jazz-tools 0.19.18 → 0.19.19

package/.svelte-kit/__package__/client.d.ts

@@ -0,0 +1,29 @@
+import type { Account, AuthSecretStorage, JazzContextType } from "jazz-tools";
+import type { jazzPlugin } from "./server.js";
+/**
+ * @example
+ * ```ts
+ * const auth = betterAuth({
+ *   plugins: [jazzPluginClient()],
+ * });
+ * ```
+ */
+export declare const jazzPluginClient: () => {
+    id: "jazz-plugin";
+    $InferServerPlugin: ReturnType<typeof jazzPlugin>;
+    getActions: ($fetch: import("@better-fetch/fetch").BetterFetch, $store: import("better-auth").ClientStore) => {
+        jazz: {
+            setJazzContext: (context: JazzContextType<Account>) => void;
+            setAuthSecretStorage: (storage: AuthSecretStorage) => void;
+        };
+    };
+    fetchPlugins: {
+        id: string;
+        name: string;
+        hooks: {
+            onRequest<T extends Record<string, any>>(context: import("@better-fetch/fetch").RequestContext<T>): Promise<void>;
+            onSuccess(context: import("@better-fetch/fetch").SuccessContext<any>): Promise<void>;
+        };
+    }[];
+};
+//# sourceMappingURL=client.d.ts.map

package/.svelte-kit/__package__/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/better-auth/auth/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,OAAO,EACP,iBAAiB,EAEjB,eAAe,EAChB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAS9C;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;;wBAmBC,UAAU,CAAC,OAAO,UAAU,CAAC;;;sCAIvB,eAAe,CAAC,OAAO,CAAC;4CAGlB,iBAAiB;;;;;;;;;;;CA6H1D,CAAC"}

package/.svelte-kit/__package__/client.js

@@ -0,0 +1,138 @@
+const SIGNUP_URLS = [
+    "/sign-up",
+    "/sign-in/social",
+    "/sign-in/oauth2",
+    "/email-otp/send-verification-otp",
+];
+/**
+ * @example
+ * ```ts
+ * const auth = betterAuth({
+ *   plugins: [jazzPluginClient()],
+ * });
+ * ```
+ */
+export const jazzPluginClient = () => {
+    let jazzContext;
+    let authSecretStorage;
+    let signOutUnsubscription;
+    const authenticateOnJazz = async (jazzAuth) => {
+        const parsedJazzAuth = {
+            ...jazzAuth,
+            secretSeed: jazzAuth.secretSeed
+                ? Uint8Array.from(jazzAuth.secretSeed)
+                : undefined,
+        };
+        await jazzContext.authenticate(parsedJazzAuth);
+        await authSecretStorage.set(parsedJazzAuth);
+    };
+    return {
+        id: "jazz-plugin",
+        $InferServerPlugin: {},
+        getActions: ($fetch, $store) => {
+            return {
+                jazz: {
+                    setJazzContext: (context) => {
+                        jazzContext = context;
+                    },
+                    setAuthSecretStorage: (storage) => {
+                        authSecretStorage = storage;
+                        if (signOutUnsubscription)
+                            signOutUnsubscription();
+                        // This is a workaround to logout from Better Auth when user logs out directly from Jazz
+                        signOutUnsubscription = authSecretStorage.onUpdate((isAuthenticated) => {
+                            if (isAuthenticated === false) {
+                                const session = $store.atoms.session?.get();
+                                if (!session)
+                                    return;
+                                // if the user logs out from Better Auth, the get session is immediately called
+                                // so we must wait the next fetched session to understand if we need to call sign-out
+                                if (session.isPending || session.isRefetching) {
+                                    // listen once for next session's data
+                                    const unsub = $store.atoms.session?.listen((session) => {
+                                        unsub?.();
+                                        // if the session is null, user has been already logged out from Better Auth
+                                        if (session.data !== null) {
+                                            $fetch("/sign-out", { method: "POST" });
+                                        }
+                                    });
+                                }
+                                // if the session is not pending, it means user logged out from Jazz only
+                                // so we call the sign-out api
+                                else {
+                                    $fetch("/sign-out", { method: "POST" });
+                                }
+                            }
+                        });
+                    },
+                },
+            };
+        },
+        fetchPlugins: [
+            {
+                id: "jazz-plugin",
+                name: "jazz-plugin",
+                hooks: {
+                    async onRequest(context) {
+                        if (SIGNUP_URLS.some((url) => context.url.toString().includes(url))) {
+                            const credentials = await authSecretStorage.get();
+                            if (!credentials) {
+                                throw new Error("Jazz credentials not found");
+                            }
+                            context.headers.set("x-jazz-auth", JSON.stringify({
+                                accountID: credentials.accountID,
+                                secretSeed: credentials.secretSeed,
+                                accountSecret: credentials.accountSecret,
+                            }));
+                        }
+                    },
+                    async onSuccess(context) {
+                        if (context.request.url.toString().includes("/sign-up")) {
+                            await authenticateOnJazz(context.data.jazzAuth);
+                            return;
+                        }
+                        if (context.request.url.toString().includes("/sign-in/email")) {
+                            await authenticateOnJazz(context.data.jazzAuth);
+                            return;
+                        }
+                        if (context.request.url.toString().includes("/get-session")) {
+                            if (context.data === null) {
+                                if (authSecretStorage.isAuthenticated === true) {
+                                    console.info("Jazz is authenticated, but the session is null. Logging out");
+                                    await jazzContext.logOut();
+                                }
+                                return;
+                            }
+                            if (!context.data?.user) {
+                                return;
+                            }
+                            if (authSecretStorage.isAuthenticated === false) {
+                                console.info("Jazz is not authenticated, using Better Auth stored credentials");
+                                await authenticateOnJazz(context.data.jazzAuth);
+                                return;
+                            }
+                            const sessionAccountID = context.data.user.accountID;
+                            const credentials = await authSecretStorage.get();
+                            if (!credentials) {
+                                throw new Error("Jazz credentials not found");
+                            }
+                            if (credentials.accountID !== sessionAccountID) {
+                                console.info("Jazz credentials mismatch, using Better Auth stored credentials");
+                                await authenticateOnJazz(context.data.jazzAuth);
+                            }
+                            return;
+                        }
+                        if (context.request.url.toString().includes("/sign-out")) {
+                            await jazzContext.logOut();
+                            return;
+                        }
+                        if (context.request.url.toString().includes("/delete-user")) {
+                            await jazzContext.logOut();
+                            return;
+                        }
+                    },
+                },
+            },
+        ],
+    };
+};

