@wizeworks/lens-cloud 0.3.0-alpha.1 → 0.3.0-alpha.2

package/dist/auth/deps.d.ts

@@ -0,0 +1,27 @@
+import type { SignupMode } from "../config.js";
+import type { Db } from "../db/db.js";
+import type { Mailer } from "../mail/mailer.js";
+import type { AuthSecret } from "./secret.js";
+/** What the Better Auth setup needs from the cloud. */
+export interface AuthDeps {
+    db: Db;
+    /** The cloud's own origin, for links and passkeys, for example https://lens.example.com. */
+    publicUrl: string;
+    /** Origins allowed to send changes: the public one (and its 127.0.0.1 twin for a local default). */
+    trustedOrigins: string[];
+    /** Identity provider origins the cloud may fetch OIDC settings from (`--sso-origins`). */
+    ssoOrigins: string[];
+    secrets: AuthSecret[];
+    signup: SignupMode;
+    mailer: Mailer;
+    /** The first account's one-time token: null once an account exists. */
+    setup: {
+        token(): string | null;
+        done(): void;
+    };
+    checkPwned: boolean;
+    retentionDays: number;
+}
+/** A link into the dashboard. Tokens go in the hash, so they never reach a server log. */
+export declare const appLink: (deps: Pick<AuthDeps, "publicUrl">, route: string, token: string) => string;
+//# sourceMappingURL=deps.d.ts.map

package/dist/auth/deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../../src/auth/deps.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,uDAAuD;AACvD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,EAAE,CAAC;IACP,4FAA4F;IAC5F,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,0FAA0F;IAC1F,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,KAAK,EAAE;QAAE,KAAK,IAAI,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,IAAI,IAAI,CAAA;KAAE,CAAC;IAChD,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,0FAA0F;AAC1F,eAAO,MAAM,OAAO,SAAU,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,SAAS,MAAM,SAAS,MAAM,KAAG,MACb,CAAC"}

package/dist/auth/deps.js

@@ -0,0 +1,3 @@
+/** A link into the dashboard. Tokens go in the hash, so they never reach a server log. */
+export const appLink = (deps, route, token) => `${deps.publicUrl}/_wizelens/#/${route}?token=${encodeURIComponent(token)}`;
+//# sourceMappingURL=deps.js.map

package/dist/auth/deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps.js","sourceRoot":"","sources":["../../src/auth/deps.ts"],"names":[],"mappings":"AAuBA,0FAA0F;AAC1F,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAiC,EAAE,KAAa,EAAE,KAAa,EAAU,EAAE,CACjG,GAAG,IAAI,CAAC,SAAS,gBAAgB,KAAK,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC"}

package/dist/auth/email-token.d.ts

@@ -0,0 +1,8 @@
+/** The current email in a confirm link (a JWT Better Auth checks itself), when the link changes the email. */
+export declare function emailChangeOf(token: unknown): string | undefined;
+/** Both addresses of an email-change link: `from` is the address before the change. */
+export declare function changeOf(token: unknown): {
+    from: string;
+    to: string;
+} | undefined;
+//# sourceMappingURL=email-token.d.ts.map

package/dist/auth/email-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-token.d.ts","sourceRoot":"","sources":["../../src/auth/email-token.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEhE;AAED,uFAAuF;AACvF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAOjF"}

package/dist/auth/email-token.js

@@ -0,0 +1,15 @@
+/** The current email in a confirm link (a JWT Better Auth checks itself), when the link changes the email. */
+export function emailChangeOf(token) {
+    return changeOf(token)?.from;
+}
+/** Both addresses of an email-change link: `from` is the address before the change. */
+export function changeOf(token) {
+    try {
+        const payload = JSON.parse(Buffer.from(String(token).split(".")[1] ?? "", "base64url").toString("utf8"));
+        return typeof payload.updateTo === "string" && typeof payload.email === "string" ? { from: payload.email, to: payload.updateTo } : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=email-token.js.map

package/dist/auth/email-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-token.js","sourceRoot":"","sources":["../../src/auth/email-token.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;AAC/B,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4C,CAAC;QACpJ,OAAO,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/I,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/auth/hooks.d.ts

@@ -0,0 +1,4 @@
+import type { BetterAuthOptions } from "better-auth";
+import type { AuthDeps } from "./deps.js";
+export declare function authHooks(deps: AuthDeps): BetterAuthOptions["hooks"];
+//# sourceMappingURL=hooks.d.ts.map

package/dist/auth/hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../src/auth/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AA2H1C,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAWpE"}

