nestjs-slightly-better-auth 1.9.2 → 1.10.0

package/README.md

@@ -948,7 +948,7 @@ Better Auth treats a process with `NODE_ENV=test` or a truthy `TEST` variable (V
 
 The kits verify extension units against the invariants of the [reviewed specification](docs/design/design-v7.md) (§4 and §14.1). Each kit returns `ConformanceCase[]` (`{ id, title, skip?, run() }`) that `runConformance(cases, { describe, it })` registers with Vitest, Jest or `node:test`. Assertions use `node:assert/strict`; the kits import no test runner.
 
-Applicability comes from the unit, not from the options a harness passes. A platform that declares `capabilities.http2` needs the `http2` option. The platform kit's trusted-hop rows need `trustOneProxy`, and its microservice rows of `H-no-adapter` need `microservice`, which returns the transport options to boot with (for example `{ transport: Transport.TCP, options: { host: "127.0.0.1", port: 0 } }`); the kit does not load the optional `@nestjs/microservices` peer itself. The production-mode rows set `process.env.NODE_ENV` to `production` while they run and restore it afterwards, so run the kit's cases sequentially. A transport with a lineage needs `invokeTwice`, one that nests handlers (`defaultAccessFor`) needs `invokeGraph`, and one that claims the kit's federation reference resolver needs `invokeEntities`. A transport whose browser leg is a connection's handshake, shared by the connection's messages (the WebSocket transports), runs the `T-ws-origin-*` cases instead of the `T-csrf-*` cases and needs `invokeConnection`, plus `authenticateConnection` when the app provides `WS_CONNECTION_AUTH`. Such a case fails when the helper is missing, and `T-selection` fails `expectBrowserLeg: false` for a transport that describes a browser leg. A transport that nests handlers needs `graphqlContexts` to list `'static'` and `'cached'` for `T-stale-context`, whose cached-context row runs where the browser leg follows each operation; the custom-context rows of `T-subscription-origin` run for the listed `'fresh'` and `'plain-request'` contexts. The `T-subscription-*` cases run when `invocationShapes` includes `'subscriptions'` and need `invokeConnection` with its `connectionParams` option. `T-inherited-handler` runs with `invokeInherited`; harnesses of transports that address a handler by a name one inherited method shares across subclasses (an RPC pattern, a GraphQL root field) omit it, and the case is skipped with the reason. A case whose optional capability is absent is skipped with the reason. The kits read these members from unit objects before running; for classes and `defineExtension()` definitions they boot once and read the resolved unit. A case known to be inapplicable registers with its reason in the test name. A case that finds out at run time resolves with `{ skipped: reason }`, which `runConformance` reports through the runner's `context.skip(reason)` (Vitest, `node:test`; Jest has no runtime skip, so the test passes).
+Applicability comes from the unit, not from the options a harness passes. A platform that declares `capabilities.http2` needs the `http2` option. The platform kit's trusted-hop rows need `trustOneProxy`, which trusts one forwarding hop on a created application (Express `app.set("trust proxy", 1)`), or `createTrustingHttpAdapter` (and `http2.createTrustingHttpAdapter` for their HTTP/2 rows), which returns a fresh adapter that already trusts it, for platforms that fix proxy trust at construction (Fastify `new FastifyAdapter({ trustProxy: "loopback" })`; the kit's requests come from loopback). Its microservice rows of `H-no-adapter` need `microservice`, which returns the transport options to boot with (for example `{ transport: Transport.TCP, options: { host: "127.0.0.1", port: 0 } }`); the kit does not load the optional `@nestjs/microservices` peer itself. The production-mode rows set `process.env.NODE_ENV` to `production` while they run and restore it afterwards, so run the kit's cases sequentially. A transport with a lineage needs `invokeTwice`, one that nests handlers (`defaultAccessFor`) needs `invokeGraph`, and one that claims the kit's federation reference resolver needs `invokeEntities`. A transport whose browser leg is a connection's handshake, shared by the connection's messages (the WebSocket transports), runs the `T-ws-origin-*` cases instead of the `T-csrf-*` cases and needs `invokeConnection`, plus `authenticateConnection` when the app provides `WS_CONNECTION_AUTH`. Such a case fails when the helper is missing, and `T-selection` fails `expectBrowserLeg: false` for a transport that describes a browser leg. A transport that nests handlers needs `graphqlContexts` to list `'static'` and `'cached'` for `T-stale-context`, whose cached-context row runs where the browser leg follows each operation; the custom-context rows of `T-subscription-origin` run for the listed `'fresh'` and `'plain-request'` contexts. The `T-subscription-*` cases run when `invocationShapes` includes `'subscriptions'` and need `invokeConnection` with its `connectionParams` option. `T-inherited-handler` runs with `invokeInherited`; harnesses of transports that address a handler by a name one inherited method shares across subclasses (an RPC pattern, a GraphQL root field) omit it, and the case is skipped with the reason. A case whose optional capability is absent is skipped with the reason. The kits read these members from unit objects before running; for classes and `defineExtension()` definitions they boot once and read the resolved unit. A case known to be inapplicable registers with its reason in the test name. A case that finds out at run time resolves with `{ skipped: reason }`, which `runConformance` reports through the runner's `context.skip(reason)` (Vitest, `node:test`; Jest has no runtime skip, so the test passes).
