@wizeworks/lens-cloud 0.0.0-stage → 0.3.0-alpha.2

package/dist/auth/principal.js

@@ -0,0 +1,69 @@
+import { fromNodeHeaders } from "better-auth/node";
+import { bearerOf, fail, HttpError } from "../http/http.js";
+import { membership } from "../repo/orgs.js";
+import { keyByToken, projectInOrg } from "../repo/projects.js";
+import { can } from "./roles.js";
+/** The session of this request, read from the database each time (no cookie cache), so a revoked session stops at once. */
+export async function sessionOf(ctx) {
+    const s = await ctx.app.auth.api.getSession({ headers: fromNodeHeaders(ctx.req.headers) });
+    if (!s)
+        return undefined;
+    const { id, email, name, emailVerified } = s.user;
+    return { user: { id, email, name, emailVerified, twoFactorEnabled: !!s.user.twoFactorEnabled }, sessionId: s.session.id };
+}
+export async function principalOf(ctx) {
+    const bearer = bearerOf(ctx.req);
+    if (bearer?.startsWith("wl_rk_")) {
+        const key = await keyByToken(ctx.app.db, bearer, ctx.app.config.now());
+        return key?.kind === "read" ? { kind: "key", key } : undefined;
+    }
+    const s = await sessionOf(ctx);
+    return s ? { kind: "user", ...s } : undefined;
+}
+/** A signed-in person, or 401. Changes also need the dashboard header, so other sites cannot send them. */
+export async function requireUser(ctx) {
+    const p = await principalOf(ctx);
+    if (p?.kind !== "user")
+        return fail(401, "Sign in first.");
+    const method = ctx.req.method ?? "GET";
+    if (method !== "GET" && ctx.req.headers["x-wizelens-client"] !== "dashboard")
+        fail(403, "Missing the X-WizeLens-Client header.");
+    return p.user;
+}
+/** The caller's role in an organization, when it allows `permission`; otherwise 403 (or 404 when not a member). */
+export async function requireOrg(ctx, orgId, permission) {
+    const user = await requireUser(ctx);
+    const m = await membership(ctx.app.db, user.id, orgId);
+    if (!m)
+        fail(404, "Organization not found.");
+    if (!can(m.role, permission))
+        fail(403, `Your role (${m.role}) cannot do this.`);
+    return { user, role: m.role };
+}
+/** Access to one project's data, for a person or a read key. */
+export async function requireProject(ctx, projectId, permission = "read") {
+    const p = await principalOf(ctx);
+    if (!p)
+        return fail(401, "Sign in, or send a read key.");
+    if (p.kind === "key")
+        return keyAccess(ctx, p, projectId, permission);
+    const [row] = await ctx.app.db.query("SELECT org_id FROM projects WHERE id = $1", [projectId]);
+    const m = row ? await membership(ctx.app.db, p.user.id, row.org_id) : undefined;
+    const project = m ? await projectInOrg(ctx.app.db, m.id, projectId) : undefined;
+    if (!m || !project)
+        return fail(404, "Project not found.");
+    if (!can(m.role, permission))
+        fail(403, `Your role (${m.role}) cannot do this.`);
+    if (permission !== "read")
+        await requireUser(ctx);
+    return { project, actor: `user:${p.user.id}`, role: m.role, principal: p };
+}
+async function keyAccess(ctx, p, projectId, permission) {
+    if (permission !== "read")
+        throw new HttpError(403, "Read keys can only read.");
+    const project = p.key.projectIds.includes(projectId) ? await projectInOrg(ctx.app.db, p.key.orgId, projectId) : undefined;
+    if (!project)
+        return fail(404, "Project not found.");
+    return { project, actor: `key:${p.key.id}`, role: "viewer", principal: p };
+}
+//# sourceMappingURL=principal.js.map

package/dist/auth/principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.js","sourceRoot":"","sources":["../../src/auth/principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAe,UAAU,EAAgB,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE1F,OAAO,EAAE,GAAG,EAA8B,MAAM,YAAY,CAAC;AAK7D,2HAA2H;AAC3H,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAQ;IACtC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;IAClD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;AAC5H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAQ;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,OAAO,GAAG,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAQ;IACxC,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,WAAW;QAAE,IAAI,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC;IACjI,OAAO,CAAC,CAAC,IAAI,CAAC;AAChB,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAQ,EAAE,KAAa,EAAE,UAAsB;IAC9E,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,CAAE,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAE,CAAC,IAAI,mBAAmB,CAAC,CAAC;IACnF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAE,CAAC,IAAI,EAAE,CAAC;AACjC,CAAC;AAUD,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAQ,EAAE,SAAiB,EAAE,UAAU,GAAe,MAAM;IAC/F,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACtE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAqB,2CAA2C,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACnH,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC;IACjF,IAAI,UAAU,KAAK,MAAM;QAAE,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,CAA8B,EAAE,SAAiB,EAAE,UAAsB;IAC1G,IAAI,UAAU,KAAK,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1H,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAC7E,CAAC"}