package/.svelte-kit/__package__/react.d.ts

@@ -0,0 +1,28 @@
+import { createAuthClient } from "better-auth/client";
+import { type PropsWithChildren } from "react";
+import { jazzPluginClient } from "./client.js";
+type AuthClient = ReturnType<typeof createAuthClient<{
+    plugins: [ReturnType<typeof jazzPluginClient>];
+}>>;
+/**
+ * @param props.children - The children to render.
+ * @param props.betterAuthClient - The BetterAuth client with the Jazz plugin.
+ *
+ * @example
+ * ```ts
+ * const betterAuthClient = createAuthClient({
+ *   plugins: [
+ *     jazzPluginClient(),
+ *   ],
+ * });
+ *
+ * <AuthProvider betterAuthClient={betterAuthClient}>
+ *   <App />
+ * </AuthProvider>
+ * ```
+ */
+export declare function AuthProvider({ children, betterAuthClient, }: PropsWithChildren<{
+    betterAuthClient: AuthClient;
+}>): import("react").ReactNode;
+export {};
+//# sourceMappingURL=react.d.ts.map

package/.svelte-kit/__package__/react.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../../../src/better-auth/auth/react.tsx"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,KAAK,UAAU,GAAG,UAAU,CAC1B,OAAO,gBAAgB,CAAC;IACtB,OAAO,EAAE,CAAC,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC;CAChD,CAAC,CACH,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,gBAAgB,GACjB,EAAE,iBAAiB,CAAC;IACnB,gBAAgB,EAAE,UAAU,CAAC;CAC9B,CAAC,6BAmBD"}

