create-safest-tools 0.2.0

package/template/src/report-better-auth.ts

@@ -0,0 +1,583 @@
+import { betterAuth } from "better-auth";
+import { getMigrations } from "better-auth/db/migration";
+import { genericOAuth } from "better-auth/plugins";
+import type { GenericOAuthConfig } from "better-auth/plugins/generic-oauth";
+
+const INVITATION_COOKIE = "safest_invitation";
+const INVITATION_MAX_AGE_SECONDS = 7 * 24 * 60 * 60;
+
+type AuthEmailBinding = {
+  send(message: {
+    from: { email: string; name?: string };
+    to: string | string[];
+    subject: string;
+    text: string;
+    html: string;
+  }): Promise<unknown>;
+};
+
+type BetterAuthEnv = Env & {
+  BETTER_AUTH_SECRET?: string;
+  AUTH_EMAIL_FROM?: string;
+  AUTH_GOOGLE_CLIENT_ID?: string;
+  AUTH_GOOGLE_CLIENT_SECRET?: string;
+  AUTH_GITHUB_CLIENT_ID?: string;
+  AUTH_GITHUB_CLIENT_SECRET?: string;
+  AUTH_CLOUDFLARE_CLIENT_ID?: string;
+  AUTH_CLOUDFLARE_CLIENT_SECRET?: string;
+  EMAIL?: AuthEmailBinding;
+};
+
+type BetterAuthSession = {
+  session: { id: string; userId: string; expiresAt: Date };
+  user: {
+    id: string;
+    name: string;
+    email: string;
+    emailVerified: boolean;
+    image?: string | null;
+  };
+};
+
+type AuthProviderInfo = {
+  providerId: "google" | "github" | "cloudflare";
+  displayName: "Google" | "GitHub" | "Cloudflare";
+};
+
+type InvitationRow = {
+  id: string;
+  email: string;
+  role: string;
+  status: string;
+  expires_at: string;
+};
+
+const encoder = new TextEncoder();
+
+function bytesToBase64Url(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+}
+
+async function sha256(value: string): Promise<string> {
+  const digest = await crypto.subtle.digest("SHA-256", encoder.encode(value));
+  return bytesToBase64Url(new Uint8Array(digest));
+}
+
+async function hmac(value: string, secret: string): Promise<string> {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  return bytesToBase64Url(new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(value))));
+}
+
+function constantTimeEqual(left: string, right: string): boolean {
+  const leftBytes = encoder.encode(left);
+  const rightBytes = encoder.encode(right);
+  if (leftBytes.byteLength !== rightBytes.byteLength) return false;
+  let difference = 0;
+  for (let index = 0; index < leftBytes.byteLength; index += 1) {
+    difference |= leftBytes[index]! ^ rightBytes[index]!;
+  }
+  return difference === 0;
+}
+
+function parseCookies(header: string | null): Map<string, string> {
+  const result = new Map<string, string>();
+  for (const part of (header ?? "").split(";")) {
+    const separator = part.indexOf("=");
+    if (separator <= 0) continue;
+    result.set(part.slice(0, separator).trim(), part.slice(separator + 1).trim());
+  }
+  return result;
+}
+
+function localDevelopment(env: BetterAuthEnv): boolean {
+  try {
+    const hostname = new URL(env.PUBLIC_BASE_URL).hostname;
+    return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+  } catch {
+    return false;
+  }
+}
+
+function authSecret(env: BetterAuthEnv): string {
+  if (env.BETTER_AUTH_SECRET && env.BETTER_AUTH_SECRET.length >= 32) return env.BETTER_AUTH_SECRET;
+  if (localDevelopment(env)) return "development-only-better-auth-secret-change-me";
+  throw new Error("BETTER_AUTH_SECRET must be configured with at least 32 characters.");
+}
+
+async function invitationCookieValue(id: string, env: BetterAuthEnv): Promise<string> {
+  return `${id}.${await hmac(`${INVITATION_COOKIE}:${id}`, authSecret(env))}`;
