elm-ssr 1.0.3 → 1.0.5

package/bin/elm-ssr.mjs

@@ -13,6 +13,11 @@ const defaultRootPath = process.cwd();
 const args = process.argv.slice(2);
 const command = args[0] ?? "help";
 
+const ownPkg = JSON.parse(
+  await readFile(new URL("../package.json", import.meta.url), "utf8")
+);
+const VERSION = ownPkg.version;
+
 const findFlagValue = (flagName) => {
   const index = args.indexOf(flagName);
   return index >= 0 ? args[index + 1] : undefined;
@@ -71,7 +76,7 @@ const run = async (cmd, cmdArgs, cwd = rootPath) => {
 };
 
 const printHelp = () => {
-  console.log(`elm-ssr commands
+  console.log(`elm-ssr ${VERSION}
 
   build         Generate wrapper modules and compile configured Elm SSR apps
   compress      Pre-compress island and app bundles using Gzip for faster edge delivery
@@ -85,6 +90,7 @@ const printHelp = () => {
   query         Generate type-safe Elm Db modules from SQL table definitions
   info          Print current workspace package and configured app names
   migrate ...   Apply / revert / inspect SQL migrations (see: elm-ssr migrate --help)
+  version       Print the elm-ssr version
 `);
 };
 
@@ -105,6 +111,11 @@ const requireConfig = () => {
   }
 };
 
+if (command === "--version" || command === "-v" || command === "version") {
+  console.log(VERSION);
+  process.exit(0);
+}
+
 switch (command) {
   case "build":
   case "compress":

package/lib/scaffold.mjs

@@ -495,23 +495,17 @@ view user =
 `;
 
 const betterAuthEndpointTemplate = () => `import { betterAuth } from "better-auth";
-import type { Middleware } from "elm-ssr/http";
-import type { RequestSession } from "elm-ssr/sessions";
-
-// BetterAuth is initialised per-request to pick up the right DB binding.
-// Production (Cloudflare Workers): env.DB is the D1 binding.
-// Local dev (Bun): falls back to bun:sqlite using app.db.
-const createAuth = (env: any) => {
-  const db = env?.DB ?? (() => {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const { Database } = require("bun:sqlite");
-    return new Database("app.db");
-  })();
-
-  return betterAuth({
+
+// BetterAuth is initialised per-request to pick up the right database binding.
+// On Cloudflare Workers env.DB is the D1 binding; on Bun (local dev) the
+// runtime injects a bun:sqlite Database as env.DB — see runtime.ts.
+// Pass env.DB directly so BetterAuth's adapter auto-detects the dialect
+// (D1 via "batch"/"exec"/"prepare", bun:sqlite via "fileControl").
+export const createAuth = (env: any) =>
+  betterAuth({
     baseURL: (env?.BETTER_AUTH_URL as string) ?? "http://localhost:8787",
     secret: (env?.BETTER_AUTH_SECRET as string) ?? "change-me-in-production",
-    database: { type: "sqlite", db },
+    database: env?.DB,
     emailAndPassword: { enabled: true },
     // Uncomment to add social providers (add matching env vars in .dev.vars):
     // socialProviders: {
@@ -521,39 +515,9 @@ const createAuth = (env: any) => {
     //   },
     // },
   });
-};
 
 export const handleAuth = (request: Request, env: any): Promise<Response> =>
   createAuth(env).handler(request);
-
-// Reads the BetterAuth session from the request and returns the user.
-const getSessionUser = async (
-  request: Request,
-  env: any
-): Promise<{ email: string; name: string } | null> => {
-  try {
-    const session = await createAuth(env).api.getSession({ headers: request.headers });
-    if (!session?.user) return null;
-    return { email: session.user.email, name: session.user.name ?? session.user.email };
-  } catch {
-    return null;
-  }
-};
-
-// elm-ssr middleware: reads BetterAuth's session and injects the user into
-// context.session so Loader.session / Loader.requireUser work on every request.
-export const betterAuthMiddleware: Middleware = async (context, next) => {
-  const user = await getSessionUser(context.request, context.env);
-  context.session = {
-    id: user ? \`ba:\${user.email}\` : "",
-    data: user,
-    csrf: "",
-    dirty: false,
-    destroyed: false,
-    isNew: false,
-  } as RequestSession;
-  return next(context);
-};
 `;
 
 const auth0EndpointTemplate = () => `import { generateSessionId, signValue, generateCsrfToken, readSignedCookie } from "elm-ssr/sessions";
@@ -572,6 +536,10 @@ const getConfig = (env: any): Auth0Config => ({
   callbackUrl: (env?.AUTH0_CALLBACK_URL as string) ?? "http://localhost:8787/api/auth/callback",
 });
 
+// Use http for localhost (dev/test mock servers), https for real Auth0 domains.
+const proto = (domain: string) =>
+  domain.startsWith("localhost") || domain.startsWith("127.") ? "http" : "https";
+
 export const handleAuth = async (
   request: Request,
   env: any,
@@ -593,14 +561,14 @@ export const handleAuth = async (
       redirect_uri: config.callbackUrl,
       scope: "openid profile email",
     });
-    return Response.redirect(\`https://\${config.domain}/authorize?\${params}\`, 302);
+    return Response.redirect(\`\${proto(config.domain)}://\${config.domain}/authorize?\${params}\`, 302);
   }
 
   if (url.pathname === "/api/auth/callback") {
     const code = url.searchParams.get("code");
     if (!code) return new Response("Missing code", { status: 400 });
 
-    const tokenRes = await fetch(\`https://\${config.domain}/oauth/token\`, {
+    const tokenRes = await fetch(\`\${proto(config.domain)}://\${config.domain}/oauth/token\`, {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify({
@@ -654,7 +622,7 @@ export const handleAuth = async (
       status: 302,
       headers: {
         "Set-Cookie": "session=; Path=/; Max-Age=0; HttpOnly",
-        Location: \`https://\${config.domain}/oidc/logout?\${params}\`,
+        Location: \`\${proto(config.domain)}://\${config.domain}/oidc/logout?\${params}\`,
       },
     });
   }
@@ -686,9 +654,12 @@ const runtimeTemplate = (appRoot, db = false, auth = undefined) => {
 
   if (isBetterAuth) {
     imports.push(`import { sessionEffects } from "elm-ssr/sessions";`);
-    imports.push(`import { handleAuth, betterAuthMiddleware } from "./src/Endpoints/Auth";`);
+    imports.push(`import type { Middleware } from "elm-ssr/http";`);
+    imports.push(`import type { RequestSession } from "elm-ssr/sessions";`);
+    imports.push(`import { createAuth } from "./src/Endpoints/Auth";`);
   } else if (isAuth0) {
     imports.push(`import { memorySessionStore } from "elm-ssr/sessions";`);
+    imports.push(`import type { Middleware } from "elm-ssr/http";`);
     imports.push(`import { handleAuth } from "./src/Endpoints/Auth";`);
   }
 
@@ -746,51 +717,100 @@ if (typeof Bun !== "undefined") {
   }`;
 
   const effectsConfig = isBetterAuth
-    ? `,\n  effects: sessionEffects(${baseEffectsBody}),\n  middlewares: [betterAuthMiddleware]`
+    ? `,\n  effects: sessionEffects(${baseEffectsBody}),\n  middlewares: [betterAuthHandler, betterAuthBridge]`
+    : isAuth0
+    ? `,\n  effects: ${baseEffectsBody},\n  middlewares: [auth0Handler]`
     : `,\n  effects: ${baseEffectsBody}`;
 
   // Auth0 keeps elm-ssr session middleware; BetterAuth manages sessions itself.
   let sessionsConfig = '';
   let authInit = '';
-  if (isAuth0) {
-    authInit = `\nexport const sessionStore = memorySessionStore();\n`;
-    sessionsConfig = `,
-  sessions: {
-    secret: (env) => (env?.SESSION_SECRET as string) || "change-me-to-a-secure-random-hmac-secret-key-that-is-at-least-32-chars",
-    store: sessionStore,
-    secure: false
-  },
-  csrf: true`;
+  if (isBetterAuth) {
+    authInit = `
+// Local dev: open a SQLite database so BetterAuth works without a Cloudflare D1 binding.
+// On Cloudflare Workers this block is eliminated by esbuild (typeof Bun is statically "undefined").
+let bunAuthDb: any = undefined;
+if (typeof (globalThis as any).Bun !== "undefined") {
+  const sqliteModule = "bun" + ":sqlite";
+  const { Database } = require(sqliteModule);
+  bunAuthDb = new Database(import.meta.dir + "/app.db");
+}
+
+const getAuthEnv = (env: any): any =>
+  bunAuthDb && !env?.DB ? { ...(env ?? {}), DB: bunAuthDb } : env;
+
+// Singleton: BetterAuth is initialised once per worker isolate, not per request.
+// Cloudflare's D1 binding is stable within an isolate; bun:sqlite is module-level too.
+let _auth: ReturnType<typeof createAuth> | null = null;
+const getAuth = (env: any) => (_auth ??= createAuth(getAuthEnv(env)));
+
+// Handles all /api/auth/* requests: BetterAuth routes + the dashboard validation endpoint.
+const betterAuthHandler: Middleware = async (context, next) => {
+  if (!context.url.pathname.startsWith("/api/auth/")) return next(context);
+  // BetterAuth's online dashboard calls this to confirm the server is reachable
+  // before saving configuration changes. Not in BetterAuth's npm package.
+  if (context.url.pathname === "/api/auth/dash/validate") {
+    const challenge = context.url.searchParams.get("challenge");
+    return new Response(challenge ?? JSON.stringify({ ok: true }), {
+      status: 200,
+      headers: { "content-type": challenge ? "text/plain" : "application/json" },
+    });
   }
+  return getAuth(context.env).handler(context.request);
+};
 
-  let authIntercept = '';
-  if (isBetterAuth) {
-    authIntercept = `
-// Delegate all /api/auth/* requests to BetterAuth.
-const baseWorkerFetch = worker.fetch;
-worker.fetch = async (request, env, ctx) => {
-  const url = new URL(request.url);
-  if (url.pathname.startsWith("/api/auth/")) {
-    return handleAuth(request, env);
+// Bridge: reads BetterAuth session before every Elm render so Loader.requireUser works.
+const betterAuthBridge: Middleware = async (context, next) => {
+  try {
+    const session = await getAuth(context.env).api.getSession({
+      headers: context.request.headers,
+    });
+    const user = session?.user
+      ? { email: session.user.email, name: session.user.name ?? session.user.email }
+      : null;
+    context.session = {
+      id: user ? \`ba:\${user.email}\` : "",
+      data: user,
+      csrf: "",
+      dirty: false,
+      destroyed: false,
+      isNew: false,
+    } as RequestSession;
+  } catch {
+    context.session = {
+      id: "", data: null, csrf: "", dirty: false, destroyed: false, isNew: false,
+    } as RequestSession;
   }
-  return baseWorkerFetch(request, env, ctx);
+  return next(context);
 };
 `;
   } else if (isAuth0) {
-    authIntercept = `
-// Delegate all /api/auth/* requests to the Auth0 handler.
-const baseWorkerFetch = worker.fetch;
-worker.fetch = async (request, env, ctx) => {
-  const url = new URL(request.url);
-  if (url.pathname.startsWith("/api/auth/")) {
-    const secret = (env?.SESSION_SECRET as string) || "change-me-to-a-secure-random-hmac-secret-key-that-is-at-least-32-chars";
-    return handleAuth(request, env, { store: sessionStore, secret });
-  }
-  return baseWorkerFetch(request, env, ctx);
+    authInit = `
+export const sessionStore = memorySessionStore();
+
+// Handles all /api/auth/* requests (login redirect, OAuth callback, logout).
+// Runs inside elm-ssr's middleware stack so logging and error handling apply.
+// Sets session.isNew = false to prevent sessionMiddleware from appending a
+// competing Set-Cookie on top of the one the auth handler already set.
+const auth0Handler: Middleware = async (context, next) => {
+  if (!context.url.pathname.startsWith("/api/auth/")) return next(context);
+  if (context.session) context.session.isNew = false;
+  const secret = (context.env?.SESSION_SECRET as string) || "change-me-to-a-secure-random-hmac-secret-key-that-is-at-least-32-chars";
+  return handleAuth(context.request, context.env, { store: sessionStore, secret });
 };
 `;
+    sessionsConfig = `,
+  sessions: {
+    secret: (env) => (env?.SESSION_SECRET as string) || "change-me-to-a-secure-random-hmac-secret-key-that-is-at-least-32-chars",
+    store: sessionStore,
+    secure: false
+  },
+  csrf: { skipPaths: ["/api/auth/"] }`;
   }
 
+  // Auth routing is handled entirely through elm-ssr's middlewares option —
+  // no worker.fetch wrapping needed.
+
   return `${imports.join("\n")}
 
 const elmModule = ElmRuntime as CompiledElmModule;
@@ -883,7 +903,6 @@ export const worker = createWorkerApp({
   routes,
   createFlags${sessionsConfig}${effectsConfig}
 });
-${authIntercept}
 `;
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "elm-ssr",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Elm-first SSR library and framework for Cloudflare Workers (and Bun): file-based routes/islands, backend-neutral effect adapters (KV/D1/Redis/Postgres), background tasks (waitUntil/Queues), SQL-file migrations, CLI scaffold + build.",
   "license": "MIT",
   "author": "Michał Majchrzak <michmajchrzak@gmail.com>",