nestjs-slightly-better-auth 1.5.0 → 1.5.1

package/README.md

@@ -387,7 +387,7 @@ runConformance(
 
 Every case boots real Nest applications or modules with a real Better Auth instance that includes `conformanceProbePlugin()`. The probe counts and faults every operation of the instance's database adapter, so storage outages reach endpoints that would swallow them, and records the `Set-Cookie` lines each call produces. `createConformanceAuth({ plugins })` builds such an instance: memory adapter, `testUtils()`, `bearer()`, the probe plugin, `nestjs()` last, and `session.updateAge: 0` and origin checks on, whatever `options` says. The principal-source and policy kits take that instance as `auth`; the principal-source kit rejects an instance without `session.updateAge: 0`. The transport kit creates its own instance and passes it to your `createApp` harness together with the kit's API-key source in `principals`, a `logger` to boot with, and the `globalScope`, `appEnhancers`, `fieldResolverEnhancers` and `federation` settings of each boot. Apply every fixture decorator, including the kit's `SetMetadata()` marker, which maps the transport's claims to fixtures. On a connection-shaped browser leg, the kit's cookie credential carries the instance's base URL, `http://localhost:3000`, as `Origin`, as a browser page of that origin does; the `T-ws-origin-*` cases pass their own `Origin`, `Host` and forwarding headers, which the harness sends in the handshake.
 
-This repository runs the platform kit against Express and Fastify; the transport kit against the built-in HTTP transport, an in-process reference transport, Socket.IO and `ws` (each with and without a principal TTL), and the RPC transport over TCP (standalone and hybrid), gRPC, NATS, RabbitMQ, MQTT, Redis and Kafka; the principal-source kit against the session and API-key sources; and the policy kit against the admin, organization, API-key and fresh-session policies. gRPC skips `T-error-shape`, because it delivers only a status and a message. Mutation tests confirm that each of these defects fails the intended case: a platform merging `Set-Cookie`, a transport sharing invocation state across aliases, a transport without a browser leg on safe operations, a `defineExtension()` transport with a lineage or nesting and no helper, a WebSocket transport that enforces its handshake like a safe read, exempts handshakes that carry a token, builds its leg URL from the bare handshake path or from forwarded headers, or answers internal errors with their cause, a source throwing its denial, a source dropping its refresh cookie, a source turning a storage outage into a 401, and a policy widening delegated principals.
+This repository runs the platform kit against Express and Fastify; the transport kit against the built-in HTTP transport, an in-process reference transport, Socket.IO and `ws` (each with and without a principal TTL), the RPC transport over TCP (standalone and hybrid), gRPC, NATS, RabbitMQ, MQTT, Redis and Kafka, and the Apollo (Express and Fastify) and Mercurius transports over HTTP and over graphql-ws (with and without a subscription principal TTL; Mercurius also without `mercuriusSubscriptionContext()`), with federation 2 subgraphs and a federation 1 run of `T-reference-resolver`; the principal-source kit against the session and API-key sources; and the policy kit against the admin, organization, API-key and fresh-session policies. gRPC skips `T-error-shape`, because it delivers only a status and a message. The kit reads each call's browser leg while its invocation runs, because the GraphQL transports reject a completed request. Mutation tests confirm that each of these defects fails the intended case: a platform merging `Set-Cookie`, a transport sharing invocation state across aliases, a transport without a browser leg on safe operations, a `defineExtension()` transport with a lineage or nesting and no helper, a WebSocket transport that enforces its handshake like a safe read, exempts handshakes that carry a token, builds its leg URL from the bare handshake path or from forwarded headers, or answers internal errors with their cause, a GraphQL transport whose aliases share one invocation, whose lineage gives every field of an operation one position, whose field resolvers do not inherit their root's access, or that serves reference resolvers without field guards, a GraphQL harness that omits `invokeGraph`, `invokeEntities` or `invokeConnection`, a source throwing its denial, a source dropping its refresh cookie, a source turning a storage outage into a 401, and a policy widening delegated principals.
 
