomerAuthConfiguration(env, request) {
+        const methods = (await resolveCustomerAuthContext(env, request)).methods;
         const providers = methods.socialProviders ?? {};
         return {
             methods: {
@@ -387,7 +457,9 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
                 ? [
                     createVoyantCloudAdminAuthPlugin({
                         db: cloudAuthDb,
-                        cookieSecret: env.SESSION_CLAIMS_SECRET,
+                        cookieSecret: env.SESSION_CLAIMS_ADMIN_SECRET,
+                        secureStateCookie: new URL(`${getPublicApiBaseUrl(env)}/auth/admin/cloud/callback`).protocol ===
+                            "https:",
                         exchange: cloudAuthExchange,
                     }),
                 ]
@@ -420,9 +492,10 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
             },
         });
     }
-    function buildCustomerBetterAuth(env, db, request) {
+    async function buildCustomerBetterAuth(env, db, request) {
         const emailSender = runtimeOptions.resolveEmailSender?.(env);
-        const context = resolveCustomerAuthContext(env, request);
+        const context = await resolveCustomerAuthContext(env, request);
+        const publicApiBaseURL = context.publicApiBaseURL ?? getPublicApiBaseUrl(env);
         const authDb = db;
         return createCustomerBetterAuth({
             db: authDb,
@@ -430,16 +503,17 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
             baseURL: context.baseURL,
             basePath: "/auth/customer",
             trustedOrigins: context.trustedOrigins,
-            methods: withCustomerSocialRedirectUris(context.methods, getPublicApiBaseUrl(env)),
+            methods: withCustomerSocialRedirectUris(context.methods, publicApiBaseURL),
             sendResetPassword: async ({ user, url }) => {
+                const publicUrl = withCustomerPublicResetPasswordUrl(url, publicApiBaseURL);
                 if (!emailSender) {
                     if (allowAuthSecretLogging(env)) {
-                        console.info(`[auth/customer] reset-password (debug fallback) -> ${user.email}: ${url}`);
+                        console.info(`[auth/customer] reset-password (debug fallback) -> ${user.email}: ${publicUrl}`);
                         return;
                     }
                     throw new Error("Password reset email provider is not configured");
                 }
-                await emailSender.sendResetPassword({ user, url });
+                await emailSender.sendResetPassword({ user, url: publicUrl });
             },
             sendVerificationOTP: async ({ email, otp, type }) => {
                 if (!emailSender) {
@@ -453,11 +527,6 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
             },
         });
     }
-    function rewriteLegacyAdminAuthRequest(request) {
-        const url = new URL(request.url);
-        url.pathname = url.pathname.replace("/auth", "/auth/admin");
-        return new Request(url, request);
-    }
     const FULL_ACCESS_SCOPES = ["*"];
     function scopesForOperatorRole(role) {
         const base = accessCatalogScopesForRole(role, runtimeOptions.accessCatalog);
@@ -503,14 +572,17 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
         return profile?.permissions ?? FULL_ACCESS_SCOPES;
     }
     async function resolveAuthRequest(request, env) {
-        const customerSurface = new URL(request.url).pathname.includes("/v1/public/");
+        const surface = classifyOperatorApiAuthSurface(request.url);
+        if (!surface)
+            return null;
+        const customerSurface = surface === "customer";
         if (customerSurface && env.VOYANT_CUSTOMER_AUTH_MODE?.trim() === "disabled") {
             return null;
         }
         const { db, dispose } = openDatabase(env);
         try {
             const auth = customerSurface
-                ? buildCustomerBetterAuth(env, db, request)
+                ? await buildCustomerBetterAuth(env, db, request)
                 : buildAdminBetterAuth(env, db);
             const session = await auth.api.getSession({ headers: request.headers });
             if (!session) {
@@ -637,16 +709,19 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
         }
     }
     async function getBootstrapStatusForRequest(request, env) {
+        const modules = runtimeOptions.activeModules
+            ? { modules: [...runtimeOptions.activeModules] }
+            : {};
         if (shouldUseBrowserEvidenceAuthFallback(env, request)) {
-            return { hasUsers: true };
+            return { hasUsers: true, ...modules };
         }
         if (isVoyantCloudAuthMode(env)) {
-            return { hasUsers: true, authMode: "voyant-cloud" };
+            return { hasUsers: true, authMode: "voyant-cloud", ...modules };
         }
