@xk2800/nextjs-template 0.5.3

package/dist/auth/helpers.js

@@ -0,0 +1,1023 @@
+'use strict';
+
+require('server-only');
+var react = require('react');
+var betterAuth = require('better-auth');
+var drizzle = require('better-auth/adapters/drizzle');
+var drizzleOrm = require('drizzle-orm');
+var serverless = require('@neondatabase/serverless');
+var neonHttp = require('drizzle-orm/neon-http');
+var nodePostgres = require('drizzle-orm/node-postgres');
+var pg = require('pg');
+var pgCore = require('drizzle-orm/pg-core');
+var cuid2 = require('@paralleldrive/cuid2');
+var zod = require('zod');
+var bcrypt = require('bcrypt');
+var plugins = require('better-auth/plugins');
+var passkey = require('better-auth/plugins/passkey');
+var api = require('better-auth/api');
+var uaParserJs = require('ua-parser-js');
+var geoip = require('geoip-lite');
+var resend$1 = require('resend');
+var components = require('@react-email/components');
+var jsxRuntime = require('react/jsx-runtime');
+var headers = require('next/headers');
+var navigation = require('next/navigation');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var bcrypt__default = /*#__PURE__*/_interopDefault(bcrypt);
+var geoip__default = /*#__PURE__*/_interopDefault(geoip);
+
+var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// server/db/schema.ts
+var schema_exports = {};
+__export(schema_exports, {
+  ActivityActionEnum: () => ActivityActionEnum,
+  RoleEnum: () => RoleEnum,
+  accounts: () => accounts,
+  activityLogs: () => activityLogs,
+  authThrottle: () => authThrottle,
+  deviceFingerprints: () => deviceFingerprints,
+  passkeys: () => passkeys,
+  sessions: () => sessions,
+  systemSettings: () => systemSettings,
+  twoFactors: () => twoFactors,
+  users: () => users,
+  verifications: () => verifications
+});
+var RoleEnum = pgCore.pgEnum("roles", ["user", "admin"]);
+var ActivityActionEnum = pgCore.pgEnum("activity_actions", [
+  "login",
+  "logout",
+  "login_failed",
+  "password_changed",
+  "email_changed",
+  "profile_updated",
+  "session_revoked",
+  "user_deleted",
+  "user_banned",
+  "user_unbanned",
+  "role_changed",
+  "impersonation_started",
+  "impersonation_stopped",
+  "settings_changed",
+  "passkey_added",
+  "passkey_removed"
+]);
+var users = pgCore.pgTable("user", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  name: pgCore.text("name").notNull(),
+  email: pgCore.text("email").notNull().unique(),
+  password: pgCore.text("password"),
+  emailVerified: pgCore.boolean("emailVerified").notNull().default(false),
+  image: pgCore.text("image"),
+  role: RoleEnum("roles").default("user").notNull(),
+  banned: pgCore.boolean("banned").default(false).notNull(),
+  bannedAt: pgCore.timestamp("bannedAt"),
+  bannedReason: pgCore.text("bannedReason"),
+  // Required by better-auth's admin plugin schema (auto-expiring bans). We
+  // never set this ourselves, so it stays null and bans behave as permanent,
+  // same as before the plugin was added.
+  banExpires: pgCore.timestamp("banExpires"),
+  lastLoginAt: pgCore.timestamp("lastLoginAt"),
+  lastActiveAt: pgCore.timestamp("lastActiveAt"),
+  // Set by better-auth's twoFactor plugin — true once the user has
+  // completed TOTP setup (see twoFactor pgTable below for the secret /
+  // backup codes themselves).
+  twoFactorEnabled: pgCore.boolean("twoFactorEnabled").notNull().default(false),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow(),
+  updatedAt: pgCore.timestamp("updatedAt").notNull().defaultNow()
+});
+var sessions = pgCore.pgTable("session", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  expiresAt: pgCore.timestamp("expiresAt").notNull(),
+  token: pgCore.text("token").notNull().unique(),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow(),
+  updatedAt: pgCore.timestamp("updatedAt").notNull().defaultNow(),
+  ipAddress: pgCore.text("ipAddress"),
+  userAgent: pgCore.text("userAgent"),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
+  // Set by better-auth's admin plugin while this session is an admin
+  // impersonating another user; holds the impersonating admin's user id.
+  impersonatedBy: pgCore.text("impersonatedBy")
+});
+var accounts = pgCore.pgTable("account", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  accountId: pgCore.text("accountId").notNull(),
+  providerId: pgCore.text("providerId").notNull(),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
+  accessToken: pgCore.text("accessToken"),
+  refreshToken: pgCore.text("refreshToken"),
+  idToken: pgCore.text("idToken"),
+  accessTokenExpiresAt: pgCore.timestamp("accessTokenExpiresAt"),
+  refreshTokenExpiresAt: pgCore.timestamp("refreshTokenExpiresAt"),
+  scope: pgCore.text("scope"),
+  password: pgCore.text("password"),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow(),
+  updatedAt: pgCore.timestamp("updatedAt").notNull().defaultNow()
+});
+var twoFactors = pgCore.pgTable("twoFactor", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  secret: pgCore.text("secret").notNull(),
+  backupCodes: pgCore.text("backupCodes").notNull(),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" })
+});
+var passkeys = pgCore.pgTable("passkey", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  name: pgCore.text("name"),
+  publicKey: pgCore.text("publicKey").notNull(),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
+  credentialID: pgCore.text("credentialID").notNull().unique(),
+  counter: pgCore.integer("counter").notNull(),
+  deviceType: pgCore.text("deviceType").notNull(),
+  backedUp: pgCore.boolean("backedUp").notNull(),
+  transports: pgCore.text("transports"),
+  createdAt: pgCore.timestamp("createdAt"),
+  aaguid: pgCore.text("aaguid")
+});
+var verifications = pgCore.pgTable("verification", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  identifier: pgCore.text("identifier").notNull(),
+  value: pgCore.text("value").notNull(),
+  expiresAt: pgCore.timestamp("expiresAt").notNull(),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow(),
+  updatedAt: pgCore.timestamp("updatedAt").notNull().defaultNow()
+});
+var activityLogs = pgCore.pgTable("activity_log", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
+  action: ActivityActionEnum("action").notNull(),
+  description: pgCore.text("description").notNull(),
+  ipAddress: pgCore.text("ipAddress"),
+  userAgent: pgCore.text("userAgent"),
+  metadata: pgCore.text("metadata"),
+  // Populated on 'login' events only (registration + sign-in) — parsed from
+  // userAgent/ipAddress at write time so the record stays stable even if
+  // the parsing library or geoip database changes later.
