tapimo 0.14.0 → 0.15.1

package/src/internal/BetterAuth.test.ts

@@ -0,0 +1,242 @@
+import { getSchema } from 'better-auth/db'
+import { sql } from 'kysely'
+
+import * as TestApp from '../../test/App.js'
+import * as BetterAuth from './BetterAuth.js'
+import * as RateLimit from './RateLimit.js'
+
+describe('create', () => {
+  test('uses the pinned schema through Tempo Kysely', async () => {
+    const db = TestApp.database()
+    try {
+      const auth = BetterAuth.create(db, {
+        basePath: '/v1/auth',
+        baseUrl: 'https://api.example.com',
+        rateLimit: RateLimit.memory(),
+        secret: 'test-better-auth-secret-at-least-32-characters',
+        secureCookies: true,
+      })
+      const context = await auth.$context
+      const user = await context.internalAdapter.createUser(
+        { email: 'developer@example.com', name: 'Tempo Developer' },
+        { method: 'email-otp' },
+      )
+      expect(user).toMatchObject({
+        createdAt: expect.any(Date),
+        email: 'developer@example.com',
+        emailVerified: false,
+        id: expect.stringMatching(/^usr_/),
+        updatedAt: expect.any(Date),
+      })
+      const account = await context.internalAdapter.createAccount({
+        accountId: 'developer@example.com',
+        issuer: 'local:email-otp',
+        providerId: 'email-otp',
+        userId: user.id,
+      })
+      const session = await context.internalAdapter.createSession(user.id)
+      const verification = await context.internalAdapter.createVerificationValue({
+        expiresAt: new Date(Date.now() + 300_000),
+        identifier: 'sign-in:developer@example.com',
+        value: 'hashed-otp',
+      })
+
+      await expect(context.internalAdapter.findSession(session.token)).resolves.toMatchObject({
+        session: { id: session.id, userId: user.id },
+        user: { email: 'developer@example.com', id: user.id },
+      })
+      await expect(context.internalAdapter.findAccounts(user.id)).resolves.toMatchObject([
+        {
+          accountId: 'developer@example.com',
+          id: account.id,
+          issuer: 'local:email-otp',
+          providerId: 'email-otp',
+          userId: user.id,
+        },
+      ])
+      await expect(
+        db.kysely.selectFrom('users').selectAll().executeTakeFirst(),
+      ).resolves.toMatchObject({
+        createdAt: user.createdAt.toISOString(),
+        email: 'developer@example.com',
+        id: user.id,
+        updatedAt: user.updatedAt.toISOString(),
+      })
+      await expect(
+        db.kysely.selectFrom('auth_accounts').selectAll().executeTakeFirst(),
+      ).resolves.toMatchObject({
+        createdAt: account.createdAt.toISOString(),
+        updatedAt: account.updatedAt.toISOString(),
+      })
+      await expect(
+        db.kysely.selectFrom('auth_sessions').selectAll().executeTakeFirst(),
+      ).resolves.toMatchObject({
+        createdAt: session.createdAt.toISOString(),
+        expiresAt: session.expiresAt.toISOString(),
+        updatedAt: session.updatedAt.toISOString(),
+      })
+      await expect(
+        db.kysely.selectFrom('auth_verifications').selectAll().executeTakeFirst(),
+      ).resolves.toMatchObject({
+        createdAt: verification.createdAt.toISOString(),
+        expiresAt: verification.expiresAt.toISOString(),
+        updatedAt: verification.updatedAt.toISOString(),
+      })
+      await expect(
+        context.internalAdapter.consumeVerificationValue(verification.identifier),
+      ).resolves.toMatchObject({ id: verification.id, value: 'hashed-otp' })
+
+      const schema = getSchema(auth.options)
+      const tableNames = new Map([
+        ['authAccounts', 'auth_accounts'],
+        ['authSessions', 'auth_sessions'],
+        ['authVerifications', 'auth_verifications'],
+        ['users', 'users'],
+      ])
+      const expectedColumns = Object.entries(schema)
+        .flatMap(([modelName, model]) => {
+          const table = tableNames.get(modelName)
+          if (!table) return []
+          return [
+            { column: 'id', nullable: false, table },
+            ...Object.entries(model.fields).map(([field, attributes]) => ({
+              column: field.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`),
+              // Wallet-only SIWE users keep email nullable.
+              nullable:
+                table === 'users' && field === 'email' ? true : attributes.required === false,
+              table,
+            })),
+          ]
+        })
+        .sort((a, b) => `${a.table}.${a.column}`.localeCompare(`${b.table}.${b.column}`))
+      const currentSchema = (
+        await sql<{ schema: string }>`SELECT current_schema() AS schema`.execute(db.kysely)
+      ).rows[0]!.schema
+      const tables = await db.kysely.introspection.getTables()
+      const actualColumns = tables
+        .filter(
+          (table) =>
+            table.schema === currentSchema && [...tableNames.values()].includes(table.name),
+        )
+        .flatMap((table) =>
+          table.columns
+            .filter((column) =>
+              expectedColumns.some(
+                (expected) => expected.table === table.name && expected.column === column.name,
+              ),
+            )
+            .map((column) => ({
+              column: column.name,
+              nullable: column.isNullable,
+              table: table.name,
+            })),
+        )
+        .sort((a, b) => `${a.table}.${a.column}`.localeCompare(`${b.table}.${b.column}`))
+      expect(actualColumns).toStrictEqual(expectedColumns)
+
+      const indexes = await sql<{ indexName: string }>`
+        SELECT indexname AS "indexName"
+        FROM pg_indexes
+        WHERE schemaname = current_schema()
+          AND tablename IN (
+            'auth_accounts',
+            'auth_sessions',
+            'auth_verifications',
+            'users'
+          )
+        ORDER BY indexname
+      `.execute(db.kysely)
+      expect(indexes.rows.map((row) => row.indexName)).toMatchInlineSnapshot(`
+        [
+          "auth_accounts_issuer_account_id_unique_idx",
+          "auth_accounts_pkey",
+          "auth_accounts_user_id_idx",
+          "auth_sessions_pkey",
+          "auth_sessions_token_key",
+          "auth_sessions_user_id_idx",
+          "auth_verifications_identifier_idx",
+          "auth_verifications_pkey",
+          "users_address_key",
+          "users_email_idx",
+          "users_email_normalized_idx",
+          "users_email_prefix_idx",
+          "users_pkey",
+        ]
+      `)
+    } finally {
+      await db.close()
+    }
+  })
+
+  test('resolves a database factory once per instance', async () => {
+    const db = TestApp.database()
+    let calls = 0
+    try {
+      BetterAuth.create(
+        () => {
+          calls++
+          return db
+        },
+        {
+          basePath: '/v1/auth',
+          baseUrl: 'https://api.example.com',
+          rateLimit: RateLimit.memory(),
+          secret: 'test-better-auth-secret-at-least-32-characters',
+          secureCookies: true,
+        },
+      )
+      expect(calls).toBe(1)
+    } finally {
+      await db.close()
+    }
+  })
+
+  test('starts Google sign-in with the configured callback', async () => {
+    const db = TestApp.database()
+    try {
+      const auth = BetterAuth.create(db, {
+        basePath: '/v1/auth',
+        baseUrl: 'https://console.example.com',
+        google: {
+          clientId: 'google-client-id',
+          clientSecret: 'google-client-secret',
+        },
+        rateLimit: RateLimit.memory(),
+        secret: 'test-better-auth-secret-at-least-32-characters',
+        secureCookies: true,
+      })
+      const response = await auth.handler(
+        new Request('https://console.example.com/v1/auth/sign-in/social', {
+          body: JSON.stringify({ callbackURL: 'https://console.example.com/', provider: 'google' }),
+          headers: {
+            'content-type': 'application/json',
+            origin: 'https://console.example.com',
+          },
+          method: 'POST',
+        }),
+      )
+      expect(response.status).toBe(200)
+      const body = (await response.json()) as { redirect: boolean; url: string }
+      const url = new URL(body.url)
+      expect({
+        clientId: url.searchParams.get('client_id'),
+        origin: url.origin,
+        pathname: url.pathname,
+        redirect: body.redirect,
+        redirectUri: url.searchParams.get('redirect_uri'),
+        scope: url.searchParams.get('scope'),
+      }).toMatchInlineSnapshot(`
+        {
+          "clientId": "google-client-id",
+          "origin": "https://accounts.google.com",
+          "pathname": "/o/oauth2/v2/auth",
+          "redirect": true,
+          "redirectUri": "https://console.example.com/v1/auth/callback/google",
+          "scope": "email profile openid",
+        }
+      `)
+    } finally {
+      await db.close()
+    }
+  })
+})

package/src/internal/BetterAuth.ts

@@ -0,0 +1,349 @@
+import { betterAuth } from 'better-auth'
+import { emailOTP } from 'better-auth/plugins'
+import { oneTimeToken } from 'better-auth/plugins/one-time-token'
+import type { Context as hono_Context } from 'hono'
+import {
+  ColumnNode,
+  type KyselyPlugin,
+  OperationNodeTransformer,
+  OrderByItemNode,
+  PrimitiveValueListNode,
+  type QueryId,
+  QueryNode,
+  ReferenceNode,
+  type SelectQueryNode,
+  TableNode,
+  ValueNode,
+} from 'kysely'
+
+import * as Db from '../db/Db.js'
+import * as Id from './Id.js'
+import type * as RateLimit from './RateLimit.js'
+
+const idPrefix: Record<string, string> = {
+  account: 'acc',
+  session: 'ses',
+  user: 'usr',
+  verification: 'ver',
+}
+
+const queryTransformer = new (class extends OperationNodeTransformer {
+  protected override transformSelectQuery(node: SelectQueryNode, queryId?: QueryId) {
+    const transformed = super.transformSelectQuery(node, queryId)
+    // Legacy duplicate emails resolve to the oldest user, matching Tempo's canonical lookup.