         const { db, dispose } = openDatabase(env);
         try {
             const [row] = await db.select({ count: sql `count(*)::int` }).from(authUser);
-            return { hasUsers: (row?.count ?? 0) > 0, authMode: "local" };
+            return { hasUsers: (row?.count ?? 0) > 0, authMode: "local", ...modules };
         }
         finally {
             await dispose();
@@ -837,17 +912,15 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
         const exchangeConfig = getCloudAuthExchangeConfig(c.env);
         if (!exchangeConfig) {
             const url = new URL(c.req.url);
+            const callbackUrl = getCloudAuthStartConfig(c.env)?.adminCallbackUrl;
             return c.json({ error: "Voyant Cloud auth exchange is not configured yet" }, 501, {
-                "Set-Cookie": buildClearCloudAdminAuthStateCookie(url.protocol === "https:", url.pathname.replace(/\/callback$/, "") || "/auth/cloud"),
+                "Set-Cookie": buildClearCloudAdminAuthStateCookie(callbackUrl ? new URL(callbackUrl).protocol === "https:" : url.protocol === "https:", url.pathname.replace(/\/callback$/, "") || "/auth/admin/cloud"),
             });
         }
         const { db, dispose } = openDatabase(c.env);
         try {
             const betterAuth = buildAdminBetterAuth(c.env, db);
-            const request = c.req.path.startsWith("/auth/admin/")
-                ? c.req.raw
-                : rewriteLegacyAdminAuthRequest(c.req.raw);
-            return await betterAuth.handler(request);
+            return await betterAuth.handler(c.req.raw);
         }
         catch (error) {
             console.error("[auth/cloud/callback] Error:", error);
@@ -859,17 +932,17 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
     }
     auth.get("/auth/admin/cloud/start", handleCloudAuthStart);
     auth.get("/auth/admin/cloud/callback", handleCloudAuthCallback);
-    /** @deprecated Use /auth/admin/cloud/*. */
-    auth.get("/auth/cloud/start", handleCloudAuthStart);
-    auth.get("/auth/cloud/callback", handleCloudAuthCallback);
     auth.all("/auth/api-tokens", handleApiTokensFacade);
     auth.all("/auth/api-tokens/:keyId", handleApiTokensFacade);
     auth.all("/auth/api-tokens/:keyId/rotate", handleApiTokensFacade);
     auth.get("/auth/organization/list-members", handleOrganizationMembersFacade);
     auth.get("/auth/customer/status", async (c) => {
+        if (c.env.VOYANT_CUSTOMER_AUTH_MODE?.trim() === "disabled") {
+            return c.json({ authenticated: false, disabled: true });
+        }
         const { db, dispose } = openDatabase(c.env);
         try {
-            const betterAuth = buildCustomerBetterAuth(c.env, db, c.req.raw);
+            const betterAuth = await buildCustomerBetterAuth(c.env, db, c.req.raw);
             const session = await betterAuth.api.getSession({ headers: c.req.raw.headers });
             return c.json({ authenticated: Boolean(session) });
         }
@@ -877,7 +950,7 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
             c.executionCtx.waitUntil(dispose());
         }
     });
-    auth.get("/auth/customer/config", (c) => {
+    auth.get("/auth/customer/config", async (c) => {
         if (c.env.VOYANT_CUSTOMER_AUTH_MODE?.trim() === "disabled") {
             return c.json({
                 methods: {
@@ -889,7 +962,7 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
                 },
             });
         }
-        return c.json(publicCustomerAuthConfiguration(c.env, c.req.raw));
+        return c.json(await publicCustomerAuthConfiguration(c.env, c.req.raw));
     });
     auth.all("/auth/customer/*", async (c) => {
         if (c.env.VOYANT_CUSTOMER_AUTH_MODE?.trim() === "disabled") {
@@ -897,7 +970,7 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
         }
         const { db, dispose } = openDatabase(c.env);
         try {
-            const betterAuth = buildCustomerBetterAuth(c.env, db, c.req.raw);
+            const betterAuth = await buildCustomerBetterAuth(c.env, db, c.req.raw);
             return await betterAuth.handler(c.req.raw);
         }
         finally {
@@ -924,20 +997,6 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
             c.executionCtx.waitUntil(dispose());
         }
     });
-    /** @deprecated Admin Better Auth routes moved to /auth/admin/*. */
-    auth.all("/auth/*", async (c) => {
-        const rewritten = rewriteLegacyAdminAuthRequest(c.req.raw);
-        if (isVoyantCloudAuthMode(c.env) && !isCloudAllowedBetterAuthRoute(rewritten)) {
-            return localAuthDisabledResponse(c);
-        }
-        const { db, dispose } = openDatabase(c.env);
-        try {
-            return await buildAdminBetterAuth(c.env, db).handler(rewritten);
-        }
-        finally {
-            c.executionCtx.waitUntil(dispose());
-        }
-    });
     return {
         handler: auth,
         getBootstrapStatusForRequest,