 
 ```ts
 import { ExpressAdapter } from "@nestjs/platform-express";

package/dist/testing/conformance.cjs

@@ -853,17 +853,6 @@ async function capabilitiesOf(options) {
 		await boot.close();
 	}
 }
-/** Whether the resolved platform implements an optional member, booting a testing app when the reference cannot tell. */
-async function implementsMember(options, name) {
-	const known = staticMember$1(options.platform, name);
-	if (known !== void 0) return known;
-	const boot = await bootHttp(options, "testing", {});
-	try {
-		return typeof Reflect.get(resolvedPlatform(boot.app), name) === "function";
-	} finally {
-		await boot.close();
-	}
-}
 function kitModule$1(options, auth, probe, config, state) {
 	const hooks = state.hooks ?? config.hooks;
 	const record = async (call, next) => {
@@ -1059,6 +1048,17 @@ function kitModule$1(options, auth, probe, config, state) {
 	})], ConformanceHttpModule);
 	return ConformanceHttpModule;
 }
+/** The factory of an adapter that trusts one forwarding hop, for HTTP/1.1 or HTTP/2, when the options give one. */
+function trustingAdapterOf(options, http2) {
+	const source = http2 ? options.http2 : options;
+	return source?.createTrustingHttpAdapter ? () => source.createTrustingHttpAdapter() : void 0;
+}
+/** A fresh adapter for a boot: the trusting adapter for a trusted-hop boot when given, else the default one. */
+function createAdapter(options, config) {
+	const trusting = config.trustProxy ? trustingAdapterOf(options, config.http2) : void 0;
+	if (trusting) return trusting();
+	return config.http2 ? options.http2.createHttpAdapter() : options.createHttpAdapter();
+}
 async function bootHttp(options, bootstrap, config) {
 	const auth = config.instance ?? createConformanceAuth(config.auth);
 	const probe = await probeOf(auth);
@@ -1067,7 +1067,7 @@ async function bootHttp(options, bootstrap, config) {
 	const around = [];
 	const accessor = {};
 	let application;
-	const adapter = config.http2 ? options.http2.createHttpAdapter() : options.createHttpAdapter();
+	const adapter = createAdapter(options, config);
 	const requests = () => resolvedPlatform(application).requests;
 	const module = kitModule$1(options, auth, probe, config, {
 		filtered,
@@ -1095,8 +1095,8 @@ async function bootHttp(options, bootstrap, config) {
 		}
 		if (config.prefix) app.setGlobalPrefix(config.prefix);
 		if (config.versioning) app.enableVersioning({ type: _nestjs_common.VersioningType.URI });
-		if (config.trustProxy) {
-			node_assert_strict.default.ok(options.trustOneProxy, "trustOneProxy is required here");
+		if (config.trustProxy && !trustingAdapterOf(options, config.http2)) {
+			node_assert_strict.default.ok(options.trustOneProxy, "trustOneProxy or createTrustingHttpAdapter is required here");
 			await options.trustOneProxy(app);
 		}
 		await app.init();
@@ -1104,6 +1104,7 @@ async function bootHttp(options, bootstrap, config) {
 		return {
 			app,
 			url,
+			http2: config.http2 === true,
 			auth,
 			probe,
 			logger,
@@ -1263,9 +1264,10 @@ const multipartBody = [
 /**
 * The HTTP platform kit (invariants H1–H14). Each case boots a real Nest application per bootstrap with a real Better
 * Auth instance that includes conformanceProbePlugin(), an app controller, a @BeforeAuth() hook provider, a recording
-* global filter and an `around` recorder. HTTP/2 is required when the platform declares capabilities.http2; a platform
-* without the capability, or without the optional proxyTrust() or trustOneProxy, gets a skip with the reason: before
-* the run for platform objects, at run time for classes and definitions. The microservice rows of H-no-adapter need the
+* global filter and an `around` recorder. HTTP/2 is required when the platform declares capabilities.http2. A platform
+* without the capability or the optional proxyTrust(), and a harness with neither trustOneProxy nor
+* createTrustingHttpAdapter for the trusted-hop rows, get a skip with the reason: before the run for platform objects,
+* at run time for classes and definitions. The microservice rows of H-no-adapter need the
 * `microservice` option. Production-mode rows set process.env.NODE_ENV to 'production' while they run and restore it,
 * so run the cases sequentially.