+    const readsUsers = transformed.from?.froms.some(
+      (from) => TableNode.is(from) && from.table.identifier.name === 'users',
+    )
+    if (!readsUsers || transformed.orderBy) return transformed
+    return QueryNode.cloneWithOrderByItems(transformed, [
+      OrderByItemNode.create(ReferenceNode.create(ColumnNode.create('created_at'))),
+      OrderByItemNode.create(ReferenceNode.create(ColumnNode.create('id'))),
+    ])
+  }
+
+  protected override transformPrimitiveValueList(node: PrimitiveValueListNode) {
+    return PrimitiveValueListNode.create(node.values.map(toDatabaseValue))
+  }
+
+  protected override transformValue(node: ValueNode) {
+    return node.value instanceof Date ? ValueNode.create(node.value.toISOString()) : node
+  }
+})()
+
+const dateFields = [
+  'accessTokenExpiresAt',
+  'createdAt',
+  'expiresAt',
+  'refreshTokenExpiresAt',
+  'updatedAt',
+] as const
+
+/**
+ * Creates Better Auth over Tempo's request-leaf Kysely handle. The handler is
+ * not mounted; Tempo routes call the server API explicitly.
+ *
+ * @param source - Database source resolved for this request.
+ * @param options - Better Auth host configuration.
+ * @returns The configured Better Auth server instance.
+ */
+export function create(source: Db.Source, options: create.Options) {
+  const db = Db.get(source)
+  const emailOtp = options.emailOtp
+  return betterAuth({
+    account: { modelName: 'authAccounts' },
+    advanced: {
+      ...(options.waitUntil ? { backgroundTasks: { handler: options.waitUntil } } : {}),
+      cookiePrefix: 'tempo_auth',
+      database: {
+        generateId: ({ model }) => Id.generate(idPrefix[model] ?? 'auth'),
+      },
+      defaultCookieAttributes: {
+        httpOnly: true,
+        path: '/',
+        sameSite: 'lax',
+        secure: options.secureCookies,
+      },
+      ipAddress: { ipAddressHeaders: ['tempo-client-ip'] },
+      // Keep one cookie name across local and hosted environments; the
+      // explicit attribute above still makes hosted cookies secure.
+      useSecureCookies: false,
+    },
+    basePath: options.basePath,
+    baseURL: options.baseUrl,
+    database: {
+      // Better Auth uses `Date` values while Tempo stores user timestamps as
+      // canonical ISO text, so its Kysely view converts both query directions.
+      db: db.kysely.withPlugin({
+        transformQuery: (options) => queryTransformer.transformNode(options.node),
+        async transformResult(options) {
+          return {
+            ...options.result,
+            rows: options.result.rows.map((row) => ({
+              ...row,
+              ...Object.fromEntries(
+                dateFields.flatMap((field) =>
+                  typeof row[field] === 'string' ? [[field, new Date(row[field])]] : [],
+                ),
+              ),
+            })),
+          }
+        },
+      } satisfies KyselyPlugin),
+      transaction: true,
+      type: 'postgres',
+    },
+    databaseHooks: {
+      session: {
+        create: {
+          async before(session, context) {
+            // Better Auth does not store the sign-in method on sessions. Capture it from the route that creates the session.
+            const provider = (() => {
+              if (context?.path === '/sign-in/email-otp') return 'email'
+              if (context?.path === '/callback/:id') return context.params?.['id']
+              if (
+                context?.path === '/sign-in/social' &&
+                context.body &&
+                typeof context.body === 'object' &&
+                'provider' in context.body &&
+                typeof context.body.provider === 'string'
+              )
+                return context.body.provider
+            })()
+            if (!provider) return
+            return { data: { ...session, provider } }
+          },
+        },
+      },
+    },
+    // prettier-ignore
+    plugins: [
+      oneTimeToken({
+        disableSetSessionCookie: true,
+        expiresIn: 3,
+        storeToken: 'hashed',
+      }),
+      // oxlint-disable-next-line unicorn/no-useless-spread -- Keeps optional plugins independently composable.