+  referrerUrl: pgCore.text("referrerUrl"),
+  os: pgCore.text("os"),
+  browser: pgCore.text("browser"),
+  deviceType: pgCore.text("deviceType"),
+  country: pgCore.text("country"),
+  city: pgCore.text("city"),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow()
+});
+var deviceFingerprints = pgCore.pgTable("device_fingerprint", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
+  visitorId: pgCore.text("visitorId").notNull(),
+  // Context captured at first-seen time — for the admin panel's "New devices"
+  // card and the alert email. Not part of the new-vs-known decision (that's
+  // visitorId only), just so an admin can eyeball whether a sign-in looks like
+  // a hijack. Nullable: an old row predates these columns, or geoip missed.
+  ipAddress: pgCore.text("ipAddress"),
+  userAgent: pgCore.text("userAgent"),
+  country: pgCore.text("country"),
+  city: pgCore.text("city"),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow()
+}, (table) => [
+  pgCore.unique("device_fingerprint_user_visitor").on(table.userId, table.visitorId)
+]);
+var authThrottle = pgCore.pgTable("auth_throttle", {
+  fingerprint: pgCore.text("fingerprint").notNull().primaryKey(),
+  count: pgCore.integer("count").notNull().default(0),
+  windowStart: pgCore.timestamp("windowStart").notNull().defaultNow(),
+  // Blockable data points, overwritten on every attempt (last-write-wins) so
+  // the admin panel can show who to block — by IP or by fingerprint — with no
+  // join and no per-attempt history table. windowStart anchors the counter's
+  // window; lastAttemptAt is just "most recently seen".
+  lastAttemptAt: pgCore.timestamp("lastAttemptAt").notNull().defaultNow(),
+  ipAddress: pgCore.text("ipAddress"),
+  userAgent: pgCore.text("userAgent"),
+  lastEmail: pgCore.text("lastEmail"),
+  lastKind: pgCore.text("lastKind")
+  // 'signin' | 'signup'
+});
+var systemSettings = pgCore.pgTable("system_settings", {
+  id: pgCore.text("id").primaryKey().default("default"),
+  maintenanceMode: pgCore.boolean("maintenanceMode").notNull().default(false),
+  maintenanceMessage: pgCore.text("maintenanceMessage"),
+  authEnableGoogle: pgCore.boolean("authEnableGoogle").notNull().default(true),
+  authEnableEmailPassword: pgCore.boolean("authEnableEmailPassword").notNull().default(true),
+  authEnableOneTap: pgCore.boolean("authEnableOneTap").notNull().default(false),
+  enableSessionRevocation: pgCore.boolean("enableSessionRevocation").notNull().default(true),
+  updatedAt: pgCore.timestamp("updatedAt").notNull().defaultNow(),
+  // Who last changed a setting. This row doesn't "belong" to that admin the
+  // way sessions/activityLogs belong to their user, so deleting that admin's
+  // account should null this out rather than cascade-delete the singleton row.
+  updatedBy: pgCore.text("updatedBy").references(() => users.id, { onDelete: "set null" })
+}, (table) => [
+  pgCore.check("system_settings_singleton", drizzleOrm.sql`${table.id} = 'default'`)
+]);
+var envSchema = zod.z.object({
+  NODE_ENV: zod.z.enum(["development", "production", "test"]).default("development"),
+  PORT: zod.z.string().default("3000").transform(Number),
+  DATABASE_URL: zod.z.string().default(""),
+  RESEND_API_KEY: zod.z.string().default(""),
+  // Display name for this deployment — shown as the authenticator-app label
+  // (2FA issuer) and the passkey relying-party name. Consuming projects set
+  // this in their own .env; defaults to the template name.
+  APP_NAME: zod.z.string().default("Next.js Template"),
+  // Seed-only: the live value lives in the system_settings DB row (see
+  // lib/settings-queries.ts) once it's been seeded on first read, and is
+  // changed from the admin System Settings page, not by editing this var.
+  ENABLE_SESSION_REVOCATION: zod.z.string().default("true").transform((val) => val === "true"),
+  AUTH_ENABLE_GOOGLE: zod.z.string().default("true").transform((val) => val === "true"),
+  AUTH_ENABLE_EMAIL_PASSWORD: zod.z.string().default("true").transform((val) => val === "true"),
+  AUTH_ENABLE_ONE_TAP: zod.z.string().default("false").transform((val) => val === "true"),
+  DB_DRIVER: zod.z.enum(["pg", "neon"]).default("pg"),
+  // Only relevant when DB_DRIVER=pg — whether the target Postgres server has SSL
+  // enabled. Self-hosted Postgres (e.g. via Docker/Dokploy) typically does not.