package/dist/auth/hooks.js

@@ -0,0 +1,143 @@
+import { APIError, createAuthMiddleware, getSessionFromCtx, isAPIError } from "better-auth/api";
+import { isOrgRole } from "@wizeworks/lens-core";
+import { audit } from "../repo/audit.js";
+import { emailChangeOf } from "./email-token.js";
+import { isLegacyHash } from "./password.js";
+import { rememberPasskey, securityAfter } from "./security-notices.js";
+const ROLE_PATHS = new Set(["/organization/invite-member", "/organization/update-member-role", "/organization/add-member"]);
+const NEEDS_ORG = new Set(["/organization/invite-member", "/organization/update-member-role", "/organization/remove-member", "/organization/update", "/organization/leave"]);
+/** Organization changes, as our audit log names them. */
+const AUDITED = {
+    "/organization/update": "org.update",
+    "/organization/invite-member": "member.invite",
+    "/organization/cancel-invitation": "invite.cancel",
+    "/organization/accept-invitation": "member.join",
+    "/organization/remove-member": "member.remove",
+    "/organization/update-member-role": "member.role",
+    "/organization/leave": "member.leave",
+};
+const SECRET_KEYS = ["password", "newPassword", "currentPassword", "token", "code", "invitationId"];
+/** SSO provider changes, as our audit log names them. Their bodies hold client secrets, so only names go in. */
+const SSO_AUDITED = {
+    "/sso/register": "sso.create",
+    "/sso/update-provider": "sso.update",
+    "/sso/delete-provider": "sso.delete",
+    "/sso/verify-domain": "sso.verify",
+};
+/** The organization of the provider a request changes, found before the change (a deleted provider is gone after). */
+const ssoOrgOf = new WeakMap();
+/** The email of a member being removed, found before the row is gone, so the notice can name them. */
+const removedEmailOf = new WeakMap();
+async function rememberRemoved(ctx, body) {
+    const target = str(body.memberIdOrEmail);
+    if (!ctx.request || !target)
+        return;
+    if (target.includes("@"))
+        return void removedEmailOf.set(ctx.request, target);
+    const [row] = await ctx.context.adapter.findMany({ model: "member", where: [{ field: "id", value: target }], limit: 1 });
+    const found = row && (await ctx.context.internalAdapter.findUserById(row.userId));
+    if (found)
+        removedEmailOf.set(ctx.request, found.email);
+}
+const str = (v) => (typeof v === "string" ? v : undefined);
+/** Better Auth signs in whoever opens an email-change link; with 2FA on, that must happen on a device already signed in. */
+async function guardEmailChange(ctx) {
+    const email = emailChangeOf(ctx.query?.token);
+    if (!email || (await getSessionFromCtx(ctx)))
+        return;
+    const found = await ctx.context.internalAdapter.findUserByEmail(email);
+    if (found?.user?.twoFactorEnabled)
+        throw new APIError("UNAUTHORIZED", { message: "Sign in on this device first, then open the link again." });
+}
+/** SSO providers belong to an organization and have a DNS-safe id; OIDC keeps PKCE and SAML wants signed assertions. New ones say so outright. */
+function guardSso(path, body) {
+    const create = path === "/sso/register";
+    if (create && !str(body.organizationId))
+        throw new APIError("BAD_REQUEST", { message: "Send organizationId: SSO providers belong to an organization." });
+    if (create && !/^[a-z0-9][a-z0-9-]{1,39}$/.test(str(body.providerId) ?? ""))
+        throw new APIError("BAD_REQUEST", { message: "The provider id is 2 to 40 lowercase letters, digits, and dashes." });
+    const oidc = body.oidcConfig;
+    const saml = body.samlConfig;
+    if (oidc && (create ? oidc.pkce !== true : oidc.pkce === false))
+        throw new APIError("BAD_REQUEST", { message: "OIDC providers must use PKCE." });
+    if (saml && (create ? saml.wantAssertionsSigned !== true : saml.wantAssertionsSigned === false))
+        throw new APIError("BAD_REQUEST", { message: "SAML providers must sign assertions." });
+}
+async function rememberSsoOrg(ctx, body) {
+    const providerId = str(body.providerId);
+    if (!ctx.request || !providerId)
+        return;
+    const row = await ctx.context.adapter.findOne({ model: "ssoProvider", where: [{ field: "providerId", value: providerId }] });
+    const orgId = str(body.organizationId) ?? row?.organizationId ?? undefined;
+    if (orgId)
+        ssoOrgOf.set(ctx.request, orgId);
+}
+/** One known role per member, the organization always named (never "the active one"), and a password to delete an account. */
+const guard = async (ctx) => {
+    if (ctx.path === "/verify-email")
+        return guardEmailChange(ctx);
+    if (ctx.path === "/passkey/delete-passkey")
+        return rememberPasskey(ctx);
+    if (SSO_AUDITED[ctx.path]) {
+        guardSso(ctx.path, (ctx.body ?? {}));
+        return rememberSsoOrg(ctx, (ctx.body ?? {}));
+    }
+    const body = (ctx.body ?? {});
+    if (ROLE_PATHS.has(ctx.path) && body.role !== undefined && !isOrgRole(body.role))
+        throw new APIError("BAD_REQUEST", { message: "Pick one role: owner, admin, member, or viewer." });
+    if (NEEDS_ORG.has(ctx.path) && !str(body.organizationId))
+        throw new APIError("BAD_REQUEST", { message: "Send organizationId." });
+    if (ctx.path === "/delete-user" && !str(body.password) && !str(body.token))
+        throw new APIError("BAD_REQUEST", { message: "Enter your password." });
+    if (ctx.path === "/organization/remove-member")
+        await rememberRemoved(ctx, body);
+};
+/** A successful sign-in with an old hash stores a new one. */
+async function upgradeHash(ctx) {
+    const body = ctx.body;
+    if (typeof body.email !== "string" || typeof body.password !== "string")
+        return;
+    const found = await ctx.context.internalAdapter.findUserByEmail(body.email);
+    const account = found && (await ctx.context.internalAdapter.findCredentialAccount(found.user.id));
+    if (found && account?.password && isLegacyHash(account.password))
+        await ctx.context.internalAdapter.updatePassword(found.user.id, await ctx.context.password.hash(body.password));
+}
+function orgIdOf(ctx) {
+    const r = ctx.context.returned;
+    return str(ctx.body?.organizationId) ?? r?.organizationId ?? r?.member?.organizationId ?? r?.invitation?.organizationId;
+}
+async function auditOrgChange(deps, ctx) {
+    const action = AUDITED[ctx.path];
+    const orgId = action && orgIdOf(ctx);
+    if (!action || !orgId)
+        return;
+    const actor = (await getSessionFromCtx(ctx))?.user.id;
+    const removed = ctx.request && removedEmailOf.get(ctx.request);
+    const detail = { ...Object.fromEntries(Object.entries((ctx.body ?? {})).filter(([k]) => !SECRET_KEYS.includes(k))), ...(removed ? { memberEmail: removed } : {}) };
+    await audit(deps.db, orgId, actor ? `user:${actor}` : "system", action, detail, Date.now());
+}
+async function auditSsoChange(deps, ctx) {
+    const action = SSO_AUDITED[ctx.path];
+    const orgId = action && ctx.request && ssoOrgOf.get(ctx.request);
+    if (!action || !orgId)
+        return;
+    const body = (ctx.body ?? {});
+    const actor = (await getSessionFromCtx(ctx))?.user.id;
+    const detail = { providerId: str(body.providerId), domain: str(body.domain), type: body.samlConfig ? "saml" : body.oidcConfig ? "oidc" : undefined };
+    await audit(deps.db, orgId, actor ? `user:${actor}` : "system", action, detail, Date.now());
+}
+export function authHooks(deps) {
+    return {
+        before: createAuthMiddleware(guard),
+        after: createAuthMiddleware(async (ctx) => {
+            if (isAPIError(ctx.context.returned) || ctx.context.returned instanceof Error)
+                return;
+            if (ctx.path === "/sign-in/email")
+                await upgradeHash(ctx);
+            await auditOrgChange(deps, ctx);
+            await auditSsoChange(deps, ctx);
+            await securityAfter(deps, ctx);
+        }),
+    };
+}
+//# sourceMappingURL=hooks.js.map