+}
+
+export async function invitationIdFromRequest(
+  request: Request | undefined,
+  env: BetterAuthEnv,
+): Promise<string | null> {
+  const value = parseCookies(request?.headers.get("cookie") ?? null).get(INVITATION_COOKIE);
+  if (!value) return null;
+  const separator = value.lastIndexOf(".");
+  if (separator <= 0) return null;
+  const id = value.slice(0, separator);
+  const signature = value.slice(separator + 1);
+  if (!/^[0-9a-f-]{36}$/iu.test(id)) return null;
+  const expected = await hmac(`${INVITATION_COOKIE}:${id}`, authSecret(env));
+  return constantTimeEqual(signature, expected) ? id : null;
+}
+
+async function findPendingInvitationById(
+  env: BetterAuthEnv,
+  id: string,
+): Promise<InvitationRow | null> {
+  return env.DB.prepare(`
+    SELECT id, email, role, status, expires_at
+    FROM operator_invitations
+    WHERE id = ?1 AND status = 'pending' AND expires_at > ?2
+    LIMIT 1
+  `).bind(id, new Date().toISOString()).first<InvitationRow>();
+}
+
+async function findPendingInvitationByToken(
+  env: BetterAuthEnv,
+  token: string,
+): Promise<InvitationRow | null> {
+  if (token.length < 32 || token.length > 200) return null;
+  return env.DB.prepare(`
+    SELECT id, email, role, status, expires_at
+    FROM operator_invitations
+    WHERE token_hash = ?1 AND status = 'pending' AND expires_at > ?2
+    LIMIT 1
+  `).bind(await sha256(token), new Date().toISOString()).first<InvitationRow>();
+}
+
+export async function invitationAllowsEmail(
+  request: Request,
+  env: BetterAuthEnv,
+  emailValue: unknown,
+): Promise<boolean> {
+  const email = typeof emailValue === "string" ? emailValue.trim().toLowerCase() : "";
+  if (!email) return false;
+  const invitationId = await invitationIdFromRequest(request, env);
+  const invitation = invitationId ? await findPendingInvitationById(env, invitationId) : null;
+  return invitation?.email.trim().toLowerCase() === email;
+}
+
+async function identityMayCreateUser(
+  env: BetterAuthEnv,
+  emailValue: unknown,
+  request: Request | undefined,
+): Promise<void | { error: string; errorDescription: string }> {
+  const email = typeof emailValue === "string" ? emailValue.trim().toLowerCase() : "";
+  if (!email) return { error: "invalid_email", errorDescription: "A verified email address is required." };
+  const existing = await env.DB.prepare(
+    "SELECT id FROM operator_users WHERE email = ?1 AND status = 'active' LIMIT 1",
+  ).bind(email).first();
+  if (existing) return;
+  const invitationId = await invitationIdFromRequest(request, env);
+  const invitation = invitationId ? await findPendingInvitationById(env, invitationId) : null;
+  if (!invitation) {
+    return { error: "invitation_required", errorDescription: "A valid Safest Resolve invitation is required." };
+  }
+  if (invitation.email.trim().toLowerCase() !== email) {
+    return {
+      error: "invitation_email_mismatch",
+      errorDescription: "Use the email address to which this invitation was sent.",
+    };
+  }
+}
+
+async function identityMaySignIn(
+  env: BetterAuthEnv,
+  emailValue: unknown,
+  request: Request | undefined,
+): Promise<void | { error: string; errorDescription: string }> {
+  const email = typeof emailValue === "string" ? emailValue.trim().toLowerCase() : "";
+  const operator = email ? await env.DB.prepare(
+    "SELECT status FROM operator_users WHERE email = ?1 LIMIT 1",
+  ).bind(email).first<{ status: string }>() : null;
+  if (operator?.status === "active") return;
+  if (request && await invitationAllowsEmail(request, env, email)) return;
+  return { error: "account_unavailable", errorDescription: "This Safest Resolve account is unavailable." };
+}
+
+function escapeHtml(value: string): string {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+
+async function sendAuthEmail(
+  env: BetterAuthEnv,
+  message: { to: string; subject: string; heading: string; body: string; action: string; url: string },
+): Promise<void> {
+  if (localDevelopment(env) && (!env.EMAIL || !env.AUTH_EMAIL_FROM)) {
+    console.info(`Local authentication email (${message.subject}) for ${message.to}: ${message.url}`);
+    return;
+  }
+  if (!env.EMAIL || !env.AUTH_EMAIL_FROM) {
+    throw new Error("Cloudflare Email Service and AUTH_EMAIL_FROM are required for authentication email.");
+  }
+  const footer = "If you did not request this message, you can safely ignore it.";
+  const html = `<!doctype html><html><body style="font-family:system-ui,sans-serif;color:#171717">` +
+    `<h1 style="font-size:20px">${escapeHtml(message.heading)}</h1>` +
+    `<p>${escapeHtml(message.body)}</p>` +
+    `<p><a href="${escapeHtml(message.url)}" style="display:inline-block;padding:10px 16px;` +
+    `background:#171717;color:#fff;text-decoration:none;border-radius:6px">${escapeHtml(message.action)}</a></p>` +
+    `<p style="font-size:12px;color:#666">${escapeHtml(footer)}</p></body></html>`;
+  await env.EMAIL.send({
+    from: { name: "Safest Resolve", email: env.AUTH_EMAIL_FROM },
+    to: message.to,
+    subject: message.subject,
+    text: `${message.heading}\n\n${message.body}\n\n${message.action}: ${message.url}\n\n${footer}`,
+    html,
+  });
+}
+
+function deliverAuthEmail(
+  env: BetterAuthEnv,
+  ctx: ExecutionContext | undefined,
+  message: Parameters<typeof sendAuthEmail>[1],
+): Promise<void> {
+  const delivery = sendAuthEmail(env, message).catch((error) => {
+    console.error("Authentication email delivery failed", error instanceof Error ? error.message : typeof error);
+  });
+  if (ctx) {
+    ctx.waitUntil(delivery);
+    return Promise.resolve();
+  }
+  return delivery;
+}
+
+function cloudflareProvider(env: BetterAuthEnv): GenericOAuthConfig | null {
+  if (!env.AUTH_CLOUDFLARE_CLIENT_ID || !env.AUTH_CLOUDFLARE_CLIENT_SECRET) return null;
+  return {
+    providerId: "cloudflare",
+    name: "Cloudflare",
+    clientId: env.AUTH_CLOUDFLARE_CLIENT_ID,
+    clientSecret: env.AUTH_CLOUDFLARE_CLIENT_SECRET,
+    authorizationUrl: "https://dash.cloudflare.com/oauth2/auth",
+    tokenUrl: "https://dash.cloudflare.com/oauth2/token",
+    tokenEndpointAuth: { method: "client_secret_basic" },
+    accountIssuer: "https://dash.cloudflare.com",
+    scopes: ["user-details.read"],
+    pkce: true,
+    requireEmailVerification: true,
+    accountSubject: ({ profile }) => String(profile.id),
+    async getUserInfo(tokens) {
+      if (!tokens.accessToken) return null;
+      const response = await fetch("https://api.cloudflare.com/client/v4/user", {
+        headers: { authorization: `Bearer ${tokens.accessToken}`, accept: "application/json" },
+      });
+      if (!response.ok) {
+        response.body?.cancel();
+        return null;
+      }
+      const envelope = await response.json() as {
+        success?: boolean;
+        result?: { id?: string; email?: string; first_name?: string; last_name?: string };
+      };
+      const profile = envelope.success ? envelope.result : undefined;