 ## Develop in this monorepo
 
@@ -410,6 +410,7 @@ The shared toolchain uses Node.js LTS, pnpm, tsdown, TypeScript and Vitest. Buil
 Each example application registers a default and a named instance, reads the signed-in user through the `@CurrentUser()` principal parameter and starts without external services:
 
 - [Express](../../examples/better-auth-express/README.md) and [Fastify](../../examples/better-auth-fastify/README.md) guard HTTP routes on their platforms.
+- [Apollo GraphQL](../../examples/better-auth-graphql/README.md) authenticates queries and mutations over HTTP and every graphql-ws operation, with the named instance bound to its own resolver.
 - [Socket.IO](../../examples/better-auth-websockets/README.md) authenticates gateway connections and every message, with the named instance on its own namespace.
 - [TCP microservice](../../examples/better-auth-rpc/README.md) authenticates the messages of a hybrid application through the payload credential carrier.
 

package/dist/testing/conformance.cjs

@@ -2414,12 +2414,18 @@ function instrument(app) {
 	const state = {
 		consumed: [],
 		contexts: [],
-		unavailable: false
+		legs: [],
+		unavailable: false,
+		recordLegs: false
 	};
 	const original = registry.describe.bind(registry);
 	registry.describe = (context, transport) => {
 		const call = original(context, transport);
 		state.contexts.push(context);
+		if (state.recordLegs) {
+			const browser = call.browser;
+			state.legs.push(browser === void 0 ? "none" : browser.key === call.key ? "operation" : "connection");
+		}
 		const read = (name, get) => {
 			state.consumed.push(name);
 			if (state.unavailable) throw require_auth_errors.BetterAuthConfigurationError.atRequest("CONFORMANCE_EXTRACTION_UNAVAILABLE", "The conformance kit made request extraction unavailable");
@@ -2573,12 +2579,11 @@ async function transportHas(options, env, member) {
 async function connectionShaped(options) {
 	let shaped = false;
 	await withApp(options, await environment(), async ({ app, instrumentation }) => {
+		instrumentation.recordLegs = true;
 		succeeded(await options.invoke(app, "optional", {}), "an anonymous optional invocation");
-		const [context] = instrumentation.contexts;
-		node_assert_strict.default.ok(context, "the guard described no invocation");
-		const call = app.get(require_decorate.TRANSPORT_REGISTRY, { strict: false }).describe(context, resolvedTransport(app, options.transport));
-		const browser = call.browser;
-		shaped = browser !== void 0 && browser.key !== call.key;
+		const [leg] = instrumentation.legs;
+		node_assert_strict.default.ok(leg, "the guard described no invocation");
+		shaped = leg === "connection";
 	});
 	return shaped;
 }
@@ -2674,8 +2679,10 @@ function transportConformance(options) {
 	add("T-selection", "handles() accepts its contexts with and without credentials and rejects foreign ones", (env) => withApp(options, env, async ({ app, instrumentation }) => {
 		const transport = resolvedTransport(app, options.transport);
 		const registry = app.get(require_decorate.TRANSPORT_REGISTRY, { strict: false });
+		instrumentation.recordLegs = !options.expectBrowserLeg;
 		succeeded(await options.invoke(app, "optional", {}));
-		if (!options.expectBrowserLeg) for (const context of [...instrumentation.contexts]) node_assert_strict.default.equal(registry.describe(context, transport).browser, void 0, "the transport describes a browser leg, so expectBrowserLeg must be true");
+		instrumentation.recordLegs = false;
+		for (const leg of instrumentation.legs) node_assert_strict.default.equal(leg, "none", "the transport describes a browser leg, so expectBrowserLeg must be true");
 		succeeded(await options.invoke(app, "optional", cookie(env)));
 		node_assert_strict.default.ok(instrumentation.contexts.length >= 2, "the guard described no invocation");
 		for (const context of instrumentation.contexts) {