@voyant-travel/auth 0.140.3 → 0.141.1

package/dist/node-runtime.d.ts

@@ -17,6 +17,14 @@ import type { CustomerBusinessAccountOnboardingRuntimeProvider } from "./custome
 import { type CustomerBuyerAccountPolicy } from "./customer-buyer-accounts.js";
 import { type CreateBetterAuthOptions, type CustomerAuthMethods } from "./server.js";
 type OperatorAuthMode = "local" | "voyant-cloud";
+/**
+ * Whether a request targets the customer realm surface eligible for per-storefront
+ * dynamic CORS: the public storefront API (`/v1/public` + `/v1/public/*`) and the
+ * customer auth routes (`/auth/customer` + `/auth/customer/*`) a direct client
+ * hits to sign in. Tolerates an optional `/api` host prefix. Admin/dash surfaces
+ * are intentionally excluded — they keep the static `CORS_ALLOWLIST` behavior.
+ */
+export declare function isCustomerCorsSurface(requestUrl: string): boolean;
 export interface OperatorAuthNodeEnv extends NodeDatabaseEnv {
     API_BASE_URL?: string;
     APP_URL?: string;
@@ -114,6 +122,15 @@ export interface CreateOperatorAuthNodeRuntimeOptions<Env extends OperatorAuthNo
      * merchant credentials. Never derive these values from Host/X-Forwarded-Host.
      */
     resolveCustomerAuthContext?: (env: Env, request: Request) => CustomerAuthRuntimeContext | Promise<CustomerAuthRuntimeContext>;
+    /**
+     * Request-time dynamic-CORS origin authorizer for the customer realm
+     * (`/v1/public/*` + `/auth/customer/*`). Returns the exact request origin to
+     * echo in `Access-Control-Allow-Origin` when a storefront authorizes it, or
+     * `null` to omit CORS headers. Authorizes keyed requests by the presented
+     * storefront key and keyless preflight by the declared allowed origins. When
+     * unset, the customer realm keeps the static `CORS_ALLOWLIST` behavior.
+     */
+    resolveCustomerCorsOrigin?: (env: Env, request: Request) => Promise<string | null>;
 }
 export interface CustomerAuthRuntimeContext {
     /** Browser-visible proxy base used by storefront/BFF auth callbacks. */
@@ -123,6 +140,12 @@ export interface CustomerAuthRuntimeContext {
     /** Explicit trusted storefront origin used for customer invitation links and request audit. */
     invitationAcceptBaseURL?: string;
     trustedOrigins: string[];
+    /**
+     * Full declared browser origins for the resolved storefront (exact +
+     * `https://*.host` wildcard). Carried for dynamic CORS; `trustedOrigins` is
+     * the canonical-origin subset Better Auth validates.
+     */
+    allowedOrigins?: string[];
     methods: CustomerAuthMethods;
     /** Buyer capabilities are independent from identity sign-up methods. */
     accountPolicy?: CustomerBuyerAccountPolicy | null;
@@ -164,6 +187,7 @@ export declare function createOperatorAuthNodeRuntime<Env extends OperatorAuthNo
     getCurrentUserForRequest: (request: Request, env: Env) => Promise<OperatorCurrentUser | null>;
     hasAuthPermission: (request: Request, env: Env) => Promise<boolean>;
     resolveAuthRequest: (request: Request, env: Env) => Promise<VoyantResolvedSessionAuthContext | null>;
+    resolveCustomerCorsOrigin: (request: Request, env: Env) => Promise<string | null>;
     validateApiTokenAccess: (env: Env, db: VoyantDb, apiKey: SelectApikey) => Promise<boolean>;
 };
 export {};