+  DATABASE_SSL: zod.z.string().default("false").transform((val) => val === "true")
+});
+
+// config/env.ts
+var results = envSchema.safeParse(process.env);
+if (results.success && results.data.NODE_ENV === "development") {
+  console.log("Environment variables loaded:", Object.keys(results.data));
+}
+if (!results.success) {
+  console.error("Invalid environment variables:", results.error.format());
+  throw new Error("Invalid environment variables");
+}
+var config = results.data;
+
+// server/db/index.ts
+var db;
+if (config.DB_DRIVER === "pg") {
+  const pool = new pg.Pool({
+    connectionString: config.DATABASE_URL,
+    ssl: config.DATABASE_SSL ? { rejectUnauthorized: false } : void 0
+  });
+  db = nodePostgres.drizzle(pool, {
+    schema: schema_exports,
+    logger: true
+  });
+  console.log("\u{1F7E1} Using PostgreSQL (pg) driver");
+} else if (config.DB_DRIVER === "neon") {
+  const sql4 = serverless.neon(config.DATABASE_URL);
+  db = neonHttp.drizzle(sql4, { schema: schema_exports, logger: true });
+  console.log("\u{1F7E2} Using Neon (HTTP) driver");
+} else {
+  console.log("Database connection not established, unknown DB_DRIVER:", config.DB_DRIVER);
+}
+async function logActivity({
+  userId,
+  action,
+  description,
+  ipAddress,
+  userAgent,
+  metadata,
+  referrerUrl,
+  os,
+  browser,
+  deviceType,
+  country,
+  city
+}) {
+  try {
+    await db.insert(activityLogs).values({
+      userId,
+      action,
+      description,
+      ipAddress: ipAddress || null,
+      userAgent: userAgent || null,
+      metadata: metadata ? JSON.stringify(metadata) : null,
+      referrerUrl: referrerUrl || null,
+      os: os || null,
+      browser: browser || null,
+      deviceType: deviceType || null,
+      country: country || null,
+      city: city || null
+    });
+  } catch (error) {
+    console.error("Failed to log activity:", error);
+  }
+}
+var countryNames = new Intl.DisplayNames(["en"], { type: "region" });
+function getClientIp(headers2) {
+  var _a;
+  const forwardedFor = headers2 == null ? void 0 : headers2.get("x-forwarded-for");
+  if (forwardedFor) return forwardedFor.split(",")[0].trim();
+  return (_a = headers2 == null ? void 0 : headers2.get("x-real-ip")) != null ? _a : null;
+}
+function parseUserAgent(userAgent) {
+  var _a;
+  if (!userAgent) {
+    return { os: null, browser: null, deviceType: "desktop" };
+  }
+  const { os, browser, device } = new uaParserJs.UAParser(userAgent).getResult();
+  return {
+    os: os.name ? [os.name, os.version].filter(Boolean).join(" ") : null,
+    browser: (_a = browser.name) != null ? _a : null,
+    deviceType: device.type === "mobile" || device.type === "tablet" ? device.type : "desktop"
+  };
+}
+function lookupGeoLocation(ipAddress) {
+  var _a;
+  if (!ipAddress) return { country: null, city: null };
+  const geo = geoip__default.default.lookup(ipAddress);
+  if (!geo) return { country: null, city: null };
+  let country = geo.country || null;
+  if (country) {
+    try {
+      country = (_a = countryNames.of(country)) != null ? _a : country;
+    } catch (e) {
+    }
+  }
+  return { country, city: geo.city || null };
+}
+function formatDeviceInfo({ os, browser, deviceType }) {
+  const label = [browser, os].filter(Boolean).join(" on ");
+  const typeLabel = deviceType === "mobile" ? "Mobile" : deviceType === "tablet" ? "Tablet" : "Desktop";
+  return label ? `${label} \xB7 ${typeLabel}` : `Unknown device \xB7 ${typeLabel}`;
+}
+function formatLocation({ country, city }) {
+  if (!country && !city) return "Unknown";
+  return [city, country].filter(Boolean).join(", ");
+}
+
+// lib/cookie-names.ts
+var LOGIN_REFERRER_COOKIE = "login_referrer";
+var DEVICE_FINGERPRINT_HEADER = "x-device-fingerprint";
+
+// lib/auth-throttle-limits.ts
+var WINDOW_MS = 15 * 60 * 1e3;
+var MAX = 10;
+var MAX_IP = MAX * 3;
+function isOverLimit(row, now, max = MAX) {
+  if (!row) return false;
+  if (now - row.windowStart.getTime() >= WINDOW_MS) return false;
+  return row.count >= max;
+}
+
+// lib/auth-throttle.ts
+async function isDeviceThrottled(fingerprint, max) {
+  try {
+    const [row] = await db.select({ count: authThrottle.count, windowStart: authThrottle.windowStart }).from(authThrottle).where(drizzleOrm.eq(authThrottle.fingerprint, fingerprint)).limit(1);
+    return isOverLimit(row, Date.now(), max);
+  } catch (error) {
+    console.error("auth-throttle read failed, allowing request", error);
+    return false;
+  }
+}
+async function recordDeviceAttempt(fingerprint, meta) {
+  const now = /* @__PURE__ */ new Date();
+  const cutoff = new Date(now.getTime() - WINDOW_MS);
+  const seen = {
+    lastAttemptAt: now,
+    ipAddress: meta.ipAddress,
+    userAgent: meta.userAgent,
+    lastEmail: meta.email,
+    lastKind: meta.kind
+  };
+  try {
+    await db.insert(authThrottle).values(__spreadValues({ fingerprint, count: 1, windowStart: now }, seen)).onConflictDoUpdate({
+      target: authThrottle.fingerprint,
+      set: __spreadValues({
+        count: drizzleOrm.sql`case when ${authThrottle.windowStart} < ${cutoff} then 1 else ${authThrottle.count} + 1 end`,
+        windowStart: drizzleOrm.sql`case when ${authThrottle.windowStart} < ${cutoff} then ${now} else ${authThrottle.windowStart} end`
+      }, seen)
+    });
+  } catch (error) {
+    console.error("auth-throttle write failed", error);
+  }
+}
+async function clearDeviceThrottle(fingerprint) {
+  try {
+    await db.delete(authThrottle).where(drizzleOrm.eq(authThrottle.fingerprint, fingerprint));
