rimecms 0.31.5 → 0.32.1

package/dist/core/auth/better-auth/config.server.js

@@ -0,0 +1,81 @@
+import { dev } from '$app/environment';
+import { env } from '$env/dynamic/public';
+import { apiKey } from '@better-auth/api-key';
+import { admin as adminPlugin } from 'better-auth/plugins';
+import { betterAuthAfterHook, betterAuthBeforeHook } from './hooks.server.js';
+import { accessControl, admin, staff, user } from './permissions.js';
+export function getBaseAuthConfig(ctx) {
+    const betterAuthOptions = {
+        baseURL: env.PUBLIC_RIME_URL,
+        plugins: configurePlugins(ctx.config.raw),
+        rateLimit: {
+            enabled: !dev,
+            window: 10,
+            max: 30
+        },
+        trustedOrigins: ctx.config.raw.$trustedOrigins,
+        session: {
+            modelName: 'authSessions'
+        },
+        account: {
+            modelName: 'authAccounts'
+        },
+        verification: {
+            modelName: 'authVerifications'
+        },
+        user: {
+            modelName: 'authUsers',
+            changeEmail: {
+                enabled: true
+            },
+            deleteUser: {
+                enabled: true
+            },
+            additionalFields: {
+                type: {
+                    type: 'string',
+                    required: true
+                }
+            }
+        },
+        hooks: {
+            before: betterAuthBeforeHook,
+            after: betterAuthAfterHook
+        },
+        emailAndPassword: {
+            enabled: true,
+            sendResetPassword: async (data) => {
+                if (!ctx.mailer)
+                    throw Error('Mailer is not configured');
+                await ctx.mailer.sendMail({
+                    to: data.user.email,
+                    subject: 'Reset your password',
+                    text: `Click the link to reset your password: ${data.url}`
+                });
+            }
+        }
+    };
+    return betterAuthOptions;
+}
+const configurePlugins = (config) => {
+    const HAS_API_KEY = (config.collections || []).filter((c) => c.auth?.type === 'apiKey').length;
+    return [
+        adminPlugin({
+            accessControl,
+            roles: {
+                admin,
+                user,
+                staff
+            }
+        }),
+        apiKey({
+            defaultKeyLength: 48,
+            enableMetadata: true,
+            permissions: {
+                defaultPermissions: {
+                    roles: HAS_API_KEY ? ['user'] : ['none']
+                }
+            }
+        })
+    ];
+};

package/dist/core/auth/better-auth/hooks.server.js

@@ -0,0 +1,132 @@
+import { dev } from '$app/environment';
+import { getRequestEvent } from '$app/server';
+import { deleteAuthUser, setAuthUserRole } from '../better-auth-tables.server.js';
+import { BETTER_AUTH_ROLES } from '../constant.server.js';
+import { userAttributes } from '../user.server.js';
+import { logger } from '../../logger.server.js';
+import { trycatch } from '../../../util/function.js';
+import { omit } from '../../../util/object.js';
+import { APIError, createAuthMiddleware } from 'better-auth/api';
+/****************************************************/
+/* After hooks
+/****************************************************/
+const getUserAttributes = async (ctx) => {
+    const newSession = ctx.context.newSession;
+    if (newSession) {
+        const event = getRequestEvent();
+        const user = await userAttributes(event.locals.rime.adapter, {
+            authUserId: newSession.user.id,
+            slug: newSession.user.type
+        });
+        if (!user) {
+            logger.error(`cant' find user with authUser id ${newSession.user.id} from ${newSession.user.type} collection`);
+            throw new APIError('BAD_REQUEST');
+        }
+        return ctx.json({
+            user: {
+                email: user.email,
+                name: user.name,
+                id: user.id
+            }
+        });
+    }
+};
+/**
+ * The creation of users handle from here is made for these two scenarios :
+ * - public sign-up with better-auth
+ * - create the first user via api/init
+ */
+const handleUserCreation = async (ctx) => {
+    const newSession = ctx.context.newSession;
+    if (!newSession)
+        return;
+    const event = getRequestEvent();
+    const data = ctx.body;
+    /**
+     * Handle first user creation,
+     * - set its role to admin
+     * - set isSuperAdmin to true
+     */
+    if (event.locals.isInit && dev) {
+        await setAuthUserRole(event.locals.rime.adapter, {
+            authUserId: newSession.user.id,
+            role: BETTER_AUTH_ROLES.ADMIN
+        });
+        // Create a placeholder user to authorize staff creation
+        event.locals.user = {
+            id: '1',
+            name: 'system',
+            email: 'admin@system.com',
+            roles: ['admin'],
+            isStaff: true,
+            isSuperAdmin: true
+        };
+        data.isSuperAdmin = true;
+    }
+    /**
+     * Set pendingSignInAfterSignUp flag to true to auto-populate the user document
+     * after creation on event.locals.user, this tell the operation that
+     * the creation is initiate by a better-auth sign-up
+     */
+    event.locals.pendingSignInAfterSignUp = true;
+    /**
+     * Create the collection document
+     */
+    const [error, userData] = await trycatch(() => event.locals.rime
+        .collection(ctx.body.type)
+        .system(event.locals.isInit)
+        .create({
+        data: {
+            ...omit(['password', 'type'], ctx.body),
+            // explicit set roles to null if not from the init process,
+            // it will be set to the default role value
+            // better safe than wrong, this prevent the role prop to be set from
+            // outside the panel
+            roles: event.locals.isInit ? ['admin'] : null,
+            authUserId: newSession.user.id
+        }
+    }));
+    // If error clean up session/account/user created
+    // note: would be cleaner to do it with the admin plugin, not possible at the moment
+    if (error) {
+        console.log(error);
+        logger.error(error.message);
+        ctx.context.newSession = null;
+        const { user } = newSession;
+        const event = getRequestEvent();
+        const { rime } = event.locals;
+        await deleteAuthUser(rime.adapter, { authUserId: user.id });
+        throw new APIError('BAD_REQUEST');
+    }
+    // Return rime user data
+    return userData;
+};
+/****************************************************/
+/* Before Hooks
+/****************************************************/
+const preventPublicStaffSignUp = (ctx) => {
+    // Prevent public staff sign-up
+    const event = getRequestEvent();
+    if (ctx.body.type === 'staff' && !event.locals.user?.isStaff && !event.locals.isInit) {
+        throw new APIError('UNAUTHORIZED');
+    }
+};
+/****************************************************/
+/* exports
+/****************************************************/
+export const betterAuthBeforeHook = createAuthMiddleware(async (ctx) => {
+    if (ctx.path.startsWith('/sign-up')) {
+        preventPublicStaffSignUp(ctx);
+    }
+});
+export const betterAuthAfterHook = createAuthMiddleware(async (ctx) => {
+    // Handle sign-in
+    if (ctx.path.startsWith('/sign-in')) {
+        return await getUserAttributes(ctx);
+    }
+    // Handle sign-up
+    if (ctx.path.startsWith('/sign-up')) {
+        await handleUserCreation(ctx);
+        return await getUserAttributes(ctx);
+    }
+});