+      if (!profile?.id || !profile.email) return null;
+      const name = [profile.first_name, profile.last_name].filter(Boolean).join(" ").trim();
+      return {
+        id: profile.id,
+        email: profile.email,
+        emailVerified: true,
+        name: name || profile.email.split("@", 1)[0],
+      };
+    },
+    mapProfileToUser(profile) {
+      return {
+        email: typeof profile.email === "string" ? profile.email : null,
+        name: typeof profile.name === "string" ? profile.name : "Cloudflare user",
+        emailVerified: true,
+      };
+    },
+  };
+}
+
+export function configuredAuthProviders(env: BetterAuthEnv): AuthProviderInfo[] {
+  const providers: AuthProviderInfo[] = [];
+  if (env.AUTH_GOOGLE_CLIENT_ID && env.AUTH_GOOGLE_CLIENT_SECRET) {
+    providers.push({ providerId: "google", displayName: "Google" });
+  }
+  if (env.AUTH_GITHUB_CLIENT_ID && env.AUTH_GITHUB_CLIENT_SECRET) {
+    providers.push({ providerId: "github", displayName: "GitHub" });
+  }
+  if (env.AUTH_CLOUDFLARE_CLIENT_ID && env.AUTH_CLOUDFLARE_CLIENT_SECRET) {
+    providers.push({ providerId: "cloudflare", displayName: "Cloudflare" });
+  }
+  return providers;
+}
+
+export async function sendOperatorInvitationEmail(
+  env: BetterAuthEnv,
+  invitation: { email: string; inviteUrl: string; role: string; expiresAt: string },
+): Promise<void> {
+  const role = invitation.role.replaceAll("_", " ");
+  await sendAuthEmail(env, {
+    to: invitation.email,
+    subject: "You are invited to Safest Resolve",
+    heading: "Join Safest Resolve",
+    body: `You were invited as ${role}. This single-use invitation expires ${new Date(invitation.expiresAt).toUTCString()}.`,
+    action: "Accept invitation",
+    url: invitation.inviteUrl,
+  });
+}
+
+function createBetterAuth(env: BetterAuthEnv, ctx?: ExecutionContext) {
+  const secret = authSecret(env);
+  const baseURL = new URL(env.PUBLIC_BASE_URL).origin;
+  const development = localDevelopment(env);
+  const cloudflare = cloudflareProvider(env);
+  const plugins = [genericOAuth({ config: cloudflare ? [cloudflare] : [] })];
+  return betterAuth({
+    appName: "Safest Resolve",
+    baseURL,
+    basePath: "/api/auth",
+    trustedOrigins: development ? [baseURL, "http://localhost:*", "http://127.0.0.1:*"] : [baseURL],
+    secret,
+    database: env.DB,
+    telemetry: { enabled: false },
+    user: {
+      modelName: "auth_user",
+      async validateUserInfo({ user, source }, endpoint) {
+        if (source.action === "create-user") return identityMayCreateUser(env, user.email, endpoint.request);
+        if (source.action === "link-account" || source.action === "sign-in") {
+          return identityMaySignIn(env, user.email, endpoint.request);
+        }
+      },
+    },
+    session: {
+      modelName: "auth_session",
+      expiresIn: 12 * 60 * 60,
+      updateAge: 60 * 60,
+    },
+    account: {
+      modelName: "auth_account",
+      encryptOAuthTokens: true,
+      accountLinking: {
+        enabled: true,
+        allowDifferentEmails: false,
+        trustedProviders: ["google", "github", "cloudflare"],
+      },
+    },
+    verification: { modelName: "auth_verification", storeIdentifier: "hashed" },
+    emailAndPassword: {
+      enabled: true,
+      minPasswordLength: 12,
+      maxPasswordLength: 128,
+      requireEmailVerification: !development,
+      autoSignIn: development,
+      revokeSessionsOnPasswordReset: true,
+      resetPasswordTokenExpiresIn: 30 * 60,