package/dist/auth/roles.d.ts

@@ -0,0 +1,50 @@
+import { type OrgRole } from "@wizeworks/lens-core";
+/** Roles in an organization, from most to least power. */
+export declare const ROLES: readonly ["owner", "admin", "member", "viewer"];
+export type Role = OrgRole;
+export declare const isRole: (v: unknown) => v is OrgRole;
+/** Better Auth access control, built from the shared role data. */
+export declare const ac: {
+    newRole<const TRoleStatements extends import("better-auth/plugins/access").Statements>(statements: import("better-auth/plugins/access").RoleInput<{
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+        readonly project: readonly ["read", "create", "update", "delete"];
+        readonly key: readonly ["read", "create", "revoke"];
+        readonly alert: readonly ["read", "create", "update", "delete"];
+        readonly share: readonly ["create", "revoke"];
+        readonly audit: readonly ["read"];
+    }, TRoleStatements>): import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<TRoleStatements>, {
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+        readonly project: readonly ["read", "create", "update", "delete"];
+        readonly key: readonly ["read", "create", "revoke"];
+        readonly alert: readonly ["read", "create", "update", "delete"];
+        readonly share: readonly ["create", "revoke"];
+        readonly audit: readonly ["read"];
+    }>;
+    statements: {
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+        readonly project: readonly ["read", "create", "update", "delete"];
+        readonly key: readonly ["read", "create", "revoke"];
+        readonly alert: readonly ["read", "create", "update", "delete"];
+        readonly share: readonly ["create", "revoke"];
+        readonly audit: readonly ["read"];
+    };
+};
+export declare const authRoles: Record<Role, ReturnType<typeof ac.newRole>>;
+/** What our own routes check. Read: data, members. Write: alerts, shares. Manage: projects, keys, settings. Own: delete the organization. */
+export type Permission = "read" | "write" | "manage" | "own";
+export declare const can: (role: Role, permission: Permission) => boolean;
+/** An admin may not give a role above their own. */
+export declare const canGrant: (actor: Role, target: Role) => boolean;
+//# sourceMappingURL=roles.d.ts.map

package/dist/auth/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6D,KAAK,OAAO,EAAsC,MAAM,sBAAsB,CAAC;AAGnJ,0DAA0D;AAC1D,eAAO,MAAM,KAAK,iDAAY,CAAC;AAC/B,MAAM,MAAM,IAAI,GAAG,OAAO,CAAC;AAC3B,eAAO,MAAM,MAAM,8BAAY,CAAC;AAEhC,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAyC,CAAC;AACzD,eAAO,MAAM,SAAS,EAAgH,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;AAElL,6IAA6I;AAC7I,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAS7D,eAAO,MAAM,GAAG,SAAU,IAAI,cAAc,UAAU,KAAG,OAA8C,CAAC;AAExG,oDAAoD;AACpD,eAAO,MAAM,QAAQ,UAAW,IAAI,UAAU,IAAI,KAAG,OAAgD,CAAC"}

package/dist/auth/roles.js

@@ -0,0 +1,18 @@
+import { ACCESS_STATEMENTS, isOrgRole, ORG_ROLES, ROLE_GRANTS, ROLE_RANK, roleAllows } from "@wizeworks/lens-core";
+import { createAccessControl } from "better-auth/plugins/access";
+/** Roles in an organization, from most to least power. */
+export const ROLES = ORG_ROLES;
+export const isRole = isOrgRole;
+/** Better Auth access control, built from the shared role data. */
+export const ac = createAccessControl(ACCESS_STATEMENTS);
+export const authRoles = Object.fromEntries(ROLES.map((r) => [r, ac.newRole(ROLE_GRANTS[r])]));
+const NEEDS = {
+    read: { project: ["read"] },
+    write: { alert: ["create"], share: ["create"] },
+    manage: { project: ["create"], key: ["create"] },
+    own: { organization: ["delete"] },
+};
+export const can = (role, permission) => roleAllows(role, NEEDS[permission]);
+/** An admin may not give a role above their own. */
+export const canGrant = (actor, target) => ROLE_RANK[actor] >= ROLE_RANK[target];
+//# sourceMappingURL=roles.js.map