+  } catch (error) {
+    console.error("auth-throttle clear failed", error);
+  }
+}
+var SETTINGS_ROW_ID = "default";
+var CACHE_TTL_MS = 1e4;
+var cached = null;
+function fallbackSettings() {
+  return {
+    id: SETTINGS_ROW_ID,
+    maintenanceMode: false,
+    maintenanceMessage: null,
+    authEnableGoogle: config.AUTH_ENABLE_GOOGLE,
+    authEnableEmailPassword: config.AUTH_ENABLE_EMAIL_PASSWORD,
+    authEnableOneTap: config.AUTH_ENABLE_ONE_TAP,
+    enableSessionRevocation: config.ENABLE_SESSION_REVOCATION,
+    updatedAt: /* @__PURE__ */ new Date(0),
+    updatedBy: null
+  };
+}
+async function loadOrSeed() {
+  var _a;
+  const existing = await db.select().from(systemSettings).where(drizzleOrm.eq(systemSettings.id, SETTINGS_ROW_ID)).limit(1);
+  if (existing[0]) return existing[0];
+  const seeded = await db.insert(systemSettings).values({
+    id: SETTINGS_ROW_ID,
+    maintenanceMode: false,
+    authEnableGoogle: config.AUTH_ENABLE_GOOGLE,
+    authEnableEmailPassword: config.AUTH_ENABLE_EMAIL_PASSWORD,
+    authEnableOneTap: config.AUTH_ENABLE_ONE_TAP,
+    enableSessionRevocation: config.ENABLE_SESSION_REVOCATION
+  }).onConflictDoNothing().returning();
+  if (seeded[0]) return seeded[0];
+  const retry = await db.select().from(systemSettings).where(drizzleOrm.eq(systemSettings.id, SETTINGS_ROW_ID)).limit(1);
+  return (_a = retry[0]) != null ? _a : fallbackSettings();
+}
+async function getSystemSettings() {
+  const now = Date.now();
+  if (cached && cached.expiresAt > now) return cached.value;
+  try {
+    const value = await loadOrSeed();
+    cached = { value, expiresAt: now + CACHE_TTL_MS };
+    return value;
+  } catch (error) {
+    console.error("Failed to load system settings, failing open:", error);
+    return fallbackSettings();
+  }
+}
+async function getEffectiveAuthFlags() {
+  const settings = await getSystemSettings();
+  return {
+    google: config.AUTH_ENABLE_GOOGLE && settings.authEnableGoogle,
+    emailPassword: config.AUTH_ENABLE_EMAIL_PASSWORD && settings.authEnableEmailPassword,
+    oneTap: config.AUTH_ENABLE_ONE_TAP && settings.authEnableOneTap
+  };
+}
+var EMAIL_FROM = "Acme <onboarding@xavierkhew.xyz>";
+var resend;
+function getResend() {
+  if (!resend) resend = new resend$1.Resend(config.RESEND_API_KEY);
+  return resend;
+}
+function EmailTemplateResetPassword({ firstName, url }) {
+  return /* @__PURE__ */ jsxRuntime.jsxs(components.Html, { children: [
+    /* @__PURE__ */ jsxRuntime.jsx(components.Head, {}),
+    /* @__PURE__ */ jsxRuntime.jsx(components.Body, { style: { backgroundColor: "#ffffff", fontFamily: "Arial, sans-serif" }, children: /* @__PURE__ */ jsxRuntime.jsx(components.Container, { style: { margin: "0 auto", padding: "20px 0 48px", maxWidth: "560px" }, children: /* @__PURE__ */ jsxRuntime.jsxs(components.Section, { style: { backgroundColor: "#f8f9fa", borderRadius: "12px", padding: "40px", textAlign: "center" }, children: [
+      /* @__PURE__ */ jsxRuntime.jsx(components.Heading, { style: { fontSize: "28px", fontWeight: "bold", marginBottom: "12px", color: "#1a1a1a" }, children: "Reset your password" }),
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { style: { fontSize: "16px", color: "#666666", marginBottom: "32px", lineHeight: "24px" }, children: [
+        "Hi ",
+        firstName,
+        ", we got a request to reset your password. This link expires in an hour \u2014 if you didn't ask for this, you can safely ignore this email."
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsx(components.Section, { style: { marginBottom: "32px" }, children: /* @__PURE__ */ jsxRuntime.jsx(
+        components.Button,
+        {
+          href: url,
+          style: {
+            backgroundColor: "#000000",
+            color: "#ffffff",
+            padding: "12px 32px",
+            borderRadius: "6px",
+            textDecoration: "none",
+            fontSize: "16px",
+            fontWeight: "bold"
+          },
+          children: "Reset password"
+        }
+      ) }),
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { style: { fontSize: "13px", color: "#999999", lineHeight: "20px", wordBreak: "break-all" }, children: [
+        "Or paste this link into your browser:",
+        /* @__PURE__ */ jsxRuntime.jsx("br", {}),
+        /* @__PURE__ */ jsxRuntime.jsx("a", { href: url, style: { color: "#000000", textDecoration: "underline" }, children: url })
+      ] })
+    ] }) }) })
+  ] });
+}
+function EmailTemplateVerifyEmail({ firstName, url }) {
+  return /* @__PURE__ */ jsxRuntime.jsxs(components.Html, { children: [
+    /* @__PURE__ */ jsxRuntime.jsx(components.Head, {}),
+    /* @__PURE__ */ jsxRuntime.jsx(components.Tailwind, { children: /* @__PURE__ */ jsxRuntime.jsx(components.Body, { className: "bg-white font-sans", children: /* @__PURE__ */ jsxRuntime.jsx(components.Container, { className: "mx-auto max-w-[560px] px-0 pt-5 pb-12", children: /* @__PURE__ */ jsxRuntime.jsxs(components.Section, { className: "rounded-xl bg-[#f8f9fa] p-10 text-center", children: [
+      /* @__PURE__ */ jsxRuntime.jsx(components.Heading, { className: "mb-3 text-[28px] font-bold text-[#1a1a1a]", children: "Confirm your email" }),
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "mb-8 text-base leading-6 text-[#666666]", children: [
+        "Hi ",
+        firstName,
+        ", click the button below to verify this email address. If you didn't create an account, you can safely ignore this email."
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsx(components.Section, { className: "mb-8", children: /* @__PURE__ */ jsxRuntime.jsx(
+        components.Button,
+        {
+          href: url,
+          className: "rounded-md bg-black px-8 py-3 text-base font-bold text-white no-underline",
+          children: "Verify email"
+        }
+      ) }),
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "text-[13px] leading-5 break-all text-[#999999]", children: [
+        "Or paste this link into your browser:",
+        /* @__PURE__ */ jsxRuntime.jsx("br", {}),
+        /* @__PURE__ */ jsxRuntime.jsx(components.Link, { href: url, className: "text-black underline", children: url })
+      ] })
+    ] }) }) }) })
+  ] });
+}
+function EmailTemplatePasskeyChange({
+  firstName,
+  action,
+  device,
+  location,
+  ipAddress,
+  when,
+  manageUrl
+}) {
+  const verb = action === "added" ? "added to" : "removed from";
+  return /* @__PURE__ */ jsxRuntime.jsxs(components.Html, { children: [
+    /* @__PURE__ */ jsxRuntime.jsx(components.Head, {}),
+    /* @__PURE__ */ jsxRuntime.jsx(components.Tailwind, { children: /* @__PURE__ */ jsxRuntime.jsx(components.Body, { className: "bg-white font-sans", children: /* @__PURE__ */ jsxRuntime.jsx(components.Container, { className: "mx-auto max-w-[560px] px-0 pt-5 pb-12", children: /* @__PURE__ */ jsxRuntime.jsxs(components.Section, { className: "rounded-xl bg-[#f8f9fa] p-10", children: [
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Heading, { className: "mb-3 text-center text-2xl font-bold text-[#1a1a1a]", children: [
+        "A passkey was ",
+        action
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "mb-6 text-base leading-6 text-[#666666]", children: [
+        "Hi ",
+        firstName,
+        ", a passkey was just ",
+        verb,
+        " your account."
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Section, { className: "mb-6 rounded-lg bg-white p-5", children: [
+        /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "m-0 mb-2 text-sm leading-5 text-[#1a1a1a]", children: [
+          /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "Device:" }),
+          " ",
+          device
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "m-0 mb-2 text-sm leading-5 text-[#1a1a1a]", children: [
+          /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "Approx. location:" }),
+          " ",
+          location
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "m-0 mb-2 text-sm leading-5 text-[#1a1a1a]", children: [
+          /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "IP address:" }),
+          " ",
+          ipAddress
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "m-0 text-sm leading-5 text-[#1a1a1a]", children: [
+          /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "When:" }),
+          " ",
+          when
+        ] })
+      ] }),
+      manageUrl && /* @__PURE__ */ jsxRuntime.jsx(components.Section, { className: "mb-6 text-center", children: /* @__PURE__ */ jsxRuntime.jsx(
+        components.Button,
+        {
+          href: manageUrl,
+          className: "rounded-lg bg-[#1a1a1a] px-6 py-3 text-sm font-bold text-white no-underline",
+          children: "Review your passkeys"
+        }
+      ) }),
+      /* @__PURE__ */ jsxRuntime.jsx(components.Text, { className: "text-sm leading-[22px] text-[#666666]", children: "If this was you, no action is needed. If you don't recognize it, change your password now and review your passkeys and active sessions." })
+    ] }) }) }) })
+  ] });
+}
+
+// server/auth.ts
+async function logFailedLogin(ctx) {
+  var _a, _b, _c;
+  try {
+    const raw = (_a = ctx.body) == null ? void 0 : _a.email;
+    const email = typeof raw === "string" ? raw.toLowerCase() : null;
+    if (!email) return;
+    const [user] = await db.select({ id: users.id }).from(users).where(drizzleOrm.eq(users.email, email)).limit(1);
+    if (!user) return;
+    await logActivity({
+      userId: user.id,
+      action: "login_failed",
+      description: "Failed login attempt",
+      ipAddress: getClientIp(ctx.headers),
+      userAgent: (_c = (_b = ctx.headers) == null ? void 0 : _b.get("user-agent")) != null ? _c : null
+    });
+  } catch (error) {
+    console.error("Failed to log login_failed activity", error);
+  }
+}
+async function notifyPasskeyChange(ctx, action) {
+  var _a, _b, _c, _d;
+  try {
+    const session = await api.getSessionFromCtx(ctx);
+    const user = session == null ? void 0 : session.user;
+    if (!user) return;
+    const ip = getClientIp(ctx.headers);
+    await logActivity({
+      userId: user.id,
+      action: action === "added" ? "passkey_added" : "passkey_removed",
+      description: `Passkey ${action}`,
+      ipAddress: ip,
+      userAgent: (_b = (_a = ctx.headers) == null ? void 0 : _a.get("user-agent")) != null ? _b : null
+    });
+    if (!config.RESEND_API_KEY) return;
+    await getResend().emails.send({
+      from: EMAIL_FROM,
+      to: [user.email],