+      async sendResetPassword({ user, token }) {
+        const resetUrl = `${baseURL}/#reset=${encodeURIComponent(token)}`;
+        await deliverAuthEmail(env, ctx, {
+          to: user.email,
+          subject: "Reset your Safest Resolve password",
+          heading: "Reset your password",
+          body: "Use this one-time link within 30 minutes. Resetting your password signs out your other sessions.",
+          action: "Reset password",
+          url: resetUrl,
+        });
+      },
+    },
+    emailVerification: {
+      sendOnSignUp: !development,
+      sendOnSignIn: !development,
+      autoSignInAfterVerification: true,
+      expiresIn: 24 * 60 * 60,
+      async sendVerificationEmail({ user, url }) {
+        await deliverAuthEmail(env, ctx, {
+          to: user.email,
+          subject: "Verify your Safest Resolve email",
+          heading: "Verify your email",
+          body: "Confirm this address before signing in. This link expires in 24 hours and can be used once.",
+          action: "Verify email",
+          url,
+        });
+      },
+    },
+    socialProviders: {
+      ...(env.AUTH_GOOGLE_CLIENT_ID && env.AUTH_GOOGLE_CLIENT_SECRET ? {
+        google: {
+          clientId: env.AUTH_GOOGLE_CLIENT_ID,
+          clientSecret: env.AUTH_GOOGLE_CLIENT_SECRET,
+          requireEmailVerification: true,
+        },
+      } : {}),
+      ...(env.AUTH_GITHUB_CLIENT_ID && env.AUTH_GITHUB_CLIENT_SECRET ? {
+        github: {
+          clientId: env.AUTH_GITHUB_CLIENT_ID,
+          clientSecret: env.AUTH_GITHUB_CLIENT_SECRET,
+          requireEmailVerification: true,
+        },
+      } : {}),
+    },
+    rateLimit: { enabled: true, storage: "database", modelName: "auth_rate_limit" },
+    advanced: {
+      database: { generateId: "uuid", joins: true },
+      ipAddress: { ipAddressHeaders: ["cf-connecting-ip"] },
+      useSecureCookies: !development,
+      cookiePrefix: "safest_auth",
+      ...(ctx ? { backgroundTasks: { handler: (promise: Promise<unknown>) => ctx.waitUntil(promise) } } : {}),
+    },
+    plugins,
+    onAPIError: {
+      onError(error) {
+        console.error("Better Auth request failed", error instanceof Error ? error.message : typeof error);
+      },
+    },
+  });
+}
+
+const migrationPromises = new WeakMap<object, Promise<void>>();
+
+function ensureBetterAuthMigrations(
+  auth: ReturnType<typeof createBetterAuth>,
+  database: D1Database,
+): Promise<void> {
+  const key = database as unknown as object;
+  const existing = migrationPromises.get(key);
+  if (existing) return existing;
+  const migration = getMigrations(auth.options).then(async ({ runMigrations }) => {
+    await runMigrations();
+  }).catch((error) => {
+    migrationPromises.delete(key);
+    throw error;
+  });
+  migrationPromises.set(key, migration);
+  return migration;
+}
+
+export async function handleBetterAuthRequest(
+  request: Request,
+  env: BetterAuthEnv,
+  ctx: ExecutionContext,
+): Promise<Response> {
+  const auth = createBetterAuth(env, ctx);
+  await ensureBetterAuthMigrations(auth, env.DB);
+  return auth.handler(request);
+}
+
+export async function callBetterAuth(
+  request: Request,
+  env: BetterAuthEnv,
+  ctx: ExecutionContext,
+  path: string,
+  body: Record<string, unknown>,
+  cookie?: string,
+): Promise<Response> {
+  const url = new URL(`/api/auth${path}`, request.url);
+  const headers = new Headers(request.headers);
+  headers.set("content-type", "application/json");
+  headers.delete("content-length");