 */
@@ -1282,7 +1284,13 @@ function httpPlatformConformance(options) {
 		node_assert_strict.default.ok(o.http2, "the platform declares capabilities.http2, so the kit requires the http2 option");
 	};
 	const noProxyTrust = () => staticMember$1(options.platform, "proxyTrust") === false ? "the platform does not implement the optional proxyTrust()" : void 0;
-	const noTrustHook = () => options.trustOneProxy ? void 0 : "no trustOneProxy option was given";
+	/** A skip when neither trustOneProxy nor the protocol's createTrustingHttpAdapter can make a trusted-hop boot. */
+	const noTrustHook = (http2 = false) => options.trustOneProxy || trustingAdapterOf(options, http2) ? void 0 : http2 ? "neither trustOneProxy nor http2.createTrustingHttpAdapter was given" : "neither trustOneProxy nor createTrustingHttpAdapter was given";
+	/** The static skip of a trusted-hop row: the HTTP/2 row also needs the http2 capability. */
+	const trustedHop = (http2) => () => (http2 ? noHttp2() : void 0) ?? noTrustHook(http2);
+	/** The run-time skip of a trusted-hop row, decided from the resolved platform for HTTP/2. */
+	const trustedHopReady = async (o, http2) => http2 ? http2Ready(o) : void 0;
+	const overHttp2 = (http2, title) => http2 ? `over HTTP/2, ${title}` : title;
 	add("H-mount-methods", "every method under the base path reaches Better Auth", (o, b) => withBoot(o, b, {}, async (boot) => {
 		for (const method of [
 			"GET",
@@ -1586,11 +1594,16 @@ function httpPlatformConformance(options) {
 		});
 		for (const [name, value] of Object.entries(headers)) node_assert_strict.default.equal(result.headers.get(name), value, `${name} changed`);
 	}));
+	/** GET /probe/ip over the boot's protocol. */
 	const probeIp = async (boot, headers = {}) => {
-		const response = await sendRaw(`${boot.url}${AUTH}/probe/ip`, { headers });
+		const response = boot.http2 ? await http2Request(http2Origin(boot), {
+			":method": "GET",
+			":path": `${AUTH}/probe/ip`,
+			...headers
+		}) : await sendRaw(`${boot.url}${AUTH}/probe/ip`, { headers });
 		return response.status === 200 ? {
 			status: response.status,
-			...json$1(response)
+			...JSON.parse(response.body.toString("utf8"))
 		} : { status: response.status };
 	};
 	add("H-ip-platform", "Better Auth's getIP sees the platform client IP", (o, b) => withBoot(o, b, {}, async (boot) => {
@@ -1632,12 +1645,15 @@ function httpPlatformConformance(options) {
 			node_assert_strict.default.deepEqual([...new Set(keys)], [`${LOOPBACK}|/probe/ip`], "the rate limiter was not keyed by the platform IP");
 		}));
 	});
-	add("H-ip-platform", "in production mode behind a trusted hop, every forwarded client gets its own rate-limit bucket", (o, b) => {
+	for (const http2 of [false, true]) add("H-ip-platform", overHttp2(http2, "in production mode behind a trusted hop, every forwarded client gets its own rate-limit bucket"), async (o, b) => {
+		const skip = await trustedHopReady(o, http2);
+		if (skip) return skip;
 		const keys = [];
 		const [left, right] = ["203.0.113.30", "203.0.113.31"];
 		return inProduction(() => withBoot(o, b, {
 			...rateLimited(keys),
-			trustProxy: true
+			trustProxy: true,
+			http2
 		}, async (boot) => {
 			const statuses = [];
 			for (let index = 0; index <= IP_RULE.max; index++) statuses.push((await probeIp(boot, { "x-forwarded-for": left })).status);