+      subject: action === "added" ? "A passkey was added to your account" : "A passkey was removed from your account",
+      react: EmailTemplatePasskeyChange({
+        firstName: user.name || "there",
+        action,
+        device: formatDeviceInfo(parseUserAgent((_d = (_c = ctx.headers) == null ? void 0 : _c.get("user-agent")) != null ? _d : null)),
+        location: formatLocation(lookupGeoLocation(ip)),
+        ipAddress: ip || "Unknown",
+        when: (/* @__PURE__ */ new Date()).toUTCString(),
+        manageUrl: `${process.env.BETTER_AUTH_URL || process.env.NEXTAUTH_URL || process.env.NEXT_PUBLIC_APP_URL || ""}/dashboard/settings`
+      })
+    });
+  } catch (error) {
+    console.error("Failed to send passkey-change notification", error);
+  }
+}
+function createAuth(overrides = {}) {
+  const socialProviders = __spreadValues(__spreadValues({}, config.AUTH_ENABLE_GOOGLE ? {
+    google: {
+      clientId: process.env.AUTH_GOOGLE_ID || process.env.GOOGLE_CLIENT_ID || "",
+      clientSecret: process.env.AUTH_GOOGLE_SECRET || process.env.GOOGLE_CLIENT_SECRET || ""
+    }
+  } : {}), overrides.socialProviders);
+  const emailAndPasswordEnabled = config.AUTH_ENABLE_EMAIL_PASSWORD;
+  const hasEnabledSocialProvider = Object.values(socialProviders).some(Boolean);
+  if (!hasEnabledSocialProvider && !emailAndPasswordEnabled) {
+    throw new Error(
+      "No auth provider is enabled \u2014 every social provider is off and emailAndPassword.enabled is false. Enable AUTH_ENABLE_GOOGLE / AUTH_ENABLE_EMAIL_PASSWORD, or pass your own provider via createAuth({ socialProviders: {...} })."
+    );
+  }
+  const baseURL = process.env.NEXTAUTH_URL || process.env.BETTER_AUTH_URL || "http://localhost:3000";
+  return betterAuth.betterAuth({
+    database: drizzle.drizzleAdapter(db, {
+      provider: "pg",
+      schema: {
+        user: users,
+        account: accounts,
+        session: sessions,
+        verification: verifications,
+        twoFactor: twoFactors,
+        passkey: passkeys
+      }
+    }),
+    // Session configuration (30 days expiration matching previous NextAuth setup)
+    session: {
+      expiresIn: 60 * 60 * 24 * 30,
+      // 30 days
+      updateAge: 60 * 60 * 24,
+      // Update session every 24 hours
+      cookieCache: {
+        enabled: true,
+        // Enable hybrid session caching for performance
+        maxAge: 5 * 60
+        // 5 minutes
+      }
+    },
+    // Email & Password Authentication (replaces Credentials provider)
+    // Toggle per-project via AUTH_ENABLE_EMAIL_PASSWORD in that project's own .env.*
+    emailAndPassword: {
+      enabled: emailAndPasswordEnabled,
+      requireEmailVerification: false,
+      // Use bcrypt to maintain compatibility with existing user passwords
+      async hash(password) {
+        return await bcrypt__default.default.hash(password, 10);
+      },
+      async verify({ hash, password }) {
+        return await bcrypt__default.default.compare(password, hash);
+      },
+      // `url` is fully composed by better-auth (baseURL + verification token +
+      // callbackURL) — see app/(auth)/forgot-password and reset-password for
+      // the pages this points at.
+      async sendResetPassword({ user, url }) {
+        await getResend().emails.send({
+          from: EMAIL_FROM,
+          to: [user.email],
+          subject: "Reset your password",
+          react: EmailTemplateResetPassword({ firstName: user.name || "there", url })
+        });
+      }
+    },
+    // Email verification. `requireEmailVerification` above stays false, so this
+    // is opt-in: users trigger it from the dashboard via
+    // authClient.sendVerificationEmail(). better-auth composes `url`
+    // (baseURL + token + callbackURL) and serves the /api/auth/verify-email
+    // callback that flips users.emailVerified on click.
+    emailVerification: {
+      autoSignInAfterVerification: true,
+      async sendVerificationEmail({ user, url }) {
+        await getResend().emails.send({
+          from: EMAIL_FROM,
+          to: [user.email],
+          subject: "Confirm your email",
+          react: EmailTemplateVerifyEmail({ firstName: user.name || "there", url })
+        });
+      }
+    },
+    // Social Providers — google is included by default; toggle per-project via
+    // AUTH_ENABLE_GOOGLE. overrides.socialProviders can still add more (or replace it).
+    socialProviders,
+    // User schema configuration
+    user: {
+      additionalFields: {
+        role: {
+          type: "string",
+          required: false,
+          defaultValue: "user",
+          input: false
+          // Prevent users from setting their own role
+        }
+      }
+    },
+    // Advanced options
+    advanced: {
+      generateId: () => __require("@paralleldrive/cuid2").createId()
+    },
+    // Every new session row corresponds to a sign-in (credential or OAuth) —
+    // use that as the "last logged in" signal rather than session updates,
+    // which also fire on cookie-cache refresh / expiry extension.
