Initial public upload from Projekte/Experimente

95b671e verified about 1 month ago

8.97 kB

import { db, schema } from "@superlog/db";
import { betterAuth } from "better-auth";
import { drizzleAdapter } from "better-auth/adapters/drizzle";
import { admin, organization } from "better-auth/plugins";
import { autumn } from "autumn-js/better-auth";
import { eq } from "drizzle-orm";
import {
  orgInvitationEmailBody,
  passwordResetEmailBody,
  sendEmail,
  verificationEmailBody,
} from "./email.js";

// Better Auth server config. Mounted at /api/auth/* by apps/api/src/index.ts.
//
// Schema mapping: we reuse our existing `users`, `orgs`, `org_members` tables
// instead of letting Better Auth own parallel ones. The drizzle adapter
// accepts a `schema` map keyed by the model names BA expects. The
// organization plugin's `member.organizationId` and `invitation.organizationId`
// columns live on the `orgId` TS property in our schema, so we map those
// explicitly via the plugin's `schema.X.fields` config.
//
// Identity is UUID end-to-end: `advanced.database.generateId` makes BA emit
// UUIDs for new rows so foreign keys to our existing uuid columns line up.

const WEB_ORIGIN = process.env.WEB_ORIGIN ?? "http://localhost:5173";
const API_ORIGIN = process.env.BETTER_AUTH_URL ?? "http://localhost:4100";

// Derive the parent domain that web and api share so the OAuth state cookie
// is scoped to `.<eTLD+1>` instead of pinned to the api host. For prod that's
// `.superlog.sh`; for localhost / .superlog.localhost it's `undefined`
// because browsers won't honour Domain= on a TLD or localhost.
function sharedCookieDomain(): string | undefined {
  try {
    const apiHost = new URL(API_ORIGIN).hostname;
    const webHost = new URL(WEB_ORIGIN).hostname;
    if (apiHost === webHost) return undefined; // same host, no cross-sub needed
    if (apiHost === "localhost" || webHost === "localhost") return undefined;
    if (apiHost.endsWith(".localhost") || webHost.endsWith(".localhost")) return undefined;
    // Trim to the longest common dