@webtwizz/cloud 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @webtwizz/cloud
 
+## 0.2.0
+
+### Minor Changes
+
+- 038e061: Visitors only see WebTwizz names: session cookies are `__Secure-webtwizz-auth.*`, the sign-in route drops the sign-in service's own response headers, sign-in log lines say `[webtwizz-auth]`, and uploads go through the site's files address like every other file link. Visitors signed in on 0.1.0 sign in again once.
+
 ## 0.1.0
 
 - Sign-ins (`createAuth`, `createAuthClient`), plain words for every sign-in error (`authMessage`), a pooler-safe database client (`createDb`) and file uploads and links (`createFiles`).

package/README.md

@@ -48,6 +48,8 @@ npm run build
 
 Sites pin an exact version, so a release never changes a live site until WebTwizz upgrades it.
 
+The WebTwizz AI builds from its own copy of AI_GUIDE.md. After a release, run `npm run cloud:sync <version>` in the ai-service so new sites get that version and its guide.
+
 ## License
 
 MIT

package/dist/chunk-7EXXDRMF.js

@@ -0,0 +1,376 @@
+// node_modules/@neondatabase/auth/dist/better-auth-helpers-DlzEQzcv.mjs
+import { AuthApiError, AuthError, isAuthApiError, isAuthError } from "@supabase/auth-js";
+var SESSION_CACHE_TTL_MS = 6e4;
+var CLOCK_SKEW_BUFFER_MS = 1e4;
+var NEON_AUTH_SESSION_VERIFIER_PARAM_NAME = "neon_auth_session_verifier";
+var NEON_AUTH_POPUP_PARAM_NAME = "neon_popup";
+var NEON_AUTH_POPUP_CALLBACK_PARAM_NAME = "neon_popup_callback";
+var NEON_AUTH_POPUP_CALLBACK_ROUTE = "/auth/callback";
+var OAUTH_POPUP_MESSAGE_TYPE = "neon-auth:oauth-complete";
+var AuthErrorCode = {
+  BadJwt: "bad_jwt",
+  InvalidCredentials: "invalid_credentials",
+  SessionExpired: "session_expired",
+  SessionNotFound: "session_not_found",
+  InvalidGrant: "invalid_grant",
+  UserNotFound: "user_not_found",
+  UserAlreadyExists: "user_already_exists",
+  EmailExists: "email_exists",
+  PhoneExists: "phone_exists",
+  EmailNotConfirmed: "email_not_confirmed",
+  PhoneNotConfirmed: "phone_not_confirmed",
+  ValidationFailed: "validation_failed",
+  BadJson: "bad_json",
+  WeakPassword: "weak_password",
+  EmailAddressInvalid: "email_address_invalid",
+  FeatureNotSupported: "feature_not_supported",
+  NotImplemented: "not_implemented",
+  OAuthProviderNotSupported: "oauth_provider_not_supported",
+  PhoneProviderDisabled: "phone_provider_disabled",
+  MagicLinkNotSupported: "magic_link_not_supported",
+  SsoProviderDisabled: "sso_provider_disabled",
+  AnonymousProviderDisabled: "anonymous_provider_disabled",
+  Web3ProviderDisabled: "web3_provider_disabled",
+  BadOAuthCallback: "bad_oauth_callback",
+  OAuthCallbackFailed: "oauth_callback_failed",
+  OverRequestRateLimit: "over_request_rate_limit",
+  OverEmailSendRateLimit: "over_email_send_rate_limit",
+  OverSmsSendRateLimit: "over_sms_send_rate_limit",
+  UnexpectedFailure: "unexpected_failure",
+  InternalError: "internal_error",
+  IdentityNotFound: "identity_not_found",
+  UnknownError: "unknown_error"
+};
+var ERROR_DEFINITIONS = {
+  [AuthErrorCode.BadJwt]: {
+    code: AuthErrorCode.BadJwt,
+    status: 401,
+    message: "Invalid or expired session token",
+    description: "The JWT token is malformed, expired, or has an invalid signature"
+  },
+  [AuthErrorCode.InvalidCredentials]: {
+    code: AuthErrorCode.InvalidCredentials,
+    status: 401,
+    message: "Invalid email or password",
+    description: "The provided credentials do not match any user account"
+  },
+  [AuthErrorCode.SessionExpired]: {
+    code: AuthErrorCode.SessionExpired,
+    status: 401,
+    message: "Session has expired",
+    description: "The user session has exceeded its timeout period"
+  },
+  [AuthErrorCode.SessionNotFound]: {
+    code: AuthErrorCode.SessionNotFound,
+    status: 401,
+    message: "No active session found",
+    description: "The user does not have an active session or the session was invalidated"
+  },
+  [AuthErrorCode.InvalidGrant]: {
+    code: AuthErrorCode.InvalidGrant,
+    status: 401,
+    message: "Invalid authorization grant",
+    description: "OAuth/OIDC grant validation failed"
+  },
+  [AuthErrorCode.UserNotFound]: {
+    code: AuthErrorCode.UserNotFound,
+    status: 404,
+    message: "User not found",
+    description: "No user exists with the provided identifier"
+  },
+  [AuthErrorCode.UserAlreadyExists]: {
+    code: AuthErrorCode.UserAlreadyExists,
+    status: 409,
+    message: "User already exists",
+    description: "A user with this email or phone number is already registered"
+  },
+  [AuthErrorCode.EmailExists]: {
+    code: AuthErrorCode.EmailExists,
+    status: 409,
+    message: "Email address already registered",
+    description: "This email address is already associated with an account"
+  },
+  [AuthErrorCode.PhoneExists]: {
+    code: AuthErrorCode.PhoneExists,
+    status: 409,
+    message: "Phone number already registered",
+    description: "This phone number is already associated with an account"
+  },
+  [AuthErrorCode.EmailNotConfirmed]: {
+    code: AuthErrorCode.EmailNotConfirmed,
+    status: 422,
+    message: "Email verification required",
+    description: "The user must verify their email before signing in"
+  },
+  [AuthErrorCode.PhoneNotConfirmed]: {
+    code: AuthErrorCode.PhoneNotConfirmed,
+    status: 422,
+    message: "Phone verification required",
+    description: "The user must verify their phone number before signing in"
+  },
+  [AuthErrorCode.ValidationFailed]: {
+    code: AuthErrorCode.ValidationFailed,
+    status: 400,
+    message: "Invalid request parameters",
+    description: "One or more request parameters are invalid or missing"
+  },
+  [AuthErrorCode.BadJson]: {
+    code: AuthErrorCode.BadJson,
+    status: 400,
+    message: "Invalid JSON in request body",
+    description: "The request body contains malformed JSON"
+  },
+  [AuthErrorCode.WeakPassword]: {
+    code: AuthErrorCode.WeakPassword,
+    status: 400,
+    message: "Password does not meet security requirements",
+    description: "The password is too weak or does not meet complexity requirements"
+  },
+  [AuthErrorCode.EmailAddressInvalid]: {
+    code: AuthErrorCode.EmailAddressInvalid,
+    status: 400,
+    message: "Invalid email address format",
+    description: "The provided email address is not in a valid format"
+  },
+  [AuthErrorCode.FeatureNotSupported]: {
+    code: AuthErrorCode.FeatureNotSupported,
+    status: 403,
+    message: "Feature not available",
+    description: "This feature is not supported in the current configuration"
+  },
+  [AuthErrorCode.NotImplemented]: {
+    code: AuthErrorCode.NotImplemented,
+    status: 501,
+    message: "Feature not implemented",
+    description: "This feature has not been implemented yet"
+  },
+  [AuthErrorCode.OAuthProviderNotSupported]: {
+    code: AuthErrorCode.OAuthProviderNotSupported,
+    status: 403,
+    message: "OAuth provider not supported",
+    description: "The requested OAuth provider is not enabled"
+  },
+  [AuthErrorCode.PhoneProviderDisabled]: {
+    code: AuthErrorCode.PhoneProviderDisabled,
+    status: 403,
+    message: "Phone authentication not available",
+    description: "Phone number authentication is not enabled"
+  },
+  [AuthErrorCode.MagicLinkNotSupported]: {
+    code: AuthErrorCode.MagicLinkNotSupported,
+    status: 403,
+    message: "Magic link authentication not available",
+    description: "Magic link authentication is not supported"
+  },
+  [AuthErrorCode.SsoProviderDisabled]: {
+    code: AuthErrorCode.SsoProviderDisabled,
+    status: 403,
+    message: "SSO not supported",
+    description: "Enterprise SSO authentication is not available"
+  },
+  [AuthErrorCode.AnonymousProviderDisabled]: {
+    code: AuthErrorCode.AnonymousProviderDisabled,
+    status: 403,
+    message: "Anonymous authentication not available",
+    description: "Anonymous sign-in is not enabled"
+  },
+  [AuthErrorCode.Web3ProviderDisabled]: {
+    code: AuthErrorCode.Web3ProviderDisabled,
+    status: 403,
+    message: "Web3 authentication not supported",
+    description: "Web3/blockchain authentication is not available"
+  },
+  [AuthErrorCode.BadOAuthCallback]: {
+    code: AuthErrorCode.BadOAuthCallback,
+    status: 400,
+    message: "Invalid OAuth callback",
+    description: "The OAuth callback request is missing required parameters"
+  },
+  [AuthErrorCode.OAuthCallbackFailed]: {
+    code: AuthErrorCode.OAuthCallbackFailed,
+    status: 500,
+    message: "OAuth authentication failed",
+    description: "The OAuth callback completed but no session was created"
+  },
+  [AuthErrorCode.OverRequestRateLimit]: {
+    code: AuthErrorCode.OverRequestRateLimit,
+    status: 429,
+    message: "Too many requests",
+    description: "Rate limit exceeded. Please try again later"
+  },
+  [AuthErrorCode.OverEmailSendRateLimit]: {
+    code: AuthErrorCode.OverEmailSendRateLimit,
+    status: 429,
+    message: "Too many email requests",
+    description: "Too many emails sent. Please wait before trying again"
+  },
+  [AuthErrorCode.OverSmsSendRateLimit]: {
+    code: AuthErrorCode.OverSmsSendRateLimit,
+    status: 429,
+    message: "Too many SMS requests",
+    description: "Too many SMS messages sent. Please wait before trying again"
+  },
+  [AuthErrorCode.UnexpectedFailure]: {
+    code: AuthErrorCode.UnexpectedFailure,
+    status: 500,
+    message: "An unexpected error occurred",
+    description: "The server encountered an unexpected condition"
+  },
+  [AuthErrorCode.InternalError]: {
+    code: AuthErrorCode.InternalError,
+    status: 500,
+    message: "Internal server error",
+    description: "An internal error occurred while processing the request"
+  },
+  [AuthErrorCode.IdentityNotFound]: {
+    code: AuthErrorCode.IdentityNotFound,
+    status: 404,
+    message: "Identity not found",
+    description: "The requested user identity does not exist"
+  },
+  [AuthErrorCode.UnknownError]: {
+    code: AuthErrorCode.UnknownError,
+    status: 500,
+    message: "An unknown error occurred",
+    description: "The error could not be categorized"
+  }
+};
+function getErrorDefinition(code) {
+  return ERROR_DEFINITIONS[code];
+}
+var BETTER_AUTH_ERROR_MAP = {
+  "INVALID_EMAIL_OR_PASSWORD": AuthErrorCode.InvalidCredentials,
+  "INVALID_PASSWORD": AuthErrorCode.InvalidCredentials,
+  "INVALID_EMAIL": AuthErrorCode.EmailAddressInvalid,
+  "USER_NOT_FOUND": AuthErrorCode.UserNotFound,
+  "INVALID_TOKEN": AuthErrorCode.BadJwt,
+  "SESSION_EXPIRED": AuthErrorCode.SessionExpired,
+  "FAILED_TO_GET_SESSION": AuthErrorCode.SessionNotFound,
+  "USER_ALREADY_EXISTS": AuthErrorCode.UserAlreadyExists,
+  "EMAIL_NOT_VERIFIED": AuthErrorCode.EmailNotConfirmed,
+  "USER_EMAIL_NOT_FOUND": AuthErrorCode.UserNotFound,
+  "PASSWORD_TOO_SHORT": AuthErrorCode.WeakPassword,
+  "PASSWORD_TOO_LONG": AuthErrorCode.WeakPassword,
+  "USER_ALREADY_HAS_PASSWORD": AuthErrorCode.ValidationFailed,
+  "CREDENTIAL_ACCOUNT_NOT_FOUND": AuthErrorCode.IdentityNotFound,
+  "FAILED_TO_UNLINK_LAST_ACCOUNT": AuthErrorCode.ValidationFailed,
+  "ACCOUNT_NOT_FOUND": AuthErrorCode.IdentityNotFound,
+  "SOCIAL_ACCOUNT_ALREADY_LINKED": AuthErrorCode.ValidationFailed,
+  "PROVIDER_NOT_FOUND": AuthErrorCode.OAuthProviderNotSupported,
+  "ID_TOKEN_NOT_SUPPORTED": AuthErrorCode.FeatureNotSupported,
+  "FAILED_TO_CREATE_USER": AuthErrorCode.InternalError,
+  "FAILED_TO_CREATE_SESSION": AuthErrorCode.InternalError,
+  "FAILED_TO_UPDATE_USER": AuthErrorCode.InternalError,
+  "EMAIL_CAN_NOT_BE_UPDATED": AuthErrorCode.FeatureNotSupported
+};
+var STATUS_CODE_ERROR_MAP = {
+  400: AuthErrorCode.ValidationFailed,
+  401: AuthErrorCode.BadJwt,
+  403: AuthErrorCode.FeatureNotSupported,
+  404: AuthErrorCode.UserNotFound,
+  409: AuthErrorCode.UserAlreadyExists,
+  422: AuthErrorCode.ValidationFailed,
+  429: AuthErrorCode.OverRequestRateLimit,
+  500: AuthErrorCode.UnexpectedFailure,
+  501: AuthErrorCode.NotImplemented,
+  503: AuthErrorCode.FeatureNotSupported
+};
+function normalizeBetterAuthError(error) {
+  if (error !== null && error !== void 0 && typeof error === "object" && "status" in error && "statusText" in error) {
+    const betterError = error;
+    const status = betterError.status;
+    if ("code" in betterError && betterError.code && typeof betterError.code === "string") {
+      const mappedCode = BETTER_AUTH_ERROR_MAP[betterError.code];
+      if (mappedCode) {
+        const def$2 = getErrorDefinition(mappedCode);
+        return createNormalizedError(def$2.message, def$2.status, def$2.code, status);
+      }
+    }
+    const def$1 = getErrorDefinition(mapStatusCodeToErrorCode(status, betterError.message || betterError.statusText));
+    return createNormalizedError(betterError.message || def$1.message, status, def$1.code, status);
+  }
+  if (error instanceof Error) {
+    const def$1 = getErrorDefinition(mapMessageToErrorCode(error.message));
+    return createNormalizedError(error.message || def$1.message, def$1.status, def$1.code, def$1.status);
+  }
+  const def = getErrorDefinition(AuthErrorCode.UnknownError);
+  return new AuthError(def.message, def.status, def.code);
+}
+function mapStatusCodeToErrorCode(status, message) {
+  const lowerMessage = message?.toLowerCase() || "";
+  switch (status) {
+    case 401:
+      if (lowerMessage.includes("token") || lowerMessage.includes("jwt")) return AuthErrorCode.BadJwt;
+      if (lowerMessage.includes("session")) return AuthErrorCode.SessionNotFound;
+      if (lowerMessage.includes("expired")) return AuthErrorCode.SessionExpired;
+      return AuthErrorCode.InvalidCredentials;
+    case 404:
+      if (lowerMessage.includes("identity") || lowerMessage.includes("account")) return AuthErrorCode.IdentityNotFound;
+      if (lowerMessage.includes("session")) return AuthErrorCode.SessionNotFound;
+      return AuthErrorCode.UserNotFound;
+    case 409:
+      if (lowerMessage.includes("email")) return AuthErrorCode.EmailExists;
+      if (lowerMessage.includes("phone")) return AuthErrorCode.PhoneExists;
+      return AuthErrorCode.UserAlreadyExists;
+    case 422:
+      if (lowerMessage.includes("email") && lowerMessage.includes("confirm")) return AuthErrorCode.EmailNotConfirmed;
+      if (lowerMessage.includes("phone") && lowerMessage.includes("confirm")) return AuthErrorCode.PhoneNotConfirmed;
+      return AuthErrorCode.ValidationFailed;
+    case 429:
+      if (lowerMessage.includes("email")) return AuthErrorCode.OverEmailSendRateLimit;
+      if (lowerMessage.includes("sms") || lowerMessage.includes("phone")) return AuthErrorCode.OverSmsSendRateLimit;
+      return AuthErrorCode.OverRequestRateLimit;
+    case 400:
+      if (lowerMessage.includes("password") && lowerMessage.includes("weak")) return AuthErrorCode.WeakPassword;
+      if (lowerMessage.includes("email") && lowerMessage.includes("invalid")) return AuthErrorCode.EmailAddressInvalid;
+      if (lowerMessage.includes("json")) return AuthErrorCode.BadJson;
+      if (lowerMessage.includes("oauth") || lowerMessage.includes("callback")) return AuthErrorCode.BadOAuthCallback;
+      return AuthErrorCode.ValidationFailed;
+    case 403:
+      if (lowerMessage.includes("provider") || lowerMessage.includes("oauth")) return AuthErrorCode.OAuthProviderNotSupported;
+      if (lowerMessage.includes("phone")) return AuthErrorCode.PhoneProviderDisabled;
+      if (lowerMessage.includes("sso")) return AuthErrorCode.SsoProviderDisabled;
+      return AuthErrorCode.FeatureNotSupported;
+    case 501:
+      return AuthErrorCode.NotImplemented;
+    case 503:
+      return AuthErrorCode.FeatureNotSupported;
+    default:
+      if (lowerMessage.includes("oauth")) return AuthErrorCode.OAuthCallbackFailed;
+      return AuthErrorCode.UnexpectedFailure;
+  }
+}
+function mapMessageToErrorCode(message) {
+  const lower = message.toLowerCase();
+  if (lower.includes("invalid login") || lower.includes("incorrect") || lower.includes("wrong password")) return AuthErrorCode.InvalidCredentials;
+  if (lower.includes("token") && (lower.includes("invalid") || lower.includes("expired"))) return AuthErrorCode.BadJwt;
+  if (lower.includes("session") && lower.includes("expired")) return AuthErrorCode.SessionExpired;
+  if (lower.includes("session") && lower.includes("not found")) return AuthErrorCode.SessionNotFound;
+  if (lower.includes("already exists") || lower.includes("already registered")) return AuthErrorCode.UserAlreadyExists;
+  if (lower.includes("not found") && lower.includes("user")) return AuthErrorCode.UserNotFound;
+  if (lower.includes("not found") && lower.includes("identity")) return AuthErrorCode.IdentityNotFound;
+  if (lower.includes("email") && lower.includes("not confirmed")) return AuthErrorCode.EmailNotConfirmed;
+  if (lower.includes("phone") && lower.includes("not confirmed")) return AuthErrorCode.PhoneNotConfirmed;
+  if (lower.includes("weak password") || lower.includes("password") && lower.includes("requirements")) return AuthErrorCode.WeakPassword;
+  if (lower.includes("email") && lower.includes("invalid")) return AuthErrorCode.EmailAddressInvalid;
+  if (lower.includes("rate limit") || lower.includes("too many requests")) return AuthErrorCode.OverRequestRateLimit;
+  if (lower.includes("oauth") && lower.includes("failed")) return AuthErrorCode.OAuthCallbackFailed;
+  if (lower.includes("provider") && lower.includes("not supported")) return AuthErrorCode.OAuthProviderNotSupported;
+  return AuthErrorCode.UnexpectedFailure;
+}
+function createNormalizedError(message, targetStatus, code, _originalStatus) {
+  const status = targetStatus;
+  if (status !== 500 && status !== 501 && status !== 503) return new AuthApiError(message, status, code);
+  return new AuthError(message, status, code);
+}
+
+export {
+  SESSION_CACHE_TTL_MS,
+  CLOCK_SKEW_BUFFER_MS,
+  NEON_AUTH_SESSION_VERIFIER_PARAM_NAME,
+  NEON_AUTH_POPUP_PARAM_NAME,
+  NEON_AUTH_POPUP_CALLBACK_PARAM_NAME,
+  NEON_AUTH_POPUP_CALLBACK_ROUTE,
+  OAUTH_POPUP_MESSAGE_TYPE,
+  normalizeBetterAuthError
+};