package/dist/auth/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAoB,SAAS,EAAE,SAAS,EAAgB,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACnJ,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,0DAA0D;AAC1D,MAAM,CAAC,MAAM,KAAK,GAAG,SAAS,CAAC;AAE/B,MAAM,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC;AAEhC,mEAAmE;AACnE,MAAM,CAAC,MAAM,EAAE,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAqC,CAAC,CAAC,CAAC,CAAgD,CAAC;AAKlL,MAAM,KAAK,GAAoC;IAC7C,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE;IAC3B,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE;IAC/C,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE;IAChD,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,QAAQ,CAAC,EAAE;CAClC,CAAC;AAEF,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAU,EAAE,UAAsB,EAAW,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;AAExG,oDAAoD;AACpD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAW,EAAE,MAAY,EAAW,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC"}

package/dist/auth/schema-names.d.ts

@@ -0,0 +1,130 @@
+export declare const userNames: {
+    modelName: string;
+    fields: {
+        emailVerified: string;
+        createdAt: string;
+        updatedAt: string;
+    };
+};
+export declare const sessionNames: {
+    modelName: string;
+    fields: {
+        expiresAt: string;
+        createdAt: string;
+        updatedAt: string;
+        ipAddress: string;
+        userAgent: string;
+        userId: string;
+    };
+};
+export declare const accountNames: {
+    modelName: string;
+    fields: {
+        accountId: string;
+        providerId: string;
+        userId: string;
+        accessToken: string;
+        refreshToken: string;
+        idToken: string;
+        accessTokenExpiresAt: string;
+        refreshTokenExpiresAt: string;
+        createdAt: string;
+        updatedAt: string;
+    };
+};
+export declare const verificationNames: {
+    modelName: string;
+    fields: {
+        expiresAt: string;
+        createdAt: string;
+        updatedAt: string;
+    };
+};
+export declare const rateLimitNames: {
+    modelName: string;
+    fields: {
+        lastRequest: string;
+    };
+};
+export declare const orgSchema: {
+    readonly session: {
+        readonly fields: {
+            readonly activeOrganizationId: "active_org_id";
+        };
+    };
+    readonly organization: {
+        readonly modelName: "orgs";
+        readonly fields: {
+            readonly createdAt: "created_at";
+        };
+        readonly additionalFields: {
+            readonly retentionDays: {
+                readonly type: "number";
+                readonly required: true;
+                readonly defaultValue: 30;
+                readonly input: false;
+                readonly fieldName: "retention_days";
+            };
+        };
+    };
+    readonly member: {
+        readonly modelName: "members";
+        readonly fields: {
+            readonly organizationId: "org_id";
+            readonly userId: "user_id";
+            readonly createdAt: "created_at";
+        };
+    };
+    readonly invitation: {
+        readonly modelName: "invites";
+        readonly fields: {
+            readonly organizationId: "org_id";
+            readonly expiresAt: "expires_at";
+            readonly createdAt: "created_at";
+            readonly inviterId: "inviter_id";
+        };
+    };
+};
+export declare const twoFactorSchema: {
+    user: {
+        fields: {
+            twoFactorEnabled: string;
+        };
+    };
+    twoFactor: {
+        modelName: string;
+        fields: {
+            backupCodes: string;
+            userId: string;
+            failedVerificationCount: string;
+            lockedUntil: string;
+        };
+    };
+};
+export declare const passkeySchema: {
+    passkey: {
+        modelName: string;
+        fields: {
+            publicKey: string;
+            userId: string;
+            credentialID: string;
+            deviceType: string;
+            backedUp: string;
+            createdAt: string;
+        };
+    };
+};
+export declare const ssoSchema: {
+    ssoProvider: {
+        modelName: string;
+        fields: {
+            providerId: string;
+            oidcConfig: string;
+            samlConfig: string;
+            userId: string;
+            organizationId: string;
+            domainVerified: string;
+        };
+    };
+};
+//# sourceMappingURL=schema-names.d.ts.map