package/dist/auth/hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/auth/hooks.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAChG,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAKvE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,6BAA6B,EAAE,kCAAkC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAC5H,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,6BAA6B,EAAE,kCAAkC,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAC7K,yDAAyD;AACzD,MAAM,OAAO,GAA2B;IACtC,sBAAsB,EAAE,YAAY;IACpC,6BAA6B,EAAE,eAAe;IAC9C,iCAAiC,EAAE,eAAe;IAClD,iCAAiC,EAAE,aAAa;IAChD,6BAA6B,EAAE,eAAe;IAC9C,kCAAkC,EAAE,aAAa;IACjD,qBAAqB,EAAE,cAAc;CACtC,CAAC;AACF,MAAM,WAAW,GAAG,CAAC,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;AACpG,gHAAgH;AAChH,MAAM,WAAW,GAA2B;IAC1C,eAAe,EAAE,YAAY;IAC7B,sBAAsB,EAAE,YAAY;IACpC,sBAAsB,EAAE,YAAY;IACpC,oBAAoB,EAAE,YAAY;CACnC,CAAC;AACF,sHAAsH;AACtH,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAkB,CAAC;AAC/C,sGAAsG;AACtG,MAAM,cAAc,GAAG,IAAI,OAAO,EAAkB,CAAC;AAErD,KAAK,UAAU,eAAe,CAAC,GAAY,EAAE,IAA6B;IACxE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM;QAAE,OAAO;IACpC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAqB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7I,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK;QAAE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAGpE,4HAA4H;AAC5H,KAAK,UAAU,gBAAgB,CAAC,GAAY;IAC1C,MAAM,KAAK,GAAG,aAAa,CAAE,GAAG,CAAC,KAA6C,EAAE,KAAK,CAAC,CAAC;IACvF,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO;IACrD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACvE,IAAK,KAAK,EAAE,IAAmD,EAAE,gBAAgB;QAAE,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC,CAAC;AAChM,CAAC;AAID,kJAAkJ;AAClJ,SAAS,QAAQ,CAAC,IAAY,EAAE,IAA6B;IAC3D,MAAM,MAAM,GAAG,IAAI,KAAK,eAAe,CAAC;IACxC,IAAI,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC,CAAC;IACzJ,IAAI,MAAM,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,mEAAmE,EAAE,CAAC,CAAC;IACjM,MAAM,IAAI,GAAG,IAAI,CAAC,UAAoB,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAoB,CAAC;IACvC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;IACjJ,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,KAAK,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;AAC1L,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAY,EAAE,IAA6B;IACvE,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU;QAAE,OAAO;IACxC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAqC,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IACjK,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,EAAE,cAAc,IAAI,SAAS,CAAC;IAC3E,IAAI,KAAK;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,8HAA8H;AAC9H,MAAM,KAAK,GAAO,KAAK,EAAE,GAAG,EAAE,EAAE;IAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,GAAG,CAAC,IAAI,KAAK,yBAAyB;QAAE,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IACxE,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC;QAChE,OAAO,cAAc,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IACzD,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,CAAC;IACpL,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACjI,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACnJ,IAAI,GAAG,CAAC,IAAI,KAAK,6BAA6B;QAAE,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACnF,CAAC,CAAC;AAEF,8DAA8D;AAC9D,KAAK,UAAU,WAAW,CAAC,GAAY;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,IAA+C,CAAC;IACjE,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO;IAChF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAClG,IAAI,KAAK,IAAI,OAAO,EAAE,QAAQ,IAAI,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACpL,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,QAAmI,CAAC;IAC1J,OAAO,GAAG,CAAE,GAAG,CAAC,IAA4C,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,cAAc,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,IAAI,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC;AACnK,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAc,EAAE,GAAY;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;QAAE,OAAO;IAC9B,MAAM,KAAK,GAAG,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9L,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAc,EAAE,GAAY;IACxD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;QAAE,OAAO;IAC9B,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IACzD,MAAM,KAAK,GAAG,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;IACtD,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACrJ,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,OAAO;QACL,MAAM,EAAE,oBAAoB,CAAC,KAAK,CAAC;QACnC,KAAK,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACxC,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,YAAY,KAAK;gBAAE,OAAO;YACtF,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;gBAAE,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;YAC1D,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAChC,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAChC,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/auth/options.d.ts