package/dist/node-runtime.js

@@ -34,6 +34,21 @@ function classifyOperatorApiAuthSurface(requestUrl) {
         return "customer";
     return null;
 }
+/**
+ * Whether a request targets the customer realm surface eligible for per-storefront
+ * dynamic CORS: the public storefront API (`/v1/public` + `/v1/public/*`) and the
+ * customer auth routes (`/auth/customer` + `/auth/customer/*`) a direct client
+ * hits to sign in. Tolerates an optional `/api` host prefix. Admin/dash surfaces
+ * are intentionally excluded — they keep the static `CORS_ALLOWLIST` behavior.
+ */
+export function isCustomerCorsSurface(requestUrl) {
+    const pathname = new URL(requestUrl).pathname.replace(/\/+$/, "") || "/";
+    const normalized = pathname.startsWith("/api/") ? pathname.slice(4) : pathname;
+    return (normalized === "/v1/public" ||
+        normalized.startsWith("/v1/public/") ||
+        normalized === "/auth/customer" ||
+        normalized.startsWith("/auth/customer/"));
+}
 /** Resolve Better Auth's standard cross-subdomain cookie policy for Node hosts. */
 export function buildBetterAuthCookieAdvancedOptions(env) {
     const domain = env.AUTH_COOKIE_DOMAIN?.trim();
@@ -419,7 +434,14 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
             : defaultCustomerAuthContext(env, parseCustomerAuthPolicy(env));
         const baseURL = requireCanonicalOrigin(context.baseURL, "customer auth baseURL");
         const publicApiBaseURL = requirePublicApiBaseUrl(context.publicApiBaseURL ?? `${baseURL}/api`, baseURL);
-        const trustedOrigins = context.trustedOrigins.map((origin) => requireCanonicalOrigin(origin, "customer auth trusted origin"));
+        // Fold the resolved storefront's trusted origins together with the static
+        // env allowlist so a cross-origin customer-auth call from any allowed
+        // storefront origin is trusted by Better Auth (WORK: direct-client support).
+        // Wildcard (`https://*.host`) entries pass through untouched — Better Auth
+        // matches them natively; every other entry must be a canonical origin.
+        const trustedOrigins = [...new Set([...context.trustedOrigins, ...getTrustedOrigins(env)])].map((origin) => isCustomerWildcardOrigin(origin)
+            ? origin
+            : requireCanonicalOrigin(origin, "customer auth trusted origin"));
         const invitationAcceptBaseURL = context.invitationAcceptBaseURL
             ? requireCanonicalOrigin(context.invitationAcceptBaseURL, "customer invitation accept baseURL")
             : undefined;
@@ -431,6 +453,13 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
             ...(invitationAcceptBaseURL ? { invitationAcceptBaseURL } : {}),
         };
     }
+    /** A single-label `https://*.host` wildcard trusted-origin declaration. */
+    function isCustomerWildcardOrigin(value) {
+        if (!value.startsWith("https://*."))
+            return false;
+        const host = value.slice("https://*.".length);
+        return host.length > 0 && !host.includes("*") && !host.includes("/") && !host.includes(":");
+    }
     function requireCanonicalOrigin(value, label) {
         let parsed;
         try {
@@ -647,9 +676,22 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
         }
         const { db, dispose } = openDatabase(env);
         try {
-            const customerContext = customerSurface
-                ? await resolveCustomerAuthContext(env, request)
-                : null;
+            // A storefront customer-auth resolution failure on `/v1/public/*` (missing/
+            // unknown/revoked key or a disallowed origin) is a client-side auth failure,
+            // not a server fault: resolve it to "unauthorized" (null) so the framework
+            // returns 401 instead of letting it surface as a 500. Genuine faults still
+            // throw. Mirrors the auth handler's onError mapping for `/auth/customer/*`.
+            let customerContext = null;
+            if (customerSurface) {
+                try {
+                    customerContext = await resolveCustomerAuthContext(env, request);
+                }
+                catch (error) {
+                    if (error instanceof StorefrontCustomerAuthResolutionError)
+                        return null;
+                    throw error;
+                }
+            }
             const auth = customerSurface
                 ? await buildCustomerBetterAuth(env, db, request, customerContext ?? undefined)
                 : buildAdminBetterAuth(env, db);
@@ -753,6 +795,23 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
         const auth = await resolveAuthRequest(request, env);
         return auth !== null;
     }
+    /**
+     * Authorize a customer-realm cross-origin request for dynamic CORS. Returns
+     * the exact request origin to echo in `Access-Control-Allow-Origin`, or `null`
+     * to omit CORS headers. Only the customer surface (`/v1/public/*` and
+     * `/auth/customer/*`) is dynamically authorized; every other surface keeps the
+     * static `CORS_ALLOWLIST` behavior. The customer realm being disabled, or no
+     * authorizer being wired, yields `null` (static behavior).
+     */
+    async function resolveCustomerCorsOrigin(request, env) {
+        if (!runtimeOptions.resolveCustomerCorsOrigin)
+            return null;
+        if (env.VOYANT_CUSTOMER_AUTH_MODE?.trim() === "disabled")
+            return null;
+        if (!isCustomerCorsSurface(request.url))
+            return null;
+        return runtimeOptions.resolveCustomerCorsOrigin(env, request);
+    }
     class CurrentUserNotFoundError extends Error {
         constructor() {
             super("User not found");
@@ -1429,6 +1488,7 @@ export function createOperatorAuthNodeRuntime(runtimeOptions) {
         getCurrentUserForRequest,
         hasAuthPermission,
         resolveAuthRequest,
+        resolveCustomerCorsOrigin,
         validateApiTokenAccess,
     };
 }