@@ -1651,7 +1667,7 @@ function httpPlatformConformance(options) {
 			node_assert_strict.default.equal(other.resolved, right);
 			node_assert_strict.default.deepEqual([...new Set(keys)].sort(), [`${left}|/probe/ip`, `${right}|/probe/ip`]);
 		}));
-	}, noTrustHook);
+	}, trustedHop(http2));
 	add("H-ip-platform", "with trustedProxies covering the platform IP and trust off, Better Auth resolves no IP and B18 warns where proxyTrust() reports 'none'", (o, b) => inProduction(() => withBoot(o, b, loopbackProxies, async (boot) => {
 		const value = await probeIp(boot, { "x-forwarded-for": "203.0.113.40" });
 		node_assert_strict.default.equal(value.resolved, null, `Better Auth resolved ${String(value.resolved)} although trustedProxies covers the socket IP`);
@@ -1659,14 +1675,19 @@ function httpPlatformConformance(options) {
 		const b18 = warningsWith(boot, "W_CLIENT_IP", "trustedProxies");
 		if (trust?.mode === "none") node_assert_strict.default.equal(b18.length, 1, boot.logger.text());
 	})));
-	add("H-ip-platform", "with trustedProxies covering the proxy and trust on, Better Auth resolves the client IP without a B18 warning", (o, b) => inProduction(() => withBoot(o, b, {
-		...loopbackProxies,
-		trustProxy: true
-	}, async (boot) => {
-		const value = await probeIp(boot, { "x-forwarded-for": "203.0.113.41" });
-		node_assert_strict.default.equal(value.resolved, "203.0.113.41");
-		node_assert_strict.default.deepEqual(warningsWith(boot, "W_CLIENT_IP", "trustedProxies"), []);
-	})), noTrustHook);
+	for (const http2 of [false, true]) add("H-ip-platform", overHttp2(http2, "with trustedProxies covering the proxy and trust on, Better Auth resolves the client IP without a B18 warning"), async (o, b) => {
+		const skip = await trustedHopReady(o, http2);
+		if (skip) return skip;
+		return inProduction(() => withBoot(o, b, {
+			...loopbackProxies,
+			trustProxy: true,
+			http2
+		}, async (boot) => {
+			const value = await probeIp(boot, { "x-forwarded-for": "203.0.113.41" });
+			node_assert_strict.default.equal(value.resolved, "203.0.113.41", "Better Auth did not resolve the client IP behind the trusted hop");
+			node_assert_strict.default.deepEqual(warningsWith(boot, "W_CLIENT_IP", "trustedProxies"), []);
+		}));
+	}, trustedHop(http2));
 	add("H-ip-spoof", "client-sent client-IP headers are ignored", (o, b) => withBoot(o, b, {}, async (boot) => {
 		const ip = json$1(await sendRaw(`${boot.url}${AUTH}/probe/ip`, { headers: {
 			"x-forwarded-for": "203.0.113.7",
@@ -1679,20 +1700,30 @@ function httpPlatformConformance(options) {
 			"203.0.113.9"
 		].includes(String(ip)), `a spoofed IP reached Better Auth: ${String(ip)}`);
 	}));
-	add("H-proxy-trust", "proxyTrust() reports the effective setting before and after trustOneProxy", (o, b) => withBoot(o, b, {}, async (boot) => {
+	add("H-proxy-trust", "proxyTrust() reports the effective setting before and after trusting one hop", (o, b) => withBoot(o, b, {}, async (boot) => {
 		const platform = resolvedPlatform(boot.app);
 		if (typeof platform.proxyTrust !== "function") return conformanceSkip("the platform does not implement the optional proxyTrust()");
 		const adapter = boot.app.getHttpAdapter();
 		const before = platform.proxyTrust(adapter);
-		await o.trustOneProxy(boot.app);
-		const after = platform.proxyTrust(adapter);
+		let after;
+		if (o.trustOneProxy) {
+			await o.trustOneProxy(boot.app);