@@ -0,0 +1,17 @@
+import type { BetterAuthOptions } from "better-auth";
+import { type AuthDeps } from "./deps.js";
+export declare const AUTH_BASE_PATH = "/_wizelens/api/auth";
+export declare const CLIENT_IP_HEADER = "x-wizelens-client-ip";
+/** Who the person is and how they leave: change email, delete the account. Deleting checks organizations first (auth/delete-user.ts). */
+export declare function userOptions(deps: AuthDeps, beforeDelete: (user: {
+    id: string;
+}) => Promise<void>): BetterAuthOptions["user"];
+/** Email and password, with links that open the dashboard. Without real mail there is nothing to verify with, so it is not asked for. */
+export declare function passwordAuth(deps: AuthDeps): Pick<BetterAuthOptions, "emailAndPassword" | "emailVerification">;
+/** Sessions live in the database only (no cookie cache), so signing out a device or a password reset works on the next request. */
+export declare function sessionOptions(): Pick<BetterAuthOptions, "session" | "account" | "verification">;
+/** Limits per client address, shared by every instance through the database. */
+export declare function rateLimitOptions(): BetterAuthOptions["rateLimit"];
+/** Every safety switch set on purpose: Better Auth relaxes some in test and development runs. */
+export declare function advancedOptions(deps: AuthDeps): BetterAuthOptions["advanced"];
+//# sourceMappingURL=options.d.ts.map

package/dist/auth/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../src/auth/options.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKrD,OAAO,EAAE,KAAK,QAAQ,EAAW,MAAM,WAAW,CAAC;AAKnD,eAAO,MAAM,cAAc,wBAAwB,CAAC;AACpD,eAAO,MAAM,gBAAgB,yBAAyB,CAAC;AAIvD,yIAAyI;AACzI,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAc5H;AAED,yIAAyI;AACzI,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC,iBAAiB,EAAE,kBAAkB,GAAG,mBAAmB,CAAC,CAuB9G;AAED,mIAAmI;AACnI,wBAAgB,cAAc,IAAI,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,SAAS,GAAG,cAAc,CAAC,CAMhG;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAqBjE;AAED,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAU7E"}