package/dist/auth/schema-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-names.d.ts","sourceRoot":"","sources":["../../src/auth/schema-names.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,SAAS;IAAK,SAAS;IAAW,MAAM;QAAI,aAAa;QAAoB,SAAS;QAAgB,SAAS;;CAAkB,CAAC;AAE/I,eAAO,MAAM,YAAY;IACvB,SAAS;IACT,MAAM;QAAI,SAAS;QAAgB,SAAS;QAAgB,SAAS;QAAgB,SAAS;QAAgB,SAAS;QAAgB,MAAM;;CAC9I,CAAC;AAEF,eAAO,MAAM,YAAY;IACvB,SAAS;IACT,MAAM;QACJ,SAAS;QACT,UAAU;QACV,MAAM;QACN,WAAW;QACX,YAAY;QACZ,OAAO;QACP,oBAAoB;QACpB,qBAAqB;QACrB,SAAS;QACT,SAAS;;CAEZ,CAAC;AAEF,eAAO,MAAM,iBAAiB;IAAK,SAAS;IAAmB,MAAM;QAAI,SAAS;QAAgB,SAAS;QAAgB,SAAS;;CAAkB,CAAC;AAEvJ,eAAO,MAAM,cAAc;IAAK,SAAS;IAAiB,MAAM;QAAI,WAAW;;CAAoB,CAAC;AAEpG,eAAO,MAAM,SAAS;aACpB,OAAO;iBAAI,MAAM;qBAAI,oBAAoB,EAAE,eAAe;;;aAC1D,YAAY;iBACV,SAAS,EAAE,MAAM;iBACjB,MAAM;qBAAI,SAAS,EAAE,YAAY;;iBACjC,gBAAgB;qBAAI,aAAa;yBAAI,IAAI,EAAE,QAAQ;yBAAE,QAAQ;yBAAQ,YAAY,EAAE,EAAE;yBAAE,KAAK;yBAAS,SAAS,EAAE,gBAAgB;;;;aAElI,MAAM;iBAAI,SAAS,EAAE,SAAS;iBAAE,MAAM;qBAAI,cAAc,EAAE,QAAQ;qBAAE,MAAM,EAAE,SAAS;qBAAE,SAAS,EAAE,YAAY;;;aAC9G,UAAU;iBAAI,SAAS,EAAE,SAAS;iBAAE,MAAM;qBAAI,cAAc,EAAE,QAAQ;qBAAE,SAAS,EAAE,YAAY;qBAAE,SAAS,EAAE,YAAY;qBAAE,SAAS,EAAE,YAAY;;;CACzI,CAAC;AAEX,eAAO,MAAM,eAAe;IAC1B,IAAI;QAAI,MAAM;YAAI,gBAAgB;;;IAClC,SAAS;QACP,SAAS;QACT,MAAM;YAAI,WAAW;YAAkB,MAAM;YAAa,uBAAuB;YAA+B,WAAW;;;CAE9H,CAAC;AAEF,eAAO,MAAM,aAAa;IACxB,OAAO;QACL,SAAS;QACT,MAAM;YAAI,SAAS;YAAgB,MAAM;YAAa,YAAY;YAAmB,UAAU;YAAiB,QAAQ;YAAe,SAAS;;;CAEnJ,CAAC;AAEF,eAAO,MAAM,SAAS;IACpB,WAAW;QACT,SAAS;QACT,MAAM;YAAI,UAAU;YAAiB,UAAU;YAAiB,UAAU;YAAiB,MAAM;YAAa,cAAc;YAAY,cAAc;;;CAEzJ,CAAC"}

package/dist/auth/schema-names.js

@@ -0,0 +1,53 @@
+// Better Auth's models mapped onto our snake_case tables (db/schema-auth.ts). A test checks Better Auth finds nothing to change.
+export const userNames = { modelName: "users", fields: { emailVerified: "email_verified", createdAt: "created_at", updatedAt: "updated_at" } };
+export const sessionNames = {
+    modelName: "sessions",
+    fields: { expiresAt: "expires_at", createdAt: "created_at", updatedAt: "updated_at", ipAddress: "ip_address", userAgent: "user_agent", userId: "user_id" },
+};
+export const accountNames = {
+    modelName: "accounts",
+    fields: {
+        accountId: "account_id",
+        providerId: "provider_id",
+        userId: "user_id",
+        accessToken: "access_token",
+        refreshToken: "refresh_token",
+        idToken: "id_token",
+        accessTokenExpiresAt: "access_token_expires_at",
+        refreshTokenExpiresAt: "refresh_token_expires_at",
+        createdAt: "created_at",
+        updatedAt: "updated_at",
+    },
+};
+export const verificationNames = { modelName: "verifications", fields: { expiresAt: "expires_at", createdAt: "created_at", updatedAt: "updated_at" } };
+export const rateLimitNames = { modelName: "rate_limits", fields: { lastRequest: "last_request" } };
+export const orgSchema = {
+    session: { fields: { activeOrganizationId: "active_org_id" } },
+    organization: {
+        modelName: "orgs",
+        fields: { createdAt: "created_at" },
+        additionalFields: { retentionDays: { type: "number", required: true, defaultValue: 30, input: false, fieldName: "retention_days" } },
+    },
+    member: { modelName: "members", fields: { organizationId: "org_id", userId: "user_id", createdAt: "created_at" } },
+    invitation: { modelName: "invites", fields: { organizationId: "org_id", expiresAt: "expires_at", createdAt: "created_at", inviterId: "inviter_id" } },
+};
+export const twoFactorSchema = {
+    user: { fields: { twoFactorEnabled: "two_factor_enabled" } },
+    twoFactor: {
+        modelName: "two_factors",
+        fields: { backupCodes: "backup_codes", userId: "user_id", failedVerificationCount: "failed_verification_count", lockedUntil: "locked_until" },
+    },
+};
+export const passkeySchema = {
+    passkey: {
+        modelName: "passkeys",
+        fields: { publicKey: "public_key", userId: "user_id", credentialID: "credential_id", deviceType: "device_type", backedUp: "backed_up", createdAt: "created_at" },
+    },
+};
+export const ssoSchema = {
+    ssoProvider: {
+        modelName: "sso_providers",
+        fields: { providerId: "provider_id", oidcConfig: "oidc_config", samlConfig: "saml_config", userId: "user_id", organizationId: "org_id", domainVerified: "domain_verified" },
+    },
+};
+//# sourceMappingURL=schema-names.js.map