+      ...(emailOtp
+        ? [
+            emailOTP({
+              allowedAttempts: 3,
+              changeEmail: { enabled: false },
+              disableSignUp: false,
+              expiresIn: 5 * 60,
+              otpLength: 6,
+              rateLimit: { max: 3, window: 60 },
+              resendStrategy: 'rotate',
+              sendVerificationOTP: async ({ email, otp, type }) => {
+                if (type !== 'sign-in') throw new UnsupportedOtpTypeError(type)
+                await emailOtp.send({
+                  from: emailOtp.from,
+                  html: `<p>Your Tempo Developer Console sign-in code is:</p><p><strong>${otp}</strong></p><p>This code expires in five minutes.</p><p>If you did not request this code, ignore this email.</p>`,
+                  subject: `${otp} is your Tempo sign-in code`,
+                  text: `Your Tempo Developer Console sign-in code is ${otp}. It expires in five minutes. If you did not request this code, ignore this email.`,
+                  to: email,
+                })
+              },
+              storeOTP: 'hashed',
+            }),
+          ]
+        : []),
+    ],
+    rateLimit: {
+      customRules: {
+        '/sign-in/social': { max: 3, window: 60 },
+      },
+      customStorage: {
+        async consume(key, rule) {
+          if (rule.window !== 60) throw new UnsupportedRateLimitWindowError(rule.window)
+          const result = await options.rateLimit.consume({
+            key: `better_auth:${key}`,
+            limit: { limit: rule.max, period: 'minute' },
+          })
+          return {
+            allowed: result.allowed,
+            retryAfter: result.allowed ? null : rule.window,
+          }
+        },
+      },
+      enabled: true,
+      max: 100,
+      window: 60,
+    },
+    secret: options.secret,
+    session: {
+      additionalFields: {
+        provider: { input: false, required: false, type: 'string' },
+      },
+      cookieCache: { enabled: false },
+      disableSessionRefresh: true,
+      expiresIn: 24 * 60 * 60,
+      modelName: 'authSessions',
+    },
+    socialProviders: options.google ? { google: options.google } : {},
+    telemetry: { enabled: false },
+    trustedOrigins: [...new Set([options.baseUrl, ...(options.trustedOrigins ?? [])])],
+    user: { modelName: 'users' },
+    verification: { modelName: 'authVerifications' },
+  })
+}
+
+function toDatabaseValue(value: unknown) {
+  return value instanceof Date ? value.toISOString() : value
+}
+
+export declare namespace create {
+  /** Host configuration for a Better Auth instance. */
+  type Options = {
+    /** Mounted path that serves Better Auth. */
+    basePath: string
+    /** Public origin used for cookie and callback URL calculations. */
+    baseUrl: string
+    /** Email OTP delivery capability. Omit to keep the plugin disabled. */
+    emailOtp?:
+      | {
+          /** Sender address for sign-in emails. */
+          from: string
+          /** Sends one sign-in email. */
+          send: (message: create.EmailMessage) => Promise<unknown>
+        }
+      | undefined
+    /** Google OpenID Connect credentials. Omit to keep Google sign-in disabled. */
+    google?:
+      | {
+          /** OAuth client identifier. */
+          clientId: string
+          /** OAuth client secret. */
+          clientSecret: string
+        }
+      | undefined
+    /** Atomic store backing Better Auth's request rate limits. */
+    rateLimit: RateLimit.Store
+    /** High-entropy secret used to protect Better Auth credentials. */
+    secret: string
+    /** Whether Better Auth cookies carry the `Secure` attribute. */
+    secureCookies: boolean
+    /** Additional browser origins accepted by Better Auth. */
+    trustedOrigins?: readonly string[] | undefined
+    /** Keeps deferred Better Auth work alive after the response. */
+    waitUntil?: ((promise: Promise<unknown>) => void) | undefined
+  }
+
+  /** One transactional email. */
+  type EmailMessage = {
+    /** Sender address. */
+    from: string
+    /** HTML body. */
+    html: string
+    /** Subject line. */
+    subject: string
+    /** Plain-text body. */
+    text: string
+    /** Recipient address. */
+    to: string
+  }
+}
+
+/** Creates a request-scoped Better Auth instance from host configuration. */
+export function fromContext(c: hono_Context, options: fromContext.Options) {
+  const email = options.email
+  const url = new URL(c.req.url)
+  const forwardedOrigin = (() => {
+    const host = c.req.header('x-forwarded-host')
+    const protocol = c.req.header('x-forwarded-proto')
+    if (!host || (protocol !== 'http' && protocol !== 'https')) return
+    try {
+      return new URL(`${protocol}://${host}`).origin
+    } catch {
+      return
+    }
+  })()
+  const baseUrl =
+    forwardedOrigin && options.trustedOrigins?.includes(forwardedOrigin)
+      ? forwardedOrigin
+      : url.origin
+  const waitUntil = getWaitUntil(c)
+  return create(options.db, {
+    basePath: options.basePath,
+    baseUrl,
+    ...(email ? { emailOtp: { from: email.from, send: email.send } } : {}),
+    ...(options.google ? { google: options.google } : {}),
+    rateLimit: options.rateLimit,
+    secret: options.secret,
+    secureCookies: new URL(baseUrl).protocol === 'https:',
+    trustedOrigins: options.trustedOrigins,
+    ...(waitUntil ? { waitUntil } : {}),
+  })
+}
+
+/** Returns the request with the host-resolved client IP in a private header. */
+export function request(c: hono_Context, options: fromContext.Options) {
+  const request = c.req.raw
+  const clientIp = options.clientIp(request)
+  const headers = new Headers(request.headers)
+  if (clientIp) headers.set('tempo-client-ip', clientIp)
+  else headers.delete('tempo-client-ip')
+  // Cloudflare's cloned Request generic is narrower than the global constructor accepts.
+  return new Request(request.clone() as never, { headers })
+}
+
+export declare namespace fromContext {
+  /** Static Better Auth configuration derived by the host app. */
+  type Options = Omit<create.Options, 'baseUrl' | 'emailOtp' | 'secureCookies' | 'waitUntil'> & {
+    /** Resolves a client IP from trusted runtime or proxy metadata. */
+    clientIp: (request: Request) => string | undefined
+    /** Database source resolved for this Better Auth instance. */
+    db: Db.Source
+    /** Transactional email capability, or undefined when email is unavailable. */
+    email: Email | undefined
+  }
+
+  /** Minimal transactional email capability provided by the host. */
+  type Email = {
+    /** Sender address for sign-in emails. */
+    from: string
+    /** Sends one sign-in email. */
+    send: (message: create.EmailMessage) => Promise<unknown>
+  }
+}
+
+function getWaitUntil(c: hono_Context) {
+  try {
+    const context = c.executionCtx
+    return context ? context.waitUntil.bind(context) : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/** Raised if a mounted Better Auth route requests an unsupported rate-limit window. */
+export class UnsupportedRateLimitWindowError extends Error {
+  override name = 'BetterAuth.UnsupportedRateLimitWindowError'
+  constructor(window: number) {
+    super(`Better Auth rate-limit window ${window}s is unsupported.`)
+  }
+}
+
+/** Raised if code accidentally enables an unsupported Better Auth OTP purpose. */
+export class UnsupportedOtpTypeError extends Error {
+  override name = 'BetterAuth.UnsupportedOtpTypeError'
+}

package/src/internal/Cache.ts

@@ -23,6 +23,8 @@ export const policies = {
    * content-addressed URL if true `immutable` forever-caching is needed.
    */
   asset: 'public, max-age=86400, stale-while-revalidate=604800',
+  /** Organization invoice estimates; recent meter events may still be processing. */
+  billing: 'private, max-age=60',
   /** Fallback for routes that do not specify a policy. */
   default: 'private, max-age=30, stale-while-revalidate=300',
   /** Newest-first feeds (transactions, receipts, transfers): refresh quickly. */

package/src/internal/EarnRates.test.ts

@@ -123,3 +123,20 @@ describe('annualize', () => {
     `)
   })
 })
+
+describe('migrationScope', () => {
+  test('normalizes the emitter filter and cache identity by vault set', () => {
+    const first = '0x0000000000000000000000000000000000000001'
+    const second = '0x0000000000000000000000000000000000000002'
+
+    const scope = EarnRates.migrationScope({ vaults: [second, first, second] })
+
+    expect(scope).toMatchInlineSnapshot(`
+      {
+        "addresses": "'0x0000000000000000000000000000000000000001', '0x0000000000000000000000000000000000000002'",
+        "key": "9a906f503dd71ffdbbbccfdf00697e04ff0d2d9f2d2b19f532771cc3fc67b4a1",
+      }
+    `)
+    expect(EarnRates.migrationScope({ vaults: [first] }).key).not.toBe(scope.key)
+  })
+})