package/dist/auth/options.js

@@ -0,0 +1,98 @@
+import { randomUUID } from "node:crypto";
+import { passwordChanged } from "../mail/emails-security.js";
+import { unsuppress } from "../repo/suppressions.js";
+import { sendSecurity } from "./security-notices.js";
+import { changeEmailMail, deleteAccountMail, resetPasswordMail, verifyEmailMail } from "../mail/templates.js";
+import { appLink } from "./deps.js";
+import { passwordOptions } from "./password.js";
+import { accountNames, rateLimitNames, sessionNames, userNames, verificationNames } from "./schema-names.js";
+import { signupGate } from "./signup.js";
+export const AUTH_BASE_PATH = "/_wizelens/api/auth";
+export const CLIENT_IP_HEADER = "x-wizelens-client-ip";
+const MINUTE = 60;
+const DAY = 24 * 60 * MINUTE;
+/** Who the person is and how they leave: change email, delete the account. Deleting checks organizations first (auth/delete-user.ts). */
+export function userOptions(deps, beforeDelete) {
+    return {
+        ...userNames,
+        validateUserInfo: signupGate(deps),
+        changeEmail: {
+            enabled: true,
+            sendChangeEmailConfirmation: async ({ user, newEmail, token }) => deps.mailer.send(changeEmailMail(user.email, newEmail, appLink(deps, "verify-email", token))),
+        },
+        deleteUser: {
+            enabled: true,
+            ...(deps.mailer.live ? { sendDeleteAccountVerification: async ({ user, token }) => deps.mailer.send(deleteAccountMail(user.email, appLink(deps, "delete-account", token))) } : {}),
+            beforeDelete,
+        },
+    };
+}
+/** Email and password, with links that open the dashboard. Without real mail there is nothing to verify with, so it is not asked for. */
+export function passwordAuth(deps) {
+    return {
+        emailAndPassword: {
+            enabled: true,
+            requireEmailVerification: deps.mailer.live,
+            autoSignIn: true,
+            minPasswordLength: 12,
+            maxPasswordLength: 128,
+            resetPasswordTokenExpiresIn: 30 * MINUTE,
+            revokeSessionsOnPasswordReset: true,
+            password: passwordOptions,
+            sendResetPassword: async ({ user, token }) => deps.mailer.send(resetPasswordMail(user.email, appLink(deps, "reset-password", token))),
+            onPasswordReset: async ({ user }) => sendSecurity(deps, user.id, (l) => passwordChanged(l, Date.now()), user.email),
+            customSyntheticUser: ({ coreFields, additionalFields, id }) => ({ ...coreFields, twoFactorEnabled: false, ...additionalFields, id }),
+        },
+        emailVerification: {
+            sendOnSignUp: deps.mailer.live,
+            autoSignInAfterVerification: true,
+            expiresIn: 60 * MINUTE,
+            sendVerificationEmail: async ({ user, token }) => deps.mailer.send(verifyEmailMail(user.email, appLink(deps, "verify-email", token))),
+            afterEmailVerification: async (user) => unsuppress(deps.db, user.email),
+        },
+    };
+}
+/** Sessions live in the database only (no cookie cache), so signing out a device or a password reset works on the next request. */
+export function sessionOptions() {
+    return {
+        session: { ...sessionNames, expiresIn: 14 * DAY, updateAge: DAY, freshAge: 15 * MINUTE, cookieCache: { enabled: false } },
+        account: { ...accountNames, encryptOAuthTokens: true },
+        verification: { ...verificationNames, storeIdentifier: "hashed" },
+    };
+}
+/** Limits per client address, shared by every instance through the database. */
+export function rateLimitOptions() {
+    return {
+        enabled: true,
+        storage: "database",
+        ...rateLimitNames,
+        window: 60,
+        max: 120,
+        customRules: {
+            "/sign-in/*": { window: 60, max: 10 },
+            "/sign-up/email": { window: 60, max: 5 },
+            "/two-factor/*": { window: 60, max: 10 },
+            "/request-password-reset": { window: 5 * MINUTE, max: 3 },
+            "/send-verification-email": { window: 5 * MINUTE, max: 3 },
+            "/change-password": { window: 60, max: 5 },
+            "/change-email": { window: 5 * MINUTE, max: 3 },
+            "/delete-user": { window: 5 * MINUTE, max: 5 },
+            "/get-session": { window: 10, max: 60 },
+            "/sso/register": { window: 60, max: 5 },
+            "/sso/verify-domain": { window: 60, max: 5 },
+        },
+    };
+}
+/** Every safety switch set on purpose: Better Auth relaxes some in test and development runs. */
+export function advancedOptions(deps) {
+    return {
+        cookiePrefix: "wizelens",
+        useSecureCookies: deps.publicUrl.startsWith("https://"),
+        defaultCookieAttributes: { sameSite: "lax", path: "/_wizelens" },
+        disableCSRFCheck: false,
+        disableOriginCheck: false,
+        ipAddress: { ipAddressHeaders: [CLIENT_IP_HEADER] },
+        database: { generateId: () => randomUUID(), validateSchema: true },
+    };
+}
+//# sourceMappingURL=options.js.map

package/dist/auth/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/auth/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC9G,OAAO,EAAiB,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC7G,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,MAAM,CAAC,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AACvD,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAE7B,yIAAyI;AACzI,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,YAAqD;IAC/F,OAAO;QACL,GAAG,SAAS;QACZ,gBAAgB,EAAE,UAAU,CAAC,IAAI,CAAC;QAClC,WAAW,EAAE;YACX,OAAO,EAAE,IAAI;YACb,2BAA2B,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;SAChK;QACD,UAAU,EAAE;YACV,OAAO,EAAE,IAAI;YACb,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,6BAA6B,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClL,YAAY;SACb;KACF,CAAC;AACJ,CAAC;AAED,yIAAyI;AACzI,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,OAAO;QACL,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,wBAAwB,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC1C,UAAU,EAAE,IAAI;YAChB,iBAAiB,EAAE,EAAE;YACrB,iBAAiB,EAAE,GAAG;YACtB,2BAA2B,EAAE,EAAE,GAAG,MAAM;YACxC,6BAA6B,EAAE,IAAI;YACnC,QAAQ,EAAE,eAAe;YACzB,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC;YACrI,eAAe,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC;YACnH,mBAAmB,EAAE,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,gBAAgB,EAAE,EAAE,EAAE,CAAC;SACrI;QACD,iBAAiB,EAAE;YACjB,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC9B,2BAA2B,EAAE,IAAI;YACjC,SAAS,EAAE,EAAE,GAAG,MAAM;YACtB,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;YACrI,sBAAsB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC;SACxE;KACF,CAAC;AACJ,CAAC;AAED,mIAAmI;AACnI,MAAM,UAAU,cAAc;IAC5B,OAAO;QACL,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACzH,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,kBAAkB,EAAE,IAAI,EAAE;QACtD,YAAY,EAAE,EAAE,GAAG,iBAAiB,EAAE,eAAe,EAAE,QAAQ,EAAE;KAClE,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,UAAU;QACnB,GAAG,cAAc;QACjB,MAAM,EAAE,EAAE;QACV,GAAG,EAAE,GAAG;QACR,WAAW,EAAE;YACX,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;YACrC,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;YACxC,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;YACxC,yBAAyB,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE;YACzD,0BAA0B,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE;YAC1D,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;YAC1C,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE;YAC/C,cAAc,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE;YAC9C,cAAc,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;YACvC,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;YACvC,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;SAC7C;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,OAAO;QACL,YAAY,EAAE,UAAU;QACxB,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC;QACvD,uBAAuB,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE;QAChE,gBAAgB,EAAE,KAAK;QACvB,kBAAkB,EAAE,KAAK;QACzB,SAAS,EAAE,EAAE,gBAAgB,EAAE,CAAC,gBAAgB,CAAC,EAAE;QACnD,QAAQ,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;KACnE,CAAC;AACJ,CAAC"}

package/dist/auth/password.d.ts

@@ -0,0 +1,10 @@
+export declare const isLegacyHash: (hash: string) => boolean;
+/** New hashes use Better Auth's scrypt; old ones still verify, and sign-in replaces them (auth/hooks.ts). */
+export declare const passwordOptions: {
+    hash: (password: string) => Promise<string>;
+    verify: ({ hash, password }: {
+        hash: string;
+        password: string;
+    }) => Promise<boolean>;
+};
+//# sourceMappingURL=password.d.ts.map

package/dist/auth/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/auth/password.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,YAAY,SAAU,MAAM,KAAG,OAAqC,CAAC;AAclF,6GAA6G;AAC7G,eAAO,MAAM,eAAe;IAC1B,IAAI,aAAa,MAAM;IACvB,MAAM,uBAAuB;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;CAChE,CAAC"}

package/dist/auth/password.js

@@ -0,0 +1,22 @@
+import { scrypt, timingSafeEqual } from "node:crypto";
+import { hashPassword, verifyPassword } from "better-auth/crypto";
+// Hashes from before Better Auth: "scrypt$<salt b64url>$<key b64url>", N=16384 r=8 p=1, 32-byte key, password as typed.
+const LEGACY = { N: 16384, r: 8, p: 1, keylen: 32 };
+export const isLegacyHash = (hash) => hash.startsWith("scrypt$");
+function legacyKey(password, salt) {
+    return new Promise((ok, fail) => scrypt(password, salt, LEGACY.keylen, { N: LEGACY.N, r: LEGACY.r, p: LEGACY.p }, (e, k) => (e ? fail(e) : ok(k))));
+}
+async function verifyLegacy(hash, password) {
+    const [, salt, key] = hash.split("$");
+    if (!salt || !key)
+        return false;
+    const want = Buffer.from(key, "base64url");
+    const got = await legacyKey(password, Buffer.from(salt, "base64url"));
+    return want.length === got.length && timingSafeEqual(want, got);
+}
+/** New hashes use Better Auth's scrypt; old ones still verify, and sign-in replaces them (auth/hooks.ts). */
+export const passwordOptions = {
+    hash: (password) => hashPassword(password),
+    verify: ({ hash, password }) => (isLegacyHash(hash) ? verifyLegacy(hash, password) : verifyPassword({ hash, password })),
+};
+//# sourceMappingURL=password.js.map

package/dist/auth/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/auth/password.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAElE,wHAAwH;AACxH,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAEpD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AAElF,SAAS,SAAS,CAAC,QAAgB,EAAE,IAAY;IAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB;IACxD,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAClE,CAAC;AAED,6GAA6G;AAC7G,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;IAClD,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAsC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;CAC7J,CAAC"}

package/dist/auth/plugins.d.ts

@@ -0,0 +1,4 @@
+import type { BetterAuthPlugin } from "better-auth";
+import { type AuthDeps } from "./deps.js";
+export declare const authPlugins: (deps: AuthDeps) => BetterAuthPlugin[];
+//# sourceMappingURL=plugins.d.ts.map

package/dist/auth/plugins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../src/auth/plugins.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,EAAE,KAAK,QAAQ,EAAW,MAAM,WAAW,CAAC;AA6CnD,eAAO,MAAM,WAAW,SAAU,QAAQ,KAAG,gBAAgB,EAAgI,CAAC"}

