rimecms 0.31.4 → 0.32.0

package/dist/core/auth/better-auth/instance.server.js

@@ -0,0 +1,26 @@
+import { betterAuth } from 'better-auth';
+import { getBaseAuthConfig } from './config.server.js';
+/**
+ * Builds the better-auth instance for a config.
+ *
+ * Extracted from `bootRime` so its *type* can be named without naming `bootRime`. `RimeContext`
+ * declares `auth`, and `bootRime` imports the prototype registry — so referring to
+ * `ReturnType<typeof bootRime>` for it would put every prototype definition, and therefore every
+ * hook, back into the type graph of `event.locals.rime`. That is the loop this whole change
+ * exists to cut. This module imports no registry and no prototype.
+ *
+ * The inference is the point of extracting it rather than widening it: a consumer's own
+ * better-auth plugins come from `config.$auth.plugins`, and `auth` has to keep carrying them so
+ * `rime.auth` is typed against the plugins that config actually declared.
+ */
+export const createAuthInstance = (args) => {
+    const { config, configCtx, mailer, adapter } = args;
+    const baseAuthConfig = getBaseAuthConfig({ mailer, config: configCtx });
+    return betterAuth({
+        ...baseAuthConfig,
+        plugins: Array.isArray(config.$auth?.plugins)
+            ? [...baseAuthConfig.plugins, ...config.$auth.plugins]
+            : baseAuthConfig.plugins,
+        database: adapter.auth.betterAuthAdapter
+    });
+};

package/dist/core/auth/better-auth-tables.server.d.ts

@@ -0,0 +1,33 @@
+import type { Adapter } from '../adapter.js';
+/**
+ * Whether anybody has signed up yet.
+ *
+ * Gates the init route, so it is asked precisely when the answer is expected to be no — which is
+ * why Better-auth's `listUsers` cannot serve it: there is no admin session to authorize with.
+ */
+export declare const hasAuthUser: (adapter: Adapter) => Promise<boolean>;
+/**
+ * Sets an auth user's Better-auth role.
+ *
+ * Better-auth's own `role` column, not rime's `roles` on the auth collection row — the first user
+ * needs the former to pass Better-auth's admin checks. Which is also why `setRole` cannot serve
+ * it: this call is what makes the first admin, so `adminMiddleware` has nobody to accept yet.
+ */
+export declare const setAuthUserRole: (adapter: Adapter, args: {
+    authUserId: string;
+    role: string;
+}) => Promise<void>;
+/**
+ * Removes an auth user and everything hanging off it.
+ *
+ * Sessions and accounts first, then the user: they reference it, and nothing here relies on a
+ * cascade. Used to undo a half-made signup, so it must not leave a session behind that would
+ * still authenticate.
+ *
+ * Better-auth's `removeUser` deletes sessions first too, but it refuses this case outright —
+ * `YOU_CANNOT_REMOVE_YOURSELF`, and the half-made signup being rolled back is exactly the session
+ * making the request.
+ */
+export declare const deleteAuthUser: (adapter: Adapter, args: {
+    authUserId: string;
+}) => Promise<void>;