package/dist/auth/schema-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-names.js","sourceRoot":"","sources":["../../src/auth/schema-names.ts"],"names":[],"mappings":"AAAA,iIAAiI;AACjI,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,gBAAgB,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;AAE/I,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,SAAS,EAAE,UAAU;IACrB,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE;CAC3J,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,SAAS,EAAE,UAAU;IACrB,MAAM,EAAE;QACN,SAAS,EAAE,YAAY;QACvB,UAAU,EAAE,aAAa;QACzB,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,cAAc;QAC3B,YAAY,EAAE,eAAe;QAC7B,OAAO,EAAE,UAAU;QACnB,oBAAoB,EAAE,yBAAyB;QAC/C,qBAAqB,EAAE,0BAA0B;QACjD,SAAS,EAAE,YAAY;QACvB,SAAS,EAAE,YAAY;KACxB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;AAEvJ,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,CAAC;AAEpG,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,oBAAoB,EAAE,eAAe,EAAE,EAAE;IAC9D,YAAY,EAAE;QACZ,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE;QACnC,gBAAgB,EAAE,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE;KACrI;IACD,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE;IAClH,UAAU,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE;CAC7I,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,EAAE;IAC5D,SAAS,EAAE;QACT,SAAS,EAAE,aAAa;QACxB,MAAM,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,WAAW,EAAE,cAAc,EAAE;KAC9I;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE;QACP,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE;KACjK;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,WAAW,EAAE;QACX,SAAS,EAAE,eAAe;QAC1B,MAAM,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,EAAE,iBAAiB,EAAE;KAC5K;CACF,CAAC"}

package/dist/auth/secret.d.ts

@@ -0,0 +1,12 @@
+import type { Db } from "../db/db.js";
+export interface AuthSecret {
+    version: number;
+    value: string;
+}
+/** "value", or "2:new,1:old" to rotate (newest first). Rotating signs everyone out; encrypted 2FA data still opens with the old one. */
+export declare function parseSecrets(text: string): AuthSecret[];
+/** The configured secrets. A trial on PGlite without one gets a random secret kept in its own database; Postgres must be given one. */
+export declare function resolveSecrets(db: Db, configured: string | undefined): Promise<AuthSecret[]>;
+/** Better Auth reads these over its options; clear them so only our config counts. */
+export declare function clearAuthEnv(env?: NodeJS.ProcessEnv): void;
+//# sourceMappingURL=secret.d.ts.map

package/dist/auth/secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.d.ts","sourceRoot":"","sources":["../../src/auth/secret.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAID,wIAAwI;AACxI,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,CAQvD;AAED,uIAAuI;AACvI,wBAAsB,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAQlG;AAED,sFAAsF;AACtF,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CAEvE"}

package/dist/auth/secret.js

@@ -0,0 +1,32 @@
+import { randomBytes } from "node:crypto";
+const MIN_LENGTH = 32;
+/** "value", or "2:new,1:old" to rotate (newest first). Rotating signs everyone out; encrypted 2FA data still opens with the old one. */
+export function parseSecrets(text) {
+    const parts = text.split(",").map((s) => s.trim()).filter(Boolean);
+    const secrets = parts.map((p, i) => {
+        const m = /^(\d+):(.+)$/.exec(p);
+        return m ? { version: Number(m[1]), value: m[2] } : { version: parts.length - i, value: p };
+    });
+    if (secrets.length === 0 || secrets.some((s) => s.value.length < MIN_LENGTH))
+        throw new Error(`Each auth secret needs at least ${MIN_LENGTH} characters (try: openssl rand -base64 32).`);
+    return secrets;
+}
+/** The configured secrets. A trial on PGlite without one gets a random secret kept in its own database; Postgres must be given one. */
+export async function resolveSecrets(db, configured) {
+    if (configured)
+        return parseSecrets(configured);
+    if (db.kind === "postgres")
+        throw new Error("Set --auth-secret (or WIZELENS_CLOUD_AUTH_SECRET) to 32 or more random characters: it signs sessions and encrypts 2FA secrets.");
+    const [row] = await db.query("SELECT value FROM cloud_meta WHERE key = 'auth_secret'");
+    if (row)
+        return parseSecrets(row.value);
+    const value = randomBytes(36).toString("base64url");
+    await db.query("INSERT INTO cloud_meta (key, value) VALUES ('auth_secret', $1) ON CONFLICT (key) DO NOTHING", [value]);
+    return resolveSecrets(db, undefined);
+}
+/** Better Auth reads these over its options; clear them so only our config counts. */
+export function clearAuthEnv(env = process.env) {
+    for (const k of ["BETTER_AUTH_TELEMETRY", "BETTER_AUTH_TELEMETRY_ENDPOINT", "BETTER_AUTH_TELEMETRY_DEBUG", "BETTER_AUTH_SECRET", "BETTER_AUTH_SECRETS", "AUTH_SECRET", "BETTER_AUTH_URL"])
+        delete env[k];
+}
+//# sourceMappingURL=secret.js.map