package/dist/auth/plugins.js

@@ -0,0 +1,45 @@
+import { passkey } from "@better-auth/passkey";
+import { haveIBeenPwned, organization, twoFactor } from "better-auth/plugins";
+import { inviteMail } from "../mail/templates.js";
+import { appLink } from "./deps.js";
+import { ac, authRoles } from "./roles.js";
+import { orgSchema, passkeySchema, twoFactorSchema } from "./schema-names.js";
+import { ssoPlugin } from "./sso.js";
+const DAY = 24 * 60 * 60;
+/** Only the cloud creates organizations and only our route deletes one; an invite opens only for its (verified, with mail) email. */
+function orgPlugin(deps) {
+    return organization({
+        ac,
+        roles: authRoles,
+        creatorRole: "owner",
+        allowUserToCreateOrganization: false,
+        organizationLimit: 50,
+        membershipLimit: 1000,
+        invitationExpiresIn: 7 * DAY,
+        invitationLimit: 500,
+        cancelPendingInvitationsOnReInvite: true,
+        requireEmailVerificationOnInvitation: deps.mailer.live,
+        disableOrganizationDeletion: true,
+        schema: orgSchema,
+        sendInvitationEmail: async ({ id, email, role, organization: org, inviter }) => deps.mailer.send(inviteMail(email, inviter.user.name, org.name, String(role), appLink(deps, "invite", id))),
+    });
+}
+/** Codes from a phone app, with 10 one-time backup codes. Both are stored encrypted with the auth secret. */
+function twoFactorPlugin() {
+    return twoFactor({
+        issuer: "WizeLens",
+        schema: twoFactorSchema,
+        totpOptions: { digits: 6, period: 30 },
+        backupCodeOptions: { amount: 10, length: 12, storeBackupCodes: "encrypted" },
+        trustDeviceMaxAge: 14 * DAY,
+        twoFactorCookieMaxAge: 5 * 60,
+        accountLockout: { enabled: true, maxFailedAttempts: 10, durationSeconds: 15 * 60 },
+    });
+}
+/** Passkeys must check the person on the device (PIN, fingerprint), so a passkey is two factors by itself. */
+function passkeyPlugin(deps) {
+    const url = new URL(deps.publicUrl);
+    return passkey({ rpID: url.hostname, rpName: "WizeLens", origin: deps.trustedOrigins, schema: passkeySchema, authenticatorSelection: { residentKey: "preferred", userVerification: "required" } });
+}
+export const authPlugins = (deps) => [orgPlugin(deps), twoFactorPlugin(), passkeyPlugin(deps), ssoPlugin(deps), ...(deps.checkPwned ? [haveIBeenPwned()] : [])];
+//# sourceMappingURL=plugins.js.map

package/dist/auth/plugins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.js","sourceRoot":"","sources":["../../src/auth/plugins.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAiB,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEzB,qIAAqI;AACrI,SAAS,SAAS,CAAC,IAAc;IAC/B,OAAO,YAAY,CAAC;QAClB,EAAE;QACF,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,OAAO;QACpB,6BAA6B,EAAE,KAAK;QACpC,iBAAiB,EAAE,EAAE;QACrB,eAAe,EAAE,IAAI;QACrB,mBAAmB,EAAE,CAAC,GAAG,GAAG;QAC5B,eAAe,EAAE,GAAG;QACpB,kCAAkC,EAAE,IAAI;QACxC,oCAAoC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;QACtD,2BAA2B,EAAE,IAAI;QACjC,MAAM,EAAE,SAAS;QACjB,mBAAmB,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;KAC5L,CAAC,CAAC;AACL,CAAC;AAED,6GAA6G;AAC7G,SAAS,eAAe;IACtB,OAAO,SAAS,CAAC;QACf,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,eAAe;QACvB,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QACtC,iBAAiB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE;QAC5E,iBAAiB,EAAE,EAAE,GAAG,GAAG;QAC3B,qBAAqB,EAAE,CAAC,GAAG,EAAE;QAC7B,cAAc,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,EAAE;KACnF,CAAC,CAAC;AACL,CAAC;AAED,8GAA8G;AAC9G,SAAS,aAAa,CAAC,IAAc;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,sBAAsB,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AACrM,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAc,EAAsB,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC"}

package/dist/auth/principal.d.ts

@@ -1,18 +1,23 @@
 import type { Ctx } from "../app.js";
 import { type ApiKey, type Project } from "../repo/projects.js";
-import { type User } from "../repo/users.js";
+import type { User } from "../repo/users.js";
 import { type Permission, type Role } from "./roles.js";
-export declare const SESSION_COOKIE = "wizelens_session";
-/** Who is calling: a signed-in person, or a read key (AI agents and scripts). */
+/** Who is calling: a signed-in person (a Better Auth session), or a read key (AI agents and scripts). */
 export type Principal = {
     kind: "user";
     user: User;
+    sessionId: string;
 } | {
     kind: "key";
     key: ApiKey & {
         orgId: string;
     };
 };
+/** The session of this request, read from the database each time (no cookie cache), so a revoked session stops at once. */
+export declare function sessionOf(ctx: Ctx): Promise<{
+    user: User;
+    sessionId: string;
+} | undefined>;
 export declare function principalOf(ctx: Ctx): Promise<Principal | undefined>;
 /** A signed-in person, or 401. Changes also need the dashboard header, so other sites cannot send them. */
 export declare function requireUser(ctx: Ctx): Promise<User>;