+			after = platform.proxyTrust(adapter);
+		} else {
+			const trusted = await bootHttp(o, b, { trustProxy: true });
+			try {
+				after = resolvedPlatform(trusted.app).proxyTrust(trusted.app.getHttpAdapter());
+			} finally {
+				await trusted.close();
+			}
+		}
 		if (before.mode === "unknown" || after.mode === "unknown") {
 			node_assert_strict.default.equal(before.mode, after.mode, "a platform that cannot inspect proxy trust must report unknown consistently");
 			return;
 		}
-		node_assert_strict.default.notDeepEqual(after, before, "proxyTrust() did not reflect trustOneProxy");
+		node_assert_strict.default.notDeepEqual(after, before, "proxyTrust() did not reflect the trusted hop");
 		node_assert_strict.default.notEqual(after.mode, "none");
-	}), () => staticMember$1(options.platform, "proxyTrust") === false ? "the platform does not implement the optional proxyTrust()" : options.trustOneProxy ? void 0 : "no trustOneProxy option was given");
+	}), () => noProxyTrust() ?? noTrustHook());
 	const forwarded = {
 		"x-forwarded-proto": "https",
 		"x-forwarded-host": "proxy.example"
@@ -1712,7 +1743,7 @@ function httpPlatformConformance(options) {
 		trustProxy: true
 	}, async (boot) => {
 		node_assert_strict.default.equal((await probedUrl(boot)).origin, "https://proxy.example");
-	}), () => options.trustOneProxy ? void 0 : "no trustOneProxy option was given");
+	}), () => noTrustHook());
 	add("H-h2-pseudo", "HTTP/2 pseudo-headers never reach Better Auth", async (o, b) => {
 		const skip = await http2Ready(o);
 		if (skip) return skip;
@@ -2085,13 +2116,23 @@ function httpPlatformConformance(options) {
 		await sendRaw(`${boot.url}${AUTH}/probe/html`, { headers: { "x-forwarded-for": "203.0.113.54" } });
 		node_assert_strict.default.deepEqual(proxyWarnings(boot), []);
 	})), noProxyTrust);
-	add("H-proxy-untrusted-warning", "in production behind a trusted hop, forwarded auth requests log no W_PROXY_UNTRUSTED", async (o, b) => {
-		if (!await implementsMember(o, "proxyTrust")) return conformanceSkip("the platform does not implement the optional proxyTrust()");
-		return inProduction(() => withBoot(o, b, { trustProxy: true }, async (boot) => {
-			await sendRaw(`${boot.url}${AUTH}/probe/html`, { headers: { "x-forwarded-for": "203.0.113.55" } });
+	for (const http2 of [false, true]) add("H-proxy-untrusted-warning", overHttp2(http2, "in production behind a trusted hop, forwarded auth requests log no W_PROXY_UNTRUSTED"), async (o, b) => {
+		const skip = await trustedHopReady(o, http2);
+		if (skip) return skip;
+		return inProduction(() => withBoot(o, b, {
+			trustProxy: true,
+			http2
+		}, async (boot) => {
+			const headers = { "x-forwarded-for": "203.0.113.55" };
+			const response = boot.http2 ? await http2Request(http2Origin(boot), {
+				":method": "GET",
+				":path": `${AUTH}/probe/html`,
+				...headers
+			}) : await sendRaw(`${boot.url}${AUTH}/probe/html`, { headers });
+			node_assert_strict.default.equal(response.status, 200);
 			node_assert_strict.default.deepEqual(proxyWarnings(boot), []);
 		}));
-	}, () => noProxyTrust() ?? noTrustHook());
+	}, trustedHop(http2));
 	add("H-log-hygiene", "session and probe cookies never appear in captured logs", (o, b) => withBoot(o, b, {}, async (boot) => {
 		const identity = await kitIdentity(boot.auth);
 		const token = identity.cookie.split("=")[1].split(".")[0];