@voyant-travel/auth 0.140.2 → 0.141.0

package/dist/node-runtime.d.ts

@@ -17,6 +17,14 @@ import type { CustomerBusinessAccountOnboardingRuntimeProvider } from "./custome
 import { type CustomerBuyerAccountPolicy } from "./customer-buyer-accounts.js";
 import { type CreateBetterAuthOptions, type CustomerAuthMethods } from "./server.js";
 type OperatorAuthMode = "local" | "voyant-cloud";
+/**
+ * Whether a request targets the customer realm surface eligible for per-storefront
+ * dynamic CORS: the public storefront API (`/v1/public` + `/v1/public/*`) and the
+ * customer auth routes (`/auth/customer` + `/auth/customer/*`) a direct client
+ * hits to sign in. Tolerates an optional `/api` host prefix. Admin/dash surfaces
+ * are intentionally excluded — they keep the static `CORS_ALLOWLIST` behavior.
+ */
+export declare function isCustomerCorsSurface(requestUrl: string): boolean;
 export interface OperatorAuthNodeEnv extends NodeDatabaseEnv {
     API_BASE_URL?: string;
     APP_URL?: string;
@@ -114,6 +122,15 @@ export interface CreateOperatorAuthNodeRuntimeOptions<Env extends OperatorAuthNo
      * merchant credentials. Never derive these values from Host/X-Forwarded-Host.
      */
     resolveCustomerAuthContext?: (env: Env, request: Request) => CustomerAuthRuntimeContext | Promise<CustomerAuthRuntimeContext>;
+    /**
+     * Request-time dynamic-CORS origin authorizer for the customer realm
+     * (`/v1/public/*` + `/auth/customer/*`). Returns the exact request origin to
+     * echo in `Access-Control-Allow-Origin` when a storefront authorizes it, or
+     * `null` to omit CORS headers. Authorizes keyed requests by the presented
+     * storefront key and keyless preflight by the declared allowed origins. When
+     * unset, the customer realm keeps the static `CORS_ALLOWLIST` behavior.
+     */
+    resolveCustomerCorsOrigin?: (env: Env, request: Request) => Promise<string | null>;
 }
 export interface CustomerAuthRuntimeContext {
     /** Browser-visible proxy base used by storefront/BFF auth callbacks. */
@@ -123,6 +140,12 @@ export interface CustomerAuthRuntimeContext {
     /** Explicit trusted storefront origin used for customer invitation links and request audit. */
     invitationAcceptBaseURL?: string;
     trustedOrigins: string[];
+    /**
+     * Full declared browser origins for the resolved storefront (exact +
+     * `https://*.host` wildcard). Carried for dynamic CORS; `trustedOrigins` is
+     * the canonical-origin subset Better Auth validates.
+     */
+    allowedOrigins?: string[];
     methods: CustomerAuthMethods;
     /** Buyer capabilities are independent from identity sign-up methods. */
     accountPolicy?: CustomerBuyerAccountPolicy | null;
@@ -164,6 +187,7 @@ export declare function createOperatorAuthNodeRuntime<Env extends OperatorAuthNo
     getCurrentUserForRequest: (request: Request, env: Env) => Promise<OperatorCurrentUser | null>;
     hasAuthPermission: (request: Request, env: Env) => Promise<boolean>;
     resolveAuthRequest: (request: Request, env: Env) => Promise<VoyantResolvedSessionAuthContext | null>;
+    resolveCustomerCorsOrigin: (request: Request, env: Env) => Promise<string | null>;
     validateApiTokenAccess: (env: Env, db: VoyantDb, apiKey: SelectApikey) => Promise<boolean>;
 };
 export {};

package/dist/node-runtime.js

@@ -23,6 +23,7 @@ import { customerBusinessAccountCreateInputSchema, customerBusinessAccountReques
 import { CustomerBusinessOnboardingConflictError, CustomerBusinessOnboardingNotFoundError, } from "./customer-business-onboarding-service.js";
 import { createDrizzleCustomerBuyerAccountStore, listCustomerBuyerAccounts, normalizeCustomerBuyerAccountPolicy, repairCustomerPersonalBuyerAccountEntitlement, resolveActiveCustomerBuyerContext, selectCustomerBuyerAccount, } from "./customer-buyer-accounts.js";
 import { createAdminBetterAuth, createCustomerBetterAuth, handleApiTokenManagementRequest, handleOrganizationMembersRequest, } from "./server.js";
+import { StorefrontCustomerAuthResolutionError } from "./storefront-customer-auth-resolver.js";
 import { ensureCurrentUserProfile } from "./workspace.js";
 function classifyOperatorApiAuthSurface(requestUrl) {
     const pathname = new URL(requestUrl).pathname.replace(/\/+$/, "") || "/";
@@ -33,6 +34,21 @@ function classifyOperatorApiAuthSurface(requestUrl) {
         return "customer";
     return null;
 }
+/**
+ * Whether a request targets the customer realm surface eligible for per-storefront
+ * dynamic CORS: the public storefront API (`/v1/public` + `/v1/public/*`) and the
+ * customer auth routes (`/auth/customer` + `/auth/customer/*`) a direct client
+ * hits to sign in. Tolerates an optional `/api` host prefix. Admin/dash surfaces
+ * are intentionally excluded — they keep the static `CORS_ALLOWLIST` behavior.
+ */
+export function isCustomerCorsSurface(requestUrl) {
+    const pathname = new URL(requestUrl).pathname.replace(/\/+$/, "") || "/";
+    const normalized = pathname.startsWith("/api/") ? pathname.slice(4) : pathname;
+    return (normalized === "/v1/public" ||
+        normalized.startsWith("/v1/public/") ||
+        normalized === "/auth/customer" ||
+        normalized.startsWith("/auth/customer/"));
+}
 /** Resolve Better Auth's standard cross-subdomain cookie policy for Node hosts. */
 export function buildBetterAuthCookieAdvancedOptions(env) {
     const domain = env.AUTH_COOKIE_DOMAIN?.trim();
@@ -147,7 +163,21 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
             });
         }
     });
-    auth.onError((err, c) => handleApiError(err, c, { reporter: runtimeOptions.reporter, appName: runtimeOptions.appName }));
+    auth.onError((err, c) => {
+        // A storefront customer-auth resolution failure is a client-side auth
+        // failure (missing/invalid storefront key or a disallowed origin), not a
+        // server fault. Translate it into a clean 401/403 with a stable, non-leaky
+        // body instead of letting it fall through to `handleApiError`'s 500. The
+        // catch is narrowed to this error type so genuine server faults still 500.
+        if (err instanceof StorefrontCustomerAuthResolutionError) {
+            c.header("Cache-Control", "no-store");
+            return c.json({ error: err.code }, err.status);
+        }
+        return handleApiError(err, c, {
+            reporter: runtimeOptions.reporter,
+            appName: runtimeOptions.appName,
+        });
+    });
     const DEFAULT_APP_URL = "http://localhost:3300";
     const CLOUD_BETTER_AUTH_ALLOWLIST = new Set([
         "/auth/get-session",
@@ -404,7 +434,14 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
             : defaultCustomerAuthContext(env, parseCustomerAuthPolicy(env));
         const baseURL = requireCanonicalOrigin(context.baseURL, "customer auth baseURL");
         const publicApiBaseURL = requirePublicApiBaseUrl(context.publicApiBaseURL ?? `${baseURL}/api`, baseURL);
-        const trustedOrigins = context.trustedOrigins.map((origin) => requireCanonicalOrigin(origin, "customer auth trusted origin"));
+        // Fold the resolved storefront's trusted origins together with the static
+        // env allowlist so a cross-origin customer-auth call from any allowed
+        // storefront origin is trusted by Better Auth (WORK: direct-client support).
+        // Wildcard (`https://*.host`) entries pass through untouched — Better Auth
+        // matches them natively; every other entry must be a canonical origin.
+        const trustedOrigins = [...new Set([...context.trustedOrigins, ...getTrustedOrigins(env)])].map((origin) => isCustomerWildcardOrigin(origin)
+            ? origin
+            : requireCanonicalOrigin(origin, "customer auth trusted origin"));
         const invitationAcceptBaseURL = context.invitationAcceptBaseURL
             ? requireCanonicalOrigin(context.invitationAcceptBaseURL, "customer invitation accept baseURL")
             : undefined;
@@ -416,6 +453,13 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
             ...(invitationAcceptBaseURL ? { invitationAcceptBaseURL } : {}),
         };
     }
+    /** A single-label `https://*.host` wildcard trusted-origin declaration. */
+    function isCustomerWildcardOrigin(value) {
+        if (!value.startsWith("https://*."))
+            return false;
+        const host = value.slice("https://*.".length);
+        return host.length > 0 && !host.includes("*") && !host.includes("/") && !host.includes(":");
+    }
     function requireCanonicalOrigin(value, label) {
         let parsed;
         try {
@@ -632,9 +676,22 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
         }
         const { db, dispose } = openDatabase(env);
         try {
-            const customerContext = customerSurface
-                ? await resolveCustomerAuthContext(env, request)
-                : null;
+            // A storefront customer-auth resolution failure on `/v1/public/*` (missing/
+            // unknown/revoked key or a disallowed origin) is a client-side auth failure,
+            // not a server fault: resolve it to "unauthorized" (null) so the framework
+            // returns 401 instead of letting it surface as a 500. Genuine faults still
+            // throw. Mirrors the auth handler's onError mapping for `/auth/customer/*`.
+            let customerContext = null;
+            if (customerSurface) {
+                try {
+                    customerContext = await resolveCustomerAuthContext(env, request);
+                }
+                catch (error) {
+                    if (error instanceof StorefrontCustomerAuthResolutionError)
+                        return null;
+                    throw error;
+                }
+            }
             const auth = customerSurface
                 ? await buildCustomerBetterAuth(env, db, request, customerContext ?? undefined)
                 : buildAdminBetterAuth(env, db);
@@ -738,6 +795,23 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
         const auth = await resolveAuthRequest(request, env);
         return auth !== null;
     }
+    /**
+     * Authorize a customer-realm cross-origin request for dynamic CORS. Returns
+     * the exact request origin to echo in `Access-Control-Allow-Origin`, or `null`
+     * to omit CORS headers. Only the customer surface (`/v1/public/*` and
+     * `/auth/customer/*`) is dynamically authorized; every other surface keeps the
+     * static `CORS_ALLOWLIST` behavior. The customer realm being disabled, or no
+     * authorizer being wired, yields `null` (static behavior).
+     */
+    async function resolveCustomerCorsOrigin(request, env) {
+        if (!runtimeOptions.resolveCustomerCorsOrigin)
+            return null;
+        if (env.VOYANT_CUSTOMER_AUTH_MODE?.trim() === "disabled")
+            return null;
+        if (!isCustomerCorsSurface(request.url))
+            return null;
+        return runtimeOptions.resolveCustomerCorsOrigin(env, request);
+    }
     class CurrentUserNotFoundError extends Error {
         constructor() {
             super("User not found");
@@ -1414,6 +1488,7 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
         getCurrentUserForRequest,
         hasAuthPermission,
         resolveAuthRequest,
+        resolveCustomerCorsOrigin,
         validateApiTokenAccess,
     };
 }