package/dist/core/auth/better-auth-tables.server.js

@@ -0,0 +1,50 @@
+/**
+ * The three writes and one read auth makes against Better-auth's own tables, through
+ * `adapter.table(slug)`.
+ *
+ * **Better-auth's admin API cannot do any of this.** `listUsers`, `setRole` and `removeUser` all
+ * sit behind `adminMiddleware`, and every caller here runs where no admin session exists — see
+ * each function.
+ */
+const USERS = '$authUsers';
+const SESSIONS = '$authSessions';
+const ACCOUNTS = '$authAccounts';
+/**
+ * Whether anybody has signed up yet.
+ *
+ * Gates the init route, so it is asked precisely when the answer is expected to be no — which is
+ * why Better-auth's `listUsers` cannot serve it: there is no admin session to authorize with.
+ */
+export const hasAuthUser = async (adapter) => {
+    const rows = await adapter.table(USERS).find({ select: ['id'], limit: 1 });
+    return rows.length > 0;
+};
+/**
+ * Sets an auth user's Better-auth role.
+ *
+ * Better-auth's own `role` column, not rime's `roles` on the auth collection row — the first user
+ * needs the former to pass Better-auth's admin checks. Which is also why `setRole` cannot serve
+ * it: this call is what makes the first admin, so `adminMiddleware` has nobody to accept yet.
+ */
+export const setAuthUserRole = async (adapter, args) => {
+    await adapter.table(USERS).update({
+        where: { id: args.authUserId },
+        data: { role: args.role }
+    });
+};
+/**
+ * Removes an auth user and everything hanging off it.
+ *
+ * Sessions and accounts first, then the user: they reference it, and nothing here relies on a
+ * cascade. Used to undo a half-made signup, so it must not leave a session behind that would
+ * still authenticate.
+ *
+ * Better-auth's `removeUser` deletes sessions first too, but it refuses this case outright —
+ * `YOU_CANNOT_REMOVE_YOURSELF`, and the half-made signup being rolled back is exactly the session
+ * making the request.
+ */
+export const deleteAuthUser = async (adapter, args) => {
+    await adapter.table(SESSIONS).delete({ where: { userId: args.authUserId } });
+    await adapter.table(ACCOUNTS).delete({ where: { userId: args.authUserId } });
+    await adapter.table(USERS).delete({ where: { id: args.authUserId } });
+};

package/dist/core/auth/configure.d.ts

@@ -0,0 +1,21 @@
+import type { TableDeclaration } from '../adapter.js';
+import type { Dic } from '../../util/types.js';
+/**
+ * Puts the tables no prototype declares on `config.$tables`: better-auth's four, plus the api-key
+ * store when a collection asks for that kind of auth.
+ *
+ * It appends, so a later step can add its own. A consumer wiring a better-auth plugin declares
+ * that plugin's table the same way:
+ *
+ * ```ts
+ * configure: (config) => ({
+ *   ...config,
+ *   $tables: [...config.$tables, { slug: 'authTwoFactor', columns: [ … ] }]
+ * })
+ * ```
+ *
+ * Runs after `configureStaff`, which is what puts an `auth` collection in the config.
+ */
+export declare const configureAuthTables: <T extends Dic>(config: T) => T & {
+    $tables: TableDeclaration[];
+};

package/dist/core/auth/configure.js

@@ -0,0 +1,21 @@
+import { authTables } from './tables.js';
+/**
+ * Puts the tables no prototype declares on `config.$tables`: better-auth's four, plus the api-key
+ * store when a collection asks for that kind of auth.
+ *
+ * It appends, so a later step can add its own. A consumer wiring a better-auth plugin declares
+ * that plugin's table the same way:
+ *
+ * ```ts
+ * configure: (config) => ({
+ *   ...config,
+ *   $tables: [...config.$tables, { slug: 'authTwoFactor', columns: [ … ] }]
+ * })
+ * ```
+ *
+ * Runs after `configureStaff`, which is what puts an `auth` collection in the config.
+ */
+export const configureAuthTables = (config) => ({
+    ...config,
+    $tables: [...(config.$tables ?? []), ...authTables(config)]
+});

package/dist/core/auth/constant.server.d.ts

@@ -0,0 +1,28 @@
+import type { Dic } from '../../util/types.js';
+import type { User } from './types.js';
+/**
+ * The members of an auth document that never leave the server.
+ *
+ * `.server` is the guarantee, not a filing convention: nothing client-reachable may import this,
+ * so nothing can ship a copy of the list to a browser or drift from it. Anything that needs it on
+ * the client's behalf goes through the server — see `auth/blank/module.server.ts`.
+ */
+export declare const PRIVATE_FIELDS: string[];
+export declare const BETTER_AUTH_ROLES: {
+    /** Panel users admin */
+    readonly ADMIN: "admin";
+    /** Panel users any role */
+    readonly STAFF: "staff";
+    /** All other users */
+    readonly USER: "user";
+};
+/** Every member of `PRIVATE_FIELDS`, off a copy of the document. */
+export declare function withoutPrivateFields<T extends Dic>(doc: T): T;
+/**
+ * Strips PRIVATE_FIELDS off the session user. Call this only where a load() function is
+ * about to hand `user` to the client (the public layouts in
+ * dev/codegen/routes/common.server.ts) — never on event.locals.user itself, which stays
+ * the full object so server-only code (hooks, access checks) always sees real staff status
+ * regardless of which route triggered it.
+ */
+export declare function toPublicUser(user: User | undefined): User | undefined;