package/.svelte-kit/__package__/react.tsx

@@ -0,0 +1,56 @@
+"use client";
+
+import { createAuthClient } from "better-auth/client";
+import { useAuthSecretStorage, useJazzContext } from "jazz-tools/react-core";
+import { useEffect } from "react";
+import { type PropsWithChildren } from "react";
+import { jazzPluginClient } from "./client.js";
+
+type AuthClient = ReturnType<
+  typeof createAuthClient<{
+    plugins: [ReturnType<typeof jazzPluginClient>];
+  }>
+>;
+
+/**
+ * @param props.children - The children to render.
+ * @param props.betterAuthClient - The BetterAuth client with the Jazz plugin.
+ *
+ * @example
+ * ```ts
+ * const betterAuthClient = createAuthClient({
+ *   plugins: [
+ *     jazzPluginClient(),
+ *   ],
+ * });
+ *
+ * <AuthProvider betterAuthClient={betterAuthClient}>
+ *   <App />
+ * </AuthProvider>
+ * ```
+ */
+export function AuthProvider({
+  children,
+  betterAuthClient,
+}: PropsWithChildren<{
+  betterAuthClient: AuthClient;
+}>) {
+  const context = useJazzContext();
+  const authSecretStorage = useAuthSecretStorage();
+
+  if (betterAuthClient.jazz === undefined) {
+    throw new Error(
+      "Better Auth client has been initialized without the jazzPluginClient",
+    );
+  }
+
+  useEffect(() => {
+    betterAuthClient.jazz.setJazzContext(context);
+    betterAuthClient.jazz.setAuthSecretStorage(authSecretStorage);
+
+    // We need to subscribe to the session to let the plugin keep sync Jazz's and BetterAuth's session
+    return betterAuthClient.useSession.subscribe(() => {});
+  }, [betterAuthClient, context, authSecretStorage]);
+
+  return children;
+}

package/.svelte-kit/__package__/server.d.ts

@@ -0,0 +1,34 @@
+import { type BetterAuthPlugin } from "better-auth";
+type JazzPlugin = BetterAuthPlugin & {
+    schema: {
+        user: {
+            fields: {
+                accountID: {
+                    type: "string";
+                    required: false;
+                    input: false;
+                };
+                encryptedCredentials: {
+                    type: "string";
+                    required: false;
+                    input: false;
+                    returned: false;
+                };
+            };
+        };
+    };
+};
+/**
+ * @returns The BetterAuth server plugin.
+ *
+ * @example
+ * ```ts
+ * const auth = betterAuth({
+ *   plugins: [jazzPlugin()],
+ *   // ... other BetterAuth options
+ * });
+ * ```
+ */
+export declare const jazzPlugin: () => JazzPlugin;
+export {};
+//# sourceMappingURL=server.d.ts.map

package/.svelte-kit/__package__/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/better-auth/auth/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gBAAgB,EAGtB,MAAM,aAAa,CAAC;AASrB,KAAK,UAAU,GAAG,gBAAgB,GAAG;IACnC,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,SAAS,EAAE;oBACT,IAAI,EAAE,QAAQ,CAAC;oBACf,QAAQ,EAAE,KAAK,CAAC;oBAChB,KAAK,EAAE,KAAK,CAAC;iBACd,CAAC;gBACF,oBAAoB,EAAE;oBACpB,IAAI,EAAE,QAAQ,CAAC;oBACf,QAAQ,EAAE,KAAK,CAAC;oBAChB,KAAK,EAAE,KAAK,CAAC;oBACb,QAAQ,EAAE,KAAK,CAAC;iBACjB,CAAC;aACH,CAAC;SACH,CAAC;KACH,CAAC;CACH,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,UAAU,EAAE,MAAM,UA0Q9B,CAAC"}