+    databaseHooks: {
+      session: {
+        create: {
+          async after(session, context) {
+            var _a, _b, _c, _d;
+            const impersonatedBy = session.impersonatedBy;
+            if (impersonatedBy) {
+              const target = await db.select({ email: users.email }).from(users).where(drizzleOrm.eq(users.id, session.userId)).limit(1);
+              await logActivity({
+                userId: impersonatedBy,
+                action: "impersonation_started",
+                description: `Admin started impersonating ${(_b = (_a = target[0]) == null ? void 0 : _a.email) != null ? _b : session.userId}`,
+                metadata: { impersonatedUserId: session.userId }
+              });
+              return;
+            }
+            try {
+              await db.update(users).set({ lastLoginAt: /* @__PURE__ */ new Date() }).where(drizzleOrm.eq(users.id, session.userId));
+            } catch (error) {
+              console.error("Failed to update lastLoginAt", error);
+            }
+            try {
+              const headers2 = context == null ? void 0 : context.headers;
+              const ipAddress = getClientIp(headers2);
+              const userAgent = (_c = headers2 == null ? void 0 : headers2.get("user-agent")) != null ? _c : null;
+              const referrerUrl = ((_d = context == null ? void 0 : context.getCookie) == null ? void 0 : _d.call(context, LOGIN_REFERRER_COOKIE)) || (headers2 == null ? void 0 : headers2.get("referer")) || null;
+              const device = parseUserAgent(userAgent);
+              const geo = lookupGeoLocation(ipAddress);
+              const [{ count }] = await db.select({ count: drizzleOrm.sql`count(*)` }).from(sessions).where(drizzleOrm.eq(sessions.userId, session.userId));
+              const isFirstSession = Number(count) <= 1;
+              await logActivity({
+                userId: session.userId,
+                action: "login",
+                description: isFirstSession ? "New account registered and signed in" : "User logged in",
+                ipAddress,
+                userAgent,
+                referrerUrl,
+                os: device.os,
+                browser: device.browser,
+                deviceType: device.deviceType,
+                country: geo.country,
+                city: geo.city
+              });
+            } catch (error) {
+              console.error("Failed to log login activity", error);
+            }
+          }
+        }
+      }
+    },
+    // better-auth's admin plugin ends impersonation by deleting the
+    // impersonation session and restoring the admin's original session
+    // straight from a signed cookie — it never runs session.create, so
+    // there's no databaseHooks entry point to log the stop event from.
+    // Reading the session here (before the endpoint deletes it) is the only
+    // point where both the admin id and the impersonated user id are still
+    // available together.
+    hooks: {
+      before: api.createAuthMiddleware(async (ctx) => {
+        var _a, _b, _c, _d;
+        if (ctx.path === "/sign-in/email" || ctx.path === "/sign-up/email") {
+          const fingerprint = (_a = ctx.headers) == null ? void 0 : _a.get(DEVICE_FINGERPRINT_HEADER);
+          const ip = getClientIp(ctx.headers);
+          const throttled = fingerprint && await isDeviceThrottled(fingerprint) || ip && await isDeviceThrottled(`ip:${ip}`, MAX_IP);
+          if (throttled) {
+            throw new api.APIError("TOO_MANY_REQUESTS", {
+              message: "Too many attempts from this device. Try again in a few minutes."
+            });
+          }
+        }
+        if (ctx.path === "/sign-in/social") {
+          if (((_b = ctx.body) == null ? void 0 : _b.provider) === "google") {
+            const flags = await getEffectiveAuthFlags();
+            if (!flags.google) {
+              throw new api.APIError("FORBIDDEN", { message: "Google sign-in is currently disabled." });
+            }
+          }
+          return;
+        }
+        if (ctx.path === "/sign-in/email") {
+          const flags = await getEffectiveAuthFlags();
+          if (!flags.emailPassword) {
+            throw new api.APIError("FORBIDDEN", { message: "Email/password sign-in is currently disabled." });
+          }
+          return;
+        }
+        if (ctx.path === "/one-tap/callback") {
+          const flags = await getEffectiveAuthFlags();
+          if (!flags.google || !flags.oneTap) {
+            throw new api.APIError("FORBIDDEN", { message: "Google One Tap is currently disabled." });
+          }
+          return;
+        }
+        if (ctx.path !== "/admin/stop-impersonating") return;
+        const current = await api.getSessionFromCtx(ctx, { disableCookieCache: true });
+        if (current == null ? void 0 : current.session.impersonatedBy) {
+          const target = await db.select({ email: users.email }).from(users).where(drizzleOrm.eq(users.id, current.session.userId)).limit(1);
+          await logActivity({
+            userId: current.session.impersonatedBy,
+            action: "impersonation_stopped",
+            description: `Admin stopped impersonating ${(_d = (_c = target[0]) == null ? void 0 : _c.email) != null ? _d : current.session.userId}`,
+            metadata: { impersonatedUserId: current.session.userId }
+          });
+        }
+      }),
+      after: api.createAuthMiddleware(async (ctx) => {
+        var _a, _b, _c, _d;
+        if (ctx.path === "/passkey/verify-registration" || ctx.path === "/passkey/delete-passkey") {
+          if (ctx.context.returned instanceof api.APIError) return;
+          await notifyPasskeyChange(
+            ctx,
+            ctx.path === "/passkey/verify-registration" ? "added" : "removed"
+          );
+          return;
+        }
+        if (ctx.path !== "/sign-in/email" && ctx.path !== "/sign-up/email") return;
+        const fingerprint = (_a = ctx.headers) == null ? void 0 : _a.get(DEVICE_FINGERPRINT_HEADER);
+        const ip = getClientIp(ctx.headers);
+        const ipKey = ip ? `ip:${ip}` : null;
+        if (!fingerprint && !ipKey) return;
+        const failed = ctx.context.returned instanceof api.APIError;
+        const rawEmail = (_b = ctx.body) == null ? void 0 : _b.email;
+        const meta = {
+          ipAddress: ip,
+          userAgent: (_d = (_c = ctx.headers) == null ? void 0 : _c.get("user-agent")) != null ? _d : null,
+          email: typeof rawEmail === "string" ? rawEmail.toLowerCase() : null
+        };
+        const keys = [fingerprint, ipKey].filter((k) => !!k);
+        if (ctx.path === "/sign-up/email") {
+          await Promise.all(keys.map((key) => recordDeviceAttempt(key, __spreadProps(__spreadValues({}, meta), { kind: "signup" }))));
+          return;
+        }
+        if (failed) {
+          await Promise.all(keys.map((key) => recordDeviceAttempt(key, __spreadProps(__spreadValues({}, meta), { kind: "signin" }))));
+          await logFailedLogin(ctx);
+        } else {
+          await Promise.all(keys.map((key) => clearDeviceThrottle(key)));
+        }
+      })
+    },
+    // Base URL for callbacks
+    baseURL,
+    // Secret for signing cookies and tokens
+    secret: process.env.AUTH_SECRET,
+    // The OAuth `state` is a one-time verification row: the callback consumes
+    // and deletes it. When the same callback URL gets hit twice (browser
+    // prefetch / bfcache / double nav — common on a repeat Google sign-in
+    // where Google auto-redirects with no consent screen), the first hit
+    // logs the user in and the second finds no `state` row and throws
+    // `please_restart_the_process`. Default sends that to better-auth's bare
+    // error page; point it at /login instead, which already bounces an
+    // authenticated user straight to their callbackUrl — so the losing race
+    // just lands them logged in. See better-auth#5658 / #6544.
+    onAPIError: {
+      errorURL: "/login"
+    },
+    plugins: [
+      // checks to see if oneTap is enabled and if google provider is available, then add the oneTap plugin
+      ...config.AUTH_ENABLE_ONE_TAP && Boolean(socialProviders.google) ? [plugins.oneTap()] : [],
+      // Registered for impersonation (auth.api.impersonateUser / stopImpersonating)
+      // only — role/ban/delete stay on our own custom routes above. adminRoles
+      // matches our existing role column so the plugin's own permission checks
+      // line up with hasRole(role, 'admin'). banReason is remapped onto our
+      // existing bannedReason column instead of adding a duplicate field.
+      plugins.admin({
+        adminRoles: ["admin"],
+        schema: {
+          user: {
+            fields: {
+              banReason: "bannedReason"
+            }
+          }
+        }
+      }),
+      // TOTP second factor + encrypted backup codes. `issuer` is the label
+      // shown in the user's authenticator app.
+      plugins.twoFactor({ issuer: config.APP_NAME }),
+      // WebAuthn passkeys (Touch ID / Windows Hello / security keys) as a
+      // passwordless sign-in method. rpID must be the bare host and origin
+      // the full URL — both derived from baseURL above.
+      passkey.passkey({
+        rpID: new URL(baseURL).hostname,
+        rpName: config.APP_NAME,
+        origin: baseURL
+      })
+    ]
+  });
+}
+var _auth;
+function getDefaultAuth() {
+  if (!_auth) _auth = createAuth();
+  return _auth;
+}
+var auth = new Proxy({}, {
+  get(_target, prop) {
+    const instance = getDefaultAuth();
+    const value = Reflect.get(instance, prop);
+    return typeof value === "function" ? value.bind(instance) : value;
+  },
+  // "prop" in auth (e.g. better-auth's toNextJsHandler does `"handler" in auth`)
+  // must also see the real instance — without this it checks the empty
+  // placeholder target and always reports false.
+  has(_target, prop) {
+    return Reflect.has(getDefaultAuth(), prop);
+  },
+  ownKeys(_target) {
+    return Reflect.ownKeys(getDefaultAuth());
+  },
+  getOwnPropertyDescriptor(_target, prop) {
+    return Reflect.getOwnPropertyDescriptor(getDefaultAuth(), prop);
+  }
+});
+var getCurrentSession = react.cache(async () => {
+  const session = await auth.api.getSession({
+    headers: await headers.headers()
+  });
+  return session;
+});
+var requireAuth = react.cache(async () => {
+  var _a;
+  const session = await getCurrentSession();
+  if (!(session == null ? void 0 : session.user)) {
+    navigation.redirect("/login");
+  }
+  const user = await db.select().from(users).where(drizzleOrm.eq(users.id, session.user.id)).limit(1);
+  if ((_a = user[0]) == null ? void 0 : _a.banned) {
+    await auth.api.signOut({
+      headers: await headers.headers()
+    });
+    navigation.redirect("/login?error=account_banned");
+  }
+  return session;
+});
+function hasRole(userRole, requiredRole) {
+  if (!userRole) return false;
+  if (requiredRole === "admin") {
+    return userRole === "admin";
+  }
+  return userRole === "user" || userRole === "admin";
+}
+async function requireRole(requiredRole) {
+  const session = await requireAuth();
+  if (!hasRole(session.user.role, requiredRole)) {
+    navigation.redirect("/dashboard");
+  }
+  return session;
+}
+function normalizeCallbackUrl(value) {
+  if (typeof value !== "string" || !value.trim()) return "/dashboard";
+  const candidate = value.trim();
+  try {
+    const appOrigin = new URL(process.env.NEXT_PUBLIC_APP_URL || process.env.BETTER_AUTH_URL || "http://localhost:3000").origin;
+    const callbackUrl = new URL(candidate, appOrigin);
+    if (callbackUrl.origin !== appOrigin) {
+      return "/dashboard";
+    }
+    return `${callbackUrl.pathname}${callbackUrl.search}${callbackUrl.hash}` || "/dashboard";
+  } catch (e) {
+    return "/dashboard";
+  }
+}
+
+exports.getCurrentSession = getCurrentSession;
+exports.hasRole = hasRole;
+exports.normalizeCallbackUrl = normalizeCallbackUrl;
+exports.requireAuth = requireAuth;
+exports.requireRole = requireRole;
+//# sourceMappingURL=helpers.js.map
+//# sourceMappingURL=helpers.js.map