package/dist/auth/secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../src/auth/secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAQ1C,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,wIAAwI;AACxI,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC/F,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,UAAU,6CAA6C,CAAC,CAAC;IAC1L,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,uIAAuI;AACvI,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAM,EAAE,UAA8B;IACzE,IAAI,UAAU;QAAE,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,EAAE,CAAC,IAAI,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,gIAAgI,CAAC,CAAC;IAC9K,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAoB,wDAAwD,CAAC,CAAC;IAC1G,IAAI,GAAG;QAAE,OAAO,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,EAAE,CAAC,KAAK,CAAC,6FAA6F,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACvH,OAAO,cAAc,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;AACvC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,YAAY,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC/D,KAAK,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,gCAAgC,EAAE,6BAA6B,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,aAAa,EAAE,iBAAiB,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAC3M,CAAC"}

package/dist/auth/security-notices.d.ts

@@ -0,0 +1,34 @@
+import { getSessionFromCtx } from "better-auth/api";
+import type { BetterAuthOptions } from "better-auth";
+import type { EmailContent } from "../mail/content.js";
+import * as security from "../mail/emails-security.js";
+import type { AuthDeps } from "./deps.js";
+type DbHooks = NonNullable<BetterAuthOptions["databaseHooks"]>;
+/** "Chrome on Windows". Versions are left out, so a browser update is not a new device. */
+export declare function deviceOf(ua: string | null | undefined): string;
+export declare const linksOf: (deps: Pick<AuthDeps, "publicUrl">) => security.SecurityLinks;
+/** One security notice to the person's address now. */
+export declare function sendSecurity(deps: AuthDeps, userId: string, content: (l: security.SecurityLinks) => EmailContent, to?: string): Promise<void>;
+/** Database hooks for sessions and user changes: new devices, two-step sign-in on or off, and a changed email. */
+export declare function securityDbHooks(deps: AuthDeps): Pick<DbHooks, "session" | "user">;
+/** Before a passkey goes, keep its name for the notice. */
+export declare function rememberPasskey(ctx: {
+    request?: Request;
+    body?: unknown;
+    context: {
+        adapter: {
+            findOne<T>(a: unknown): Promise<T | null>;
+        };
+    };
+}): Promise<void>;
+type AfterCtx = Parameters<typeof getSessionFromCtx>[0] & {
+    path: string;
+    request?: Request;
+    context: {
+        returned?: unknown;
+    };
+};
+/** Notices from endpoints: a changed password, a passkey added or removed, new backup codes. */
+export declare function securityAfter(deps: AuthDeps, ctx: AfterCtx): Promise<void>;
+export {};
+//# sourceMappingURL=security-notices.d.ts.map

package/dist/auth/security-notices.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-notices.d.ts","sourceRoot":"","sources":["../../src/auth/security-notices.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,QAAQ,MAAM,4BAA4B,CAAC;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG1C,KAAK,OAAO,GAAG,WAAW,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC,CAAC;AAM/D,2FAA2F;AAC3F,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAI9D;AAED,eAAO,MAAM,OAAO,SAAU,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,KAAG,QAAQ,CAAC,aAGnE,CAAC;AAEH,uDAAuD;AACvD,wBAAsB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,aAAa,KAAK,YAAY,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGnJ;AAwBD,kHAAkH;AAClH,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAAC,CAUjF;AAID,2DAA2D;AAC3D,wBAAsB,eAAe,CAAC,GAAG,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE;QAAE,OAAO,EAAE;YAAE,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;SAAE,CAAA;KAAE,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAKpK;AAED,KAAK,QAAQ,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC;AAE/H,gGAAgG;AAChG,wBAAsB,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhF"}

package/dist/auth/security-notices.js

@@ -0,0 +1,81 @@
+import { getSessionFromCtx } from "better-auth/api";
+import * as security from "../mail/emails-security.js";
+import { renderMail } from "../mail/templates.js";
+import { changeOf } from "./email-token.js";
+const BROWSERS = [[/Edg\//, "Edge"], [/OPR\//, "Opera"], [/Firefox\//, "Firefox"], [/Chrome\//, "Chrome"], [/Safari\//, "Safari"]];
+const SYSTEMS = [[/iPhone|iPad/, "iOS"], [/Android/, "Android"], [/Windows/, "Windows"], [/Mac OS X|Macintosh/, "macOS"], [/CrOS/, "ChromeOS"], [/Linux/, "Linux"]];
+/** "Chrome on Windows". Versions are left out, so a browser update is not a new device. */
+export function deviceOf(ua) {
+    const browser = BROWSERS.find(([r]) => r.test(ua ?? ""))?.[1];
+    const system = SYSTEMS.find(([r]) => r.test(ua ?? ""))?.[1];
+    return browser && system ? `${browser} on ${system}` : browser || system || "an unknown device";
+}
+export const linksOf = (deps) => ({
+    account: `${deps.publicUrl}/_wizelens/#/account`,
+    forgot: `${deps.publicUrl}/_wizelens/#/forgot-password`,
+});
+/** One security notice to the person's address now. */
+export async function sendSecurity(deps, userId, content, to) {
+    const [u] = to ? [{ email: to }] : await deps.db.query("SELECT email FROM users WHERE id = $1", [userId]);
+    if (u)
+        deps.mailer.send(renderMail(u.email, content(linksOf(deps))));
+}
+/** A sign-in on a browser and system this person never used gets a notice. The first device (sign-up) does not. */
+async function onSession(deps, s) {
+    const device = deviceOf(s.userAgent);
+    const now = Date.now();
+    const fresh = await deps.db.query("INSERT INTO known_devices (user_id, device, first_ms, last_ms) VALUES ($1, $2, $3, $3) ON CONFLICT DO NOTHING RETURNING device", [s.userId, device, now]);
+    if (fresh.length === 0)
+        return void (await deps.db.query("UPDATE known_devices SET last_ms = $3 WHERE user_id = $1 AND device = $2", [s.userId, device, now]));
+    const [n] = await deps.db.query("SELECT count(*)::int AS n FROM known_devices WHERE user_id = $1", [s.userId]);
+    if ((n?.n ?? 0) > 1)
+        await sendSecurity(deps, s.userId, (l) => security.newSignIn(l, device, s.ipAddress ?? "", now));
+}
+/** What a user update is about to change, kept until it is saved. */
+const pending = new WeakMap();
+async function onUserUpdated(deps, user, ctx) {
+    const change = ctx ? pending.get(ctx) : undefined;
+    if (!change)
+        return;
+    const now = Date.now();
+    if (typeof change.twoFactorEnabled === "boolean")
+        await sendSecurity(deps, user.id, (l) => security.twoFactorChanged(l, change.twoFactorEnabled, now));
+    const moved = changeOf(ctx?.query?.token);
+    if (typeof change.email === "string" && moved && moved.from !== user.email)
+        await sendSecurity(deps, user.id, (l) => security.emailChanged(l, user.email, now), moved.from);
+}
+/** Database hooks for sessions and user changes: new devices, two-step sign-in on or off, and a changed email. */
+export function securityDbHooks(deps) {
+    return {
+        session: { create: { after: async (s) => onSession(deps, s) } },
+        user: {
+            update: {
+                before: async (data, ctx) => void (ctx && pending.set(ctx, data)),
+                after: async (user, ctx) => onUserUpdated(deps, user, ctx),
+            },
+        },
+    };
+}
+const PASSKEY_NAMES = new WeakMap();
+/** Before a passkey goes, keep its name for the notice. */
+export async function rememberPasskey(ctx) {
+    const id = ctx.body?.id;
+    if (!ctx.request || typeof id !== "string")
+        return;
+    const row = await ctx.context.adapter.findOne({ model: "passkey", where: [{ field: "id", value: id }] });
+    PASSKEY_NAMES.set(ctx.request, row?.name ?? "");
+}
+/** Notices from endpoints: a changed password, a passkey added or removed, new backup codes. */
+export async function securityAfter(deps, ctx) {
+    const notices = {
+        "/change-password": (l, now) => security.passwordChanged(l, now),
+        "/passkey/verify-registration": (l, now) => security.passkeyChanged(l, true, ctx.context.returned?.name ?? "", now),
+        "/passkey/delete-passkey": (l, now) => security.passkeyChanged(l, false, (ctx.request && PASSKEY_NAMES.get(ctx.request)) ?? "", now),
+        "/two-factor/generate-backup-codes": (l, now) => security.backupCodesMade(l, now),
+    };
+    const make = notices[ctx.path];
+    const user = make && (await getSessionFromCtx(ctx))?.user;
+    if (make && user)
+        await sendSecurity(deps, user.id, (l) => make(l, Date.now()));
+}
+//# sourceMappingURL=security-notices.js.map