package/dist/core/auth/constant.server.js

@@ -0,0 +1,43 @@
+/**
+ * The members of an auth document that never leave the server.
+ *
+ * `.server` is the guarantee, not a filing convention: nothing client-reachable may import this,
+ * so nothing can ship a copy of the list to a browser or drift from it. Anything that needs it on
+ * the client's behalf goes through the server — see `auth/blank/module.server.ts`.
+ */
+export const PRIVATE_FIELDS = [
+    'password',
+    'token',
+    'isSuperAdmin',
+    'apiKeyId',
+    'authUserId',
+    'isStaff'
+];
+export const BETTER_AUTH_ROLES = {
+    /** Panel users admin */
+    ADMIN: 'admin',
+    /** Panel users any role */
+    STAFF: 'staff',
+    /** All other users */
+    USER: 'user'
+};
+/** Every member of `PRIVATE_FIELDS`, off a copy of the document. */
+export function withoutPrivateFields(doc) {
+    const clean = { ...doc };
+    for (const key of PRIVATE_FIELDS) {
+        delete clean[key];
+    }
+    return clean;
+}
+/**
+ * Strips PRIVATE_FIELDS off the session user. Call this only where a load() function is
+ * about to hand `user` to the client (the public layouts in
+ * dev/codegen/routes/common.server.ts) — never on event.locals.user itself, which stays
+ * the full object so server-only code (hooks, access checks) always sees real staff status
+ * regardless of which route triggered it.
+ */
+export function toPublicUser(user) {
+    if (!user)
+        return undefined;
+    return withoutPrivateFields(user);
+}

package/dist/core/auth/enabled.d.ts

@@ -0,0 +1,10 @@
+import type { Dic } from '../../util/types.js';
+/**
+ * A collection signs in by declaring `auth`.
+ *
+ * `Dic`, not a narrow shape: an area has no `auth` member at all, and every caller that guards
+ * a step here holds one config or the other.
+ */
+export declare const isAuth: (config: Dic) => boolean;
+/** The one collection whose documents are the panel's users. */
+export declare const isStaffCollection: (config: Dic) => boolean;

package/dist/core/auth/enabled.js

@@ -0,0 +1,10 @@
+import { STAFF_SLUG } from './tables.js';
+/**
+ * A collection signs in by declaring `auth`.
+ *
+ * `Dic`, not a narrow shape: an area has no `auth` member at all, and every caller that guards
+ * a step here holds one config or the other.
+ */
+export const isAuth = (config) => !!config.auth;
+/** The one collection whose documents are the panel's users. */
+export const isStaffCollection = (config) => config.slug === STAFF_SLUG;

