elm-ssr 1.0.4 → 1.0.5

package/bin/elm-ssr.mjs

@@ -13,6 +13,11 @@ const defaultRootPath = process.cwd();
 const args = process.argv.slice(2);
 const command = args[0] ?? "help";
 
+const ownPkg = JSON.parse(
+  await readFile(new URL("../package.json", import.meta.url), "utf8")
+);
+const VERSION = ownPkg.version;
+
 const findFlagValue = (flagName) => {
   const index = args.indexOf(flagName);
   return index >= 0 ? args[index + 1] : undefined;
@@ -71,7 +76,7 @@ const run = async (cmd, cmdArgs, cwd = rootPath) => {
 };
 
 const printHelp = () => {
-  console.log(`elm-ssr commands
+  console.log(`elm-ssr ${VERSION}
 
   build         Generate wrapper modules and compile configured Elm SSR apps
   compress      Pre-compress island and app bundles using Gzip for faster edge delivery
@@ -85,6 +90,7 @@ const printHelp = () => {
   query         Generate type-safe Elm Db modules from SQL table definitions
   info          Print current workspace package and configured app names
   migrate ...   Apply / revert / inspect SQL migrations (see: elm-ssr migrate --help)
+  version       Print the elm-ssr version
 `);
 };
 
@@ -105,6 +111,11 @@ const requireConfig = () => {
   }
 };
 
+if (command === "--version" || command === "-v" || command === "version") {
+  console.log(VERSION);
+  process.exit(0);
+}
+
 switch (command) {
   case "build":
   case "compress":

package/lib/scaffold.mjs

@@ -536,6 +536,10 @@ const getConfig = (env: any): Auth0Config => ({
   callbackUrl: (env?.AUTH0_CALLBACK_URL as string) ?? "http://localhost:8787/api/auth/callback",
 });
 
+// Use http for localhost (dev/test mock servers), https for real Auth0 domains.
+const proto = (domain: string) =>
+  domain.startsWith("localhost") || domain.startsWith("127.") ? "http" : "https";
+
 export const handleAuth = async (
   request: Request,
   env: any,
@@ -557,14 +561,14 @@ export const handleAuth = async (
       redirect_uri: config.callbackUrl,
       scope: "openid profile email",
     });
-    return Response.redirect(\`https://\${config.domain}/authorize?\${params}\`, 302);
+    return Response.redirect(\`\${proto(config.domain)}://\${config.domain}/authorize?\${params}\`, 302);
   }
 
   if (url.pathname === "/api/auth/callback") {
     const code = url.searchParams.get("code");
     if (!code) return new Response("Missing code", { status: 400 });
 
-    const tokenRes = await fetch(\`https://\${config.domain}/oauth/token\`, {
+    const tokenRes = await fetch(\`\${proto(config.domain)}://\${config.domain}/oauth/token\`, {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify({
@@ -618,7 +622,7 @@ export const handleAuth = async (
       status: 302,
       headers: {
         "Set-Cookie": "session=; Path=/; Max-Age=0; HttpOnly",
-        Location: \`https://\${config.domain}/oidc/logout?\${params}\`,
+        Location: \`\${proto(config.domain)}://\${config.domain}/oidc/logout?\${params}\`,
       },
     });
   }
@@ -652,9 +656,10 @@ const runtimeTemplate = (appRoot, db = false, auth = undefined) => {
     imports.push(`import { sessionEffects } from "elm-ssr/sessions";`);
     imports.push(`import type { Middleware } from "elm-ssr/http";`);
     imports.push(`import type { RequestSession } from "elm-ssr/sessions";`);
-    imports.push(`import { createAuth, handleAuth } from "./src/Endpoints/Auth";`);
+    imports.push(`import { createAuth } from "./src/Endpoints/Auth";`);
   } else if (isAuth0) {
     imports.push(`import { memorySessionStore } from "elm-ssr/sessions";`);
+    imports.push(`import type { Middleware } from "elm-ssr/http";`);
     imports.push(`import { handleAuth } from "./src/Endpoints/Auth";`);
   }
 
@@ -712,7 +717,9 @@ if (typeof Bun !== "undefined") {
   }`;
 
   const effectsConfig = isBetterAuth
-    ? `,\n  effects: sessionEffects(${baseEffectsBody}),\n  middlewares: [betterAuthBridge]`
+    ? `,\n  effects: sessionEffects(${baseEffectsBody}),\n  middlewares: [betterAuthHandler, betterAuthBridge]`
+    : isAuth0
+    ? `,\n  effects: ${baseEffectsBody},\n  middlewares: [auth0Handler]`
     : `,\n  effects: ${baseEffectsBody}`;
 
   // Auth0 keeps elm-ssr session middleware; BetterAuth manages sessions itself.
@@ -732,10 +739,30 @@ if (typeof (globalThis as any).Bun !== "undefined") {
 const getAuthEnv = (env: any): any =>
   bunAuthDb && !env?.DB ? { ...(env ?? {}), DB: bunAuthDb } : env;
 
-// Bridge: reads BetterAuth session on every request so Loader.requireUser works.
+// Singleton: BetterAuth is initialised once per worker isolate, not per request.
+// Cloudflare's D1 binding is stable within an isolate; bun:sqlite is module-level too.
+let _auth: ReturnType<typeof createAuth> | null = null;
+const getAuth = (env: any) => (_auth ??= createAuth(getAuthEnv(env)));
+
+// Handles all /api/auth/* requests: BetterAuth routes + the dashboard validation endpoint.
+const betterAuthHandler: Middleware = async (context, next) => {
+  if (!context.url.pathname.startsWith("/api/auth/")) return next(context);
+  // BetterAuth's online dashboard calls this to confirm the server is reachable
+  // before saving configuration changes. Not in BetterAuth's npm package.
+  if (context.url.pathname === "/api/auth/dash/validate") {
+    const challenge = context.url.searchParams.get("challenge");
+    return new Response(challenge ?? JSON.stringify({ ok: true }), {
+      status: 200,
+      headers: { "content-type": challenge ? "text/plain" : "application/json" },
+    });
+  }
+  return getAuth(context.env).handler(context.request);
+};
+
+// Bridge: reads BetterAuth session before every Elm render so Loader.requireUser works.
 const betterAuthBridge: Middleware = async (context, next) => {
   try {
-    const session = await createAuth(getAuthEnv(context.env)).api.getSession({
+    const session = await getAuth(context.env).api.getSession({
       headers: context.request.headers,
     });
     const user = session?.user
@@ -758,43 +785,31 @@ const betterAuthBridge: Middleware = async (context, next) => {
 };
 `;
   } else if (isAuth0) {
-    authInit = `\nexport const sessionStore = memorySessionStore();\n`;
+    authInit = `
+export const sessionStore = memorySessionStore();
+
+// Handles all /api/auth/* requests (login redirect, OAuth callback, logout).
+// Runs inside elm-ssr's middleware stack so logging and error handling apply.
+// Sets session.isNew = false to prevent sessionMiddleware from appending a
+// competing Set-Cookie on top of the one the auth handler already set.
+const auth0Handler: Middleware = async (context, next) => {
+  if (!context.url.pathname.startsWith("/api/auth/")) return next(context);
+  if (context.session) context.session.isNew = false;
+  const secret = (context.env?.SESSION_SECRET as string) || "change-me-to-a-secure-random-hmac-secret-key-that-is-at-least-32-chars";
+  return handleAuth(context.request, context.env, { store: sessionStore, secret });
+};
+`;
     sessionsConfig = `,
   sessions: {
     secret: (env) => (env?.SESSION_SECRET as string) || "change-me-to-a-secure-random-hmac-secret-key-that-is-at-least-32-chars",
     store: sessionStore,
     secure: false
   },
-  csrf: true`;
+  csrf: { skipPaths: ["/api/auth/"] }`;
   }
 
-  let authIntercept = '';
-  if (isBetterAuth) {
-    authIntercept = `
-// Delegate all /api/auth/* requests to BetterAuth, injecting the local db when needed.
-const baseWorkerFetch = worker.fetch;
-worker.fetch = async (request, env, ctx) => {
-  const url = new URL(request.url);
-  if (url.pathname.startsWith("/api/auth/")) {
-    return handleAuth(request, getAuthEnv(env));
-  }
-  return baseWorkerFetch(request, env, ctx);
-};
-`;
-  } else if (isAuth0) {
-    authIntercept = `
-// Delegate all /api/auth/* requests to the Auth0 handler.
-const baseWorkerFetch = worker.fetch;
-worker.fetch = async (request, env, ctx) => {
-  const url = new URL(request.url);
-  if (url.pathname.startsWith("/api/auth/")) {
-    const secret = (env?.SESSION_SECRET as string) || "change-me-to-a-secure-random-hmac-secret-key-that-is-at-least-32-chars";
-    return handleAuth(request, env, { store: sessionStore, secret });
-  }
-  return baseWorkerFetch(request, env, ctx);
-};
-`;
-  }
+  // Auth routing is handled entirely through elm-ssr's middlewares option —
+  // no worker.fetch wrapping needed.
 
   return `${imports.join("\n")}
 
@@ -888,7 +903,6 @@ export const worker = createWorkerApp({
   routes,
   createFlags${sessionsConfig}${effectsConfig}
 });
-${authIntercept}
 `;
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "elm-ssr",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Elm-first SSR library and framework for Cloudflare Workers (and Bun): file-based routes/islands, backend-neutral effect adapters (KV/D1/Redis/Postgres), background tasks (waitUntil/Queues), SQL-file migrations, CLI scaffold + build.",
   "license": "MIT",
   "author": "Michał Majchrzak <michmajchrzak@gmail.com>",