package/dist/auth/security-notices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-notices.js","sourceRoot":"","sources":["../../src/auth/security-notices.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,OAAO,KAAK,QAAQ,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAK5C,MAAM,QAAQ,GAAuB,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvJ,MAAM,OAAO,GAAuB,CAAC,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,oBAAoB,EAAE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAExL,2FAA2F;AAC3F,MAAM,UAAU,QAAQ,CAAC,EAA6B;IACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,MAAM,IAAI,mBAAmB,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAiC,EAA0B,EAAE,CAAC,CAAC;IACrF,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,sBAAsB;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,8BAA8B;CACxD,CAAC,CAAC;AAEH,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc,EAAE,MAAc,EAAE,OAAoD,EAAE,EAAW;IAClI,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAoB,uCAAuC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7H,IAAI,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,mHAAmH;AACnH,KAAK,UAAU,SAAS,CAAC,IAAc,EAAE,CAA2E;IAClH,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,gIAAgI,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7L,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,0EAA0E,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/J,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAgB,iEAAiE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9H,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;QAAE,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;AACxH,CAAC;AAED,qEAAqE;AACrE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAmC,CAAC;AAE/D,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,IAAmC,EAAE,GAAY;IAC5F,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,SAAS;QAAE,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,EAAE,MAAM,CAAC,gBAA2B,EAAE,GAAG,CAAC,CAAC,CAAC;IAClK,MAAM,KAAK,GAAG,QAAQ,CAAE,GAAG,EAAE,KAA6C,EAAE,KAAK,CAAC,CAAC;IACnF,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK;QAAE,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AAC9K,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,OAAO;QACL,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;QAC/D,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACjE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;aAC3D;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,OAAO,EAAkB,CAAC;AAEpD,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAA+G;IACnJ,MAAM,EAAE,GAAI,GAAG,CAAC,IAAqC,EAAE,EAAE,CAAC;IAC1D,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO;IACnD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAA2B,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACnI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAID,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,GAAa;IAC/D,MAAM,OAAO,GAA6E;QACxF,kBAAkB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC;QAChE,8BAA8B,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,IAAI,EAAG,GAAG,CAAC,OAAO,CAAC,QAA0C,EAAE,IAAI,IAAI,EAAE,EAAE,GAAG,CAAC;QACtJ,yBAAyB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC;QACpI,mCAAmC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC;KAClF,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC;IAC1D,IAAI,IAAI,IAAI,IAAI;QAAE,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAClF,CAAC"}

package/dist/auth/signup.d.ts

@@ -0,0 +1,23 @@
+import { type BetterAuthOptions } from "better-auth";
+import type { AuthDeps } from "./deps.js";
+type UserOptions = NonNullable<BetterAuthOptions["user"]>;
+type Validate = NonNullable<UserOptions["validateUserInfo"]>;
+export declare const SETUP_HEADER = "x-wizelens-setup-token";
+export declare const INVITE_HEADER = "x-wizelens-invite";
+/** Who may make an account: by SSO, only from a proven domain; the first needs the setup token; then the invited, or anyone with open sign-up. */
+export declare function signupGate(deps: AuthDeps): Validate;
+/** The provider proved the domain and the gate checked the email, so an SSO account starts confirmed. */
+export declare function confirmSsoEmail<U extends {
+    email: string;
+    emailVerified?: boolean;
+}>(user: U, ctx: unknown): Promise<{
+    data: U;
+} | undefined>;
+/** Runs after the new user is saved: the first account and open sign-ups get their own organization and project. */
+export declare function afterSignup(deps: AuthDeps, createOrg: (userId: string, name: string) => Promise<unknown>): (user: {
+    id: string;
+    name: string;
+    email: string;
+}, ctx: unknown) => Promise<void>;
+export {};
+//# sourceMappingURL=signup.d.ts.map

package/dist/auth/signup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signup.d.ts","sourceRoot":"","sources":["../../src/auth/signup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,iBAAiB,EAAqB,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG1C,KAAK,WAAW,GAAG,WAAW,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1D,KAAK,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAG7D,eAAO,MAAM,YAAY,2BAA2B,CAAC;AACrD,eAAO,MAAM,aAAa,sBAAsB,CAAC;AAmBjD,kJAAkJ;AAClJ,wBAAgB,UAAU,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAcnD;AAKD,yGAAyG;AACzG,wBAAsB,eAAe,CAAC,CAAC,SAAS;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,CAAA;CAAE,GAAG,SAAS,CAAC,CAKnJ;AAED,oHAAoH;AACpH,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,UACnF;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,OAAO,OAAO,KAAG,OAAO,CAAC,IAAI,CAAC,CAW9F"}