package/dist/core/auth/handler/index.server.js

@@ -0,0 +1,159 @@
+import { RimeError } from '../../errors/index.js';
+import { error, redirect } from '@sveltejs/kit';
+import { access } from '../../../util/index.js';
+import { BETTER_AUTH_ROLES } from '../constant.server.js';
+import { userAttributes } from '../user.server.js';
+import { hasAuthUser } from '../better-auth-tables.server.js';
+import { logger } from '../../logger.server.js';
+const dev = process.env.NODE_ENV === 'development';
+/**
+ * Ensures panel is properly set up before allowing access
+ */
+async function ensureFirstAuthSetup(rime) {
+    if (!(await hasAuthUser(rime.adapter)) && !dev) {
+        throw new RimeError(RimeError.NOT_FOUND);
+    }
+}
+/**
+ * Authenticates the request using better-auth
+ */
+async function authenticateRequest(headers, 
+// Typed by what this uses, not by the whole instance. `RimeContext['auth']` resolves to
+// `RimeAuth<Config>`, and a better-auth instance varies with the plugins its config declared,
+// so the one a real request carries is not assignable to that base. Making the helper generic
+// does not help either — `RimeContext<C>['auth']` has no resolved `api` while `C` is unbound.
+// Naming the one call it makes keeps the plugin typing intact everywhere it matters and asks
+// for nothing here that this function does not actually need.
+auth) {
+    return await auth.api.getSession({ headers });
+}
+/**
+ * Handles unauthenticated users based on route requirements
+ */
+function handleUnauthenticated(event, resolve) {
+    const { isPanel, panelUrl } = event.locals.rime.routes;
+    if (isPanel) {
+        throw redirect(303, panelUrl('sign-in'));
+    }
+    event.locals.user = undefined;
+    event.locals.session = undefined;
+    return resolve(event);
+}
+/**
+ * Gets CMS user attributes for the authenticated user
+ */
+async function getCmsUserAttributes(authUserId, userType, rime) {
+    const user = await userAttributes(rime.adapter, {
+        authUserId,
+        slug: userType
+    });
+    if (!user) {
+        logger.error(RimeError.UNAUTHORIZED);
+        throw error(401, RimeError.UNAUTHORIZED);
+    }
+    return user;
+}
+/**
+ * Validates admin roles consistency between better-auth and CMS
+ */
+function validateAdminRoles(user, authUser) {
+    if (user.roles.includes('admin') && authUser.role !== BETTER_AUTH_ROLES.ADMIN) {
+        logger.error(RimeError.UNAUTHORIZED);
+        throw error(401, RimeError.UNAUTHORIZED);
+    }
+}
+/**
+ * Handles API key authentication and role forwarding
+ */
+async function handleApiKeyAuth(headers, user, 
+// As above: the one call this makes, rather than the whole instance.
+auth) {
+    const apiKey = headers.get('x-api-key');
+    if (!apiKey)
+        return;
+    const result = await auth.api.verifyApiKey({
+        body: { key: apiKey }
+    });
+    if (!result.valid || !result.key || !result.key.permissions) {
+        logger.error(RimeError.UNAUTHORIZED, 'Invalid api key');
+        throw error(401, RimeError.UNAUTHORIZED);
+    }
+    user.roles = result.key.permissions.roles;
+}
+/**
+ * Builds complete user data by combining auth and CMS information
+ */
+async function buildUserData(authResult, rime, headers) {
+    const { session, user: authUser } = authResult;
+    // Get CMS user attributes
+    const user = await getCmsUserAttributes(authUser.id, authUser.type, rime);
+    // Validate admin roles consistency
+    validateAdminRoles(user, authUser);
+    // Handle API key authentication.
+    //
+    // The narrowing is local and deliberate: `C` is still an unbound type parameter here, so
+    // better-auth's `api` — which is built from the plugin list a config declares — has nothing
+    // concrete to offer yet. The api-key plugin is always in the base config, so the call is sound;
+    // it just cannot be proven from inside a function generic over every config.
+    await handleApiKeyAuth(headers, user, rime.auth);
+    return { user, session, authUser };
+}
+/**
+ * Applies authorization rules based on route and user data
+ */
+function authorizePanelUser(userData, isPanel, config) {
+    const { user } = userData;
+    // Panel-specific authorization
+    if (isPanel) {
+        // Do not allow non-staff user on panel
+        if (!user.isStaff) {
+            logger.error(RimeError.UNAUTHORIZED);
+            throw error(401, RimeError.UNAUTHORIZED);
+        }
+        // Defaulted here rather than in the config chain. `augmentPanelAccess` existed to make this
+        // one call safe: a server-only step, refining the config's type, for a member nothing else
+        // reads. One `??` at the only read site costs less than a step in the chain.
+        const panelAccess = config.raw.panel.$access ?? ((u) => access.isAdmin(u));
+        if (!panelAccess(user)) {
+            logger.error(RimeError.UNAUTHORIZED);
+            throw error(401, RimeError.UNAUTHORIZED);
+        }
+    }
+}
+/**
+ * Sets up event locals and resolves the request. event.locals.user is always the full
+ * object, on every route type — server-only code (hooks, access checks) can rely on
+ * isStaff/isSuperAdmin regardless of which route triggered it. Only the handful of
+ * load() functions that hand `user` to the client need to call toPublicUser() first
+ * (see dev/codegen/routes/common.server.ts's public layout templates).
+ */
+function setupLocalsAndResolve(event, resolve, userData) {
+    const { user, session, authUser } = userData;
+    event.locals.user = user;
+    event.locals.session = session || undefined;
+    event.locals.betterAuthUser = authUser;
+    return resolve(event);
+}
+/**
+ * Main authentication handler with clear, linear flow
+ */
+export const handleAuth = async ({ event, resolve }) => {
+    const rime = event.locals.rime;
+    const { isPanel } = rime.routes;
+    // Ensure auth is set up
+    if (isPanel) {
+        await ensureFirstAuthSetup(rime);
+    }
+    // Authenticate the request
+    const authResult = await authenticateRequest(event.request.headers, rime.auth);
+    // Handle unauthenticated users
+    if (!authResult) {
+        return handleUnauthenticated(event, resolve);
+    }
+    // Build complete user data
+    const userData = await buildUserData(authResult, rime, event.request.headers);
+    // Apply panel authorization rules
+    authorizePanelUser(userData, isPanel, rime.config);
+    // Set up locals and resolve
+    return setupLocalsAndResolve(event, resolve, userData);
+};

package/dist/core/auth/hooks/augment-fields-password.server.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Appends the `password` field to the config, so the validation steps that follow
+ * (buildDataConfigMap → validateFields) see it and enforce the password policy.
+ *
+ * `password` is not a column — better-auth stores the credential. It lives in the config
+ * purely to carry `validate.password`, which is why it is added here per-operation rather
+ * than declared on the collection in augment.ts.
+ *
+ * Must run *after* mergeWithBlankDocument. The blank document is built from `config.fields`,
+ * and the config map is built from the *data*: augment before the merge and every create
+ * gains a blank `password`, which then fails its own `.required()` check on the paths that
+ * legitimately have no password — better-auth's post-signup callback, which creates the
+ * document with `{ name, email, authUserId }`.
+ *
+ * `confirmPassword` deliberately does NOT appear here. It is a form control, not data: the
+ * only thing a server-side comparison proves is that the same client sent the same value
+ * twice. The panel enforces the match in AuthFooter.svelte, where a mistyped password can
+ * still be corrected.
+ */
+export declare const augmentFieldsPassword: import("../../pipeline/types").Hook<"auth", "create" | "update", "before">;

package/dist/core/auth/hooks/augment-fields-password.server.js

@@ -0,0 +1,44 @@
+import { Hooks } from '../../pipeline/define-hook.js';
+import validate from '../../fields/validate.js';
+import { text } from '../../../fields/text/index.js';
+const passwordField = text('password')
+    .required()
+    .access({
+    create: () => true,
+    read: () => false,
+    update: () => false
+})
+    .validate((value) => validate.password(value));
+/**
+ * Appends the `password` field to the config, so the validation steps that follow
+ * (buildDataConfigMap → validateFields) see it and enforce the password policy.
+ *
+ * `password` is not a column — better-auth stores the credential. It lives in the config
+ * purely to carry `validate.password`, which is why it is added here per-operation rather
+ * than declared on the collection in augment.ts.
+ *
+ * Must run *after* mergeWithBlankDocument. The blank document is built from `config.fields`,
+ * and the config map is built from the *data*: augment before the merge and every create
+ * gains a blank `password`, which then fails its own `.required()` check on the paths that
+ * legitimately have no password — better-auth's post-signup callback, which creates the
+ * document with `{ name, email, authUserId }`.
+ *
+ * `confirmPassword` deliberately does NOT appear here. It is a form control, not data: the
+ * only thing a server-side comparison proves is that the same client sent the same value
+ * twice. The panel enforces the match in AuthFooter.svelte, where a mistyped password can
+ * still be corrected.
+ */
+export const augmentFieldsPassword = Hooks.beforeUpsert(async function augmentFieldsPassword(args) {
+    let { config } = args;
+    const IS_PASSWORD_AUTH = config.auth && typeof config.auth !== 'boolean' && config.auth.type === 'password';
+    if (IS_PASSWORD_AUTH) {
+        config = {
+            ...config,
+            fields: [...config.fields, passwordField]
+        };
+    }
+    return {
+        ...args,
+        config
+    };
+});

package/dist/core/auth/hooks/create-better-auth-user.server.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Create a better-auth user before a document creation
+ */
+export declare const createBetterAuthUser: import("../../pipeline/types").Hook<"auth", "create", "before">;