package/dist/auth/principal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"principal.d.ts","sourceRoot":"","sources":["../../src/auth/principal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGrC,OAAO,EAAE,KAAK,MAAM,EAAc,KAAK,OAAO,EAAgB,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,KAAK,IAAI,EAAiB,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAO,KAAK,UAAU,EAAE,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC;AAE7D,eAAO,MAAM,cAAc,qBAAqB,CAAC;AAEjD,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAExG,wBAAsB,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAU1E;AAED,2GAA2G;AAC3G,wBAAsB,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAMzD;AAED,mHAAmH;AACnH,wBAAsB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,CAMrH;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,gEAAgE;AAChE,wBAAsB,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAE,UAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAWzH"}
+{"version":3,"file":"principal.d.ts","sourceRoot":"","sources":["../../src/auth/principal.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGrC,OAAO,EAAE,KAAK,MAAM,EAAc,KAAK,OAAO,EAAgB,MAAM,qBAAqB,CAAC;AAC1F,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAO,KAAK,UAAU,EAAE,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC;AAE7D,yGAAyG;AACzG,MAAM,MAAM,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE3H,2HAA2H;AAC3H,wBAAsB,SAAS,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAKhG;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAQ1E;AAED,2GAA2G;AAC3G,wBAAsB,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAMzD;AAED,mHAAmH;AACnH,wBAAsB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,CAMrH;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,gEAAgE;AAChE,wBAAsB,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAE,UAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAWzH"}

package/dist/auth/principal.js

@@ -1,19 +1,24 @@
-import { bearerOf, cookieOf, fail, HttpError } from "../http/http.js";
+import { fromNodeHeaders } from "better-auth/node";
+import { bearerOf, fail, HttpError } from "../http/http.js";
 import { membership } from "../repo/orgs.js";
 import { keyByToken, projectInOrg } from "../repo/projects.js";
-import { userBySession } from "../repo/users.js";
 import { can } from "./roles.js";
-export const SESSION_COOKIE = "wizelens_session";
+/** The session of this request, read from the database each time (no cookie cache), so a revoked session stops at once. */
+export async function sessionOf(ctx) {
+    const s = await ctx.app.auth.api.getSession({ headers: fromNodeHeaders(ctx.req.headers) });
+    if (!s)
+        return undefined;
+    const { id, email, name, emailVerified } = s.user;
+    return { user: { id, email, name, emailVerified, twoFactorEnabled: !!s.user.twoFactorEnabled }, sessionId: s.session.id };
+}
 export async function principalOf(ctx) {
-    const now = ctx.app.config.now();
     const bearer = bearerOf(ctx.req);
     if (bearer?.startsWith("wl_rk_")) {
-        const key = await keyByToken(ctx.app.db, bearer, now);
+        const key = await keyByToken(ctx.app.db, bearer, ctx.app.config.now());
         return key?.kind === "read" ? { kind: "key", key } : undefined;
     }
-    const token = cookieOf(ctx.req, SESSION_COOKIE);
-    const user = token ? await userBySession(ctx.app.db, token, now) : undefined;
-    return user ? { kind: "user", user } : undefined;
+    const s = await sessionOf(ctx);
+    return s ? { kind: "user", ...s } : undefined;
 }
 /** A signed-in person, or 401. Changes also need the dashboard header, so other sites cannot send them. */
 export async function requireUser(ctx) {

package/dist/auth/principal.js.map

@@ -1 +1 @@
-{"version":3,"file":"principal.js","sourceRoot":"","sources":["../../src/auth/principal.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAe,UAAU,EAAgB,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAa,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,GAAG,EAA8B,MAAM,YAAY,CAAC;AAE7D,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAKjD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAQ;IACxC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO,GAAG,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACnD,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAQ;IACxC,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,WAAW;QAAE,IAAI,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC;IACjI,OAAO,CAAC,CAAC,IAAI,CAAC;AAChB,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAQ,EAAE,KAAa,EAAE,UAAsB;IAC9E,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,CAAE,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAE,CAAC,IAAI,mBAAmB,CAAC,CAAC;IACnF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAE,CAAC,IAAI,EAAE,CAAC;AACjC,CAAC;AAUD,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAQ,EAAE,SAAiB,EAAE,UAAU,GAAe,MAAM;IAC/F,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACtE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAqB,2CAA2C,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACnH,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC;IACjF,IAAI,UAAU,KAAK,MAAM;QAAE,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,CAA8B,EAAE,SAAiB,EAAE,UAAsB;IAC1G,IAAI,UAAU,KAAK,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1H,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAC7E,CAAC"}
+{"version":3,"file":"principal.js","sourceRoot":"","sources":["../../src/auth/principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAe,UAAU,EAAgB,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE1F,OAAO,EAAE,GAAG,EAA8B,MAAM,YAAY,CAAC;AAK7D,2HAA2H;AAC3H,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAQ;IACtC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;IAClD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;AAC5H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAQ;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,OAAO,GAAG,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAQ;IACxC,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,WAAW;QAAE,IAAI,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC;IACjI,OAAO,CAAC,CAAC,IAAI,CAAC;AAChB,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAQ,EAAE,KAAa,EAAE,UAAsB;IAC9E,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,CAAE,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAE,CAAC,IAAI,mBAAmB,CAAC,CAAC;IACnF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAE,CAAC,IAAI,EAAE,CAAC;AACjC,CAAC;AAUD,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAQ,EAAE,SAAiB,EAAE,UAAU,GAAe,MAAM;IAC/F,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACtE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAqB,2CAA2C,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACnH,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC;IACjF,IAAI,UAAU,KAAK,MAAM;QAAE,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,CAA8B,EAAE,SAAiB,EAAE,UAAsB;IAC1G,IAAI,UAAU,KAAK,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1H,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAC7E,CAAC"}