package/.svelte-kit/__package__/server.js

@@ -0,0 +1,269 @@
+import { APIError } from "better-auth/api";
+import { symmetricDecrypt, symmetricEncrypt } from "better-auth/crypto";
+import { createAuthMiddleware } from "better-auth/plugins";
+/**
+ * @returns The BetterAuth server plugin.
+ *
+ * @example
+ * ```ts
+ * const auth = betterAuth({
+ *   plugins: [jazzPlugin()],
+ *   // ... other BetterAuth options
+ * });
+ * ```
+ */
+export const jazzPlugin = () => {
+    return {
+        id: "jazz-plugin",
+        schema: {
+            user: {
+                fields: {
+                    accountID: {
+                        type: "string",
+                        required: false,
+                        input: false,
+                    },
+                    encryptedCredentials: {
+                        type: "string",
+                        required: false,
+                        input: false,
+                        returned: false,
+                    },
+                },
+            },
+        },
+        init() {
+            return {
+                options: {
+                    databaseHooks: {
+                        user: {
+                            create: {
+                                before: async (user, context) => {
+                                    // If the user is created without a jazzAuth, it will throw an error.
+                                    if (!contextContainsJazzAuth(context)) {
+                                        throw new APIError(422, {
+                                            message: "JazzAuth is required on user creation",
+                                        });
+                                    }
+                                    // Decorate the user with the jazz's credentials.
+                                    return {
+                                        data: {
+                                            accountID: context.jazzAuth.accountID,
+                                            encryptedCredentials: context.jazzAuth.encryptedCredentials,
+                                        },
+                                    };
+                                },
+                            },
+                        },
+                        verification: {
+                            create: {
+                                after: async (verification, context) => {
+                                    /**
+                                     * For: Email OTP plugin
+                                     * After a verification is created, if it is from the EmailOTP plugin,
+                                     * create a new verification value with the jazzAuth with the same expiration.
+                                     */
+                                    if (contextContainsJazzAuth(context) &&
+                                        verification.identifier.startsWith("sign-in-otp-")) {
+                                        const identifier = `jazz-auth-${verification.identifier}`;
+                                        await context.context.internalAdapter.deleteVerificationByIdentifier(identifier);
+                                        await context.context.internalAdapter.createVerificationValue({
+                                            value: JSON.stringify({ jazzAuth: context.jazzAuth }),
+                                            identifier: identifier,
+                                            expiresAt: verification.expiresAt,
+                                        });
+                                    }
+                                },
+                            },
+                        },
+                    },
+                },
+            };
+        },
+        hooks: {
+            before: [
+                /**
+                 * If the client sends a x-jazz-auth header,
+                 * we encrypt the credentials and inject them into the context.
+                 */
+                {
+                    matcher: (context) => {
+                        return !!context.headers?.get("x-jazz-auth");
+                    },
+                    handler: createAuthMiddleware(async (ctx) => {
+                        const jazzAuth = JSON.parse(ctx.headers?.get("x-jazz-auth"));
+                        const credentials = {
+                            accountID: jazzAuth.accountID,
+                            secretSeed: jazzAuth.secretSeed,
+                            accountSecret: jazzAuth.accountSecret,
+                            // If the provider remains 'anonymous', Jazz will not consider us authenticated later.
+                            provider: "better-auth",
+                        };
+                        const encryptedCredentials = await symmetricEncrypt({
+                            key: ctx.context.secret,
+                            data: JSON.stringify(credentials),
+                        });
+                        return {
+                            context: {
+                                ...ctx,
+                                jazzAuth: {
+                                    accountID: jazzAuth.accountID,
+                                    encryptedCredentials: encryptedCredentials,
+                                },
+                            },
+                        };
+                    }),
+                },
+                /**
+                 * For: Social / OAuth2 plugin
+                 * /callback is the endpoint that BetterAuth uses to authenticate the user coming from a social provider.
+                 * 1. Catch the state
+                 * 2. Find the verification value
+                 * 3. If the verification value contains a jazzAuth, inject into the context to have it in case of registration.
+                 */
+                {
+                    matcher: (context) => {
+                        return (context.path.startsWith("/callback") ||
+                            context.path.startsWith("/oauth2/callback"));
+                    },
+                    handler: createAuthMiddleware(async (ctx) => {
+                        const state = ctx.query?.state || ctx.body?.state;
+                        const identifier = `jazz-auth-${state}`;
+                        const data = await ctx.context.internalAdapter.findVerificationValue(identifier);
+                        // if not found, the social plugin will throw later anyway
+                        if (!data) {
+                            throw new APIError(404, {
+                                message: "Verification not found",
+                            });
+                        }
+                        const parsed = JSON.parse(data.value);
+                        if (parsed && "jazzAuth" in parsed) {
+                            return {
+                                context: {
+                                    ...ctx,
+                                    jazzAuth: parsed.jazzAuth,
+                                },
+                            };
+                        }
+                        else {
+                            throw new APIError(404, {
+                                message: "JazzAuth not found in verification value",
+                            });
+                        }
+                    }),
+                },
+                /**
+                 * For: Email OTP plugin
+                 * When the user sends an OTP, we try to find the jazzAuth.
+                 * If it isn't a sign-up, we expect to not find a verification value.
+                 */
+                {
+                    matcher: (context) => {
+                        return context.path.startsWith("/sign-in/email-otp");
+                    },
+                    handler: createAuthMiddleware(async (ctx) => {
+                        const email = ctx.body.email;
+                        const identifier = `jazz-auth-sign-in-otp-${email}`;
+                        const data = await ctx.context.internalAdapter.findVerificationValue(identifier);
+                        // if not found, it isn't a sign-up
+                        if (!data || data.expiresAt < new Date()) {
+                            return;
+                        }
+                        const parsed = JSON.parse(data.value);
+                        if (parsed && "jazzAuth" in parsed) {
+                            return {
+                                context: {
+                                    ...ctx,
+                                    jazzAuth: parsed.jazzAuth,
+                                },
+                            };
+                        }
+                        else {
+                            throw new APIError(500, {
+                                message: "JazzAuth not found in verification value",
+                            });
+                        }
+                    }),
+                },
+            ],
+            after: [
+                /**
+                 * This middleware is used to extract the jazzAuth from the user and return it in the response.
+                 * It is used in the following endpoints that return the user:
+                 * - /sign-up/email
+                 * - /sign-in/email
+                 * - /get-session
+                 */
+                {
+                    matcher: (context) => {
+                        return (context.path.startsWith("/sign-up") ||
+                            context.path.startsWith("/sign-in") ||
+                            context.path.startsWith("/get-session"));
+                    },
+                    handler: createAuthMiddleware({}, async (ctx) => {
+                        const returned = ctx.context.returned;
+                        if (!returned?.user?.id) {
+                            return;
+                        }
+                        const jazzAuth = await extractJazzAuth(returned.user.id, ctx);
+                        return ctx.json({
+                            ...returned,
+                            jazzAuth: jazzAuth,
+                        });
+                    }),
+                },
+                /**
+                 * For: Social / OAuth2 plugin
+                 * When the user sign-in via social, we create a verification value with the jazzAuth.
+                 */
+                {
+                    matcher: (context) => {
+                        return context.path.startsWith("/sign-in/social");
+                    },
+                    handler: createAuthMiddleware(async (ctx) => {
+                        if (!contextContainsJazzAuth(ctx)) {
+                            throw new APIError(500, {
+                                message: "JazzAuth not found in context",
+                            });
+                        }
+                        const returned = ctx.context.returned;
+                        const url = new URL(returned.url);
+                        const state = url.searchParams.get("state");
+                        const value = JSON.stringify({ jazzAuth: ctx.jazzAuth });
+                        const expiresAt = new Date();
+                        expiresAt.setMinutes(expiresAt.getMinutes() + 10);
+                        await ctx.context.internalAdapter.createVerificationValue({
+                            value,
+                            identifier: `jazz-auth-${state}`,
+                            expiresAt,
+                        });
+                    }),
+                },
+            ],
+        },
+    };
+};
+function contextContainsJazzAuth(ctx) {
+    return !!ctx && typeof ctx === "object" && "jazzAuth" in ctx;
+}
+async function extractJazzAuth(userId, ctx) {
+    const user = await ctx.context.adapter.findOne({
+        model: ctx.context.tables.user.modelName,
+        where: [
+            {
+                field: "id",
+                operator: "eq",
+                value: userId,
+            },
+        ],
+        select: ["accountID", "encryptedCredentials"],
+    });
+    if (!user) {
+        return;
+    }
+    const jazzAuth = JSON.parse(await symmetricDecrypt({
+        key: ctx.context.secret,
+        data: user.encryptedCredentials,
+    }));
+    return jazzAuth;
+}