+  if (cookie) headers.set("cookie", cookie);
+  const internal = new Request(url, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(body),
+  });
+  return handleBetterAuthRequest(internal, env, ctx);
+}
+
+export async function resolveBetterAuthSession(
+  request: Request,
+  env: BetterAuthEnv,
+): Promise<BetterAuthSession | null> {
+  const auth = createBetterAuth(env);
+  await ensureBetterAuthMigrations(auth, env.DB);
+  const session = await auth.api.getSession({ headers: request.headers });
+  return session as BetterAuthSession | null;
+}
+
+export async function revokeBetterAuthSessionsForOperator(
+  env: BetterAuthEnv,
+  operatorUserId: string,
+): Promise<number> {
+  const auth = createBetterAuth(env);
+  await ensureBetterAuthMigrations(auth, env.DB);
+  const result = await env.DB.prepare(`
+    DELETE FROM auth_session
+    WHERE userId IN (
+      SELECT auth_user.id
+      FROM auth_user JOIN operator_users ON operator_users.email = auth_user.email COLLATE NOCASE
+      WHERE operator_users.id = ?1
+    )
+  `).bind(operatorUserId).run();
+  return Number(result.meta.changes ?? 0);
+}
+
+export async function betterAuthCsrfToken(
+  env: BetterAuthEnv,
+  sessionId: string,
+): Promise<string> {
+  return hmac(`safest-csrf:${sessionId}`, authSecret(env));
+}
+
+export async function betterAuthCsrfHash(token: string): Promise<string> {
+  return sha256(token);
+}
+
+export function appendBetterAuthCsrfCookie(
+  response: Response,
+  request: Request,
+  token: string,
+  expiresAt: Date,
+): Response {
+  const secure = new URL(request.url).protocol === "https:";
+  const name = secure ? "__Host-safest_csrf" : "safest_csrf";
+  const maxAge = Math.max(0, Math.floor((expiresAt.valueOf() - Date.now()) / 1_000));
+  const headers = new Headers(response.headers);
+  headers.append(
+    "set-cookie",
+    `${name}=${token}; Path=/; Max-Age=${maxAge}; SameSite=Strict${secure ? "; Secure" : ""}`,
+  );
+  headers.append(
+    "set-cookie",
+    `${INVITATION_COOKIE}=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax${secure ? "; Secure" : ""}`,
+  );
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+  });
+}
+
+export async function inspectInvitation(
+  request: Request,
+  env: BetterAuthEnv,
+): Promise<Response> {
+  if (request.method !== "POST") return new Response("Method Not Allowed", { status: 405, headers: { allow: "POST" } });
+  const body = await request.json().catch(() => null) as { token?: unknown } | null;
+  const token = typeof body?.token === "string" ? body.token : "";
+  const invitation = await findPendingInvitationByToken(env, token);
+  if (!invitation) {
+    return Response.json({ error: { code: "invalid_invitation", message: "This invitation link is invalid or expired." } }, { status: 400 });
+  }
+  const secure = new URL(request.url).protocol === "https:";
+  const maxAge = Math.min(
+    INVITATION_MAX_AGE_SECONDS,
+    Math.max(0, Math.floor((Date.parse(invitation.expires_at) - Date.now()) / 1_000)),
+  );
+  const headers = new Headers({ "cache-control": "no-store" });
+  headers.append(
+    "set-cookie",
+    `${INVITATION_COOKIE}=${await invitationCookieValue(invitation.id, env)}; Path=/; ` +
+      `Max-Age=${maxAge}; HttpOnly; SameSite=Lax${secure ? "; Secure" : ""}`,
+  );
+  return Response.json({
+    schema_version: "1",
+    invitation: {
+      email: invitation.email,
+      role: invitation.role,
+      expires_at: invitation.expires_at,
+    },
+  }, { headers });
+}