package/.svelte-kit/__package__/svelte.svelte

@@ -0,0 +1,47 @@
+<script lang="ts">
+import type { Snippet } from "svelte";
+import { createAuthClient } from "better-auth/client";
+import { getAuthSecretStorage, getJazzContext } from "jazz-tools/svelte";
+import { jazzPluginClient } from "./client.js";
+
+type AuthClient = ReturnType<
+  typeof createAuthClient<{
+    plugins: [ReturnType<typeof jazzPluginClient>];
+  }>
+>;
+
+let {
+  betterAuthClient,
+  children,
+}: {
+  betterAuthClient: AuthClient;
+  children?: Snippet;
+} = $props();
+
+const context = getJazzContext();
+const authSecretStorage = getAuthSecretStorage();
+
+if (betterAuthClient.jazz === undefined) {
+  throw new Error(
+    "Better Auth client has been initialized without the jazzPluginClient",
+  );
+}
+
+$effect(() => {
+  // Register reactive dependencies
+  context.current;
+  authSecretStorage;
+  betterAuthClient;
+
+  // The plugin installs itself on the client under the `jazz` key:
+  betterAuthClient.jazz.setJazzContext(context.current);
+  betterAuthClient.jazz.setAuthSecretStorage(authSecretStorage);
+
+  // If we don't subscribe, then the plugin won't keep the states synced, but we don't need to actually do anything in the callback.
+  return betterAuthClient.useSession.subscribe(() => {});
+});
+</script>
+
+{#if children}
+  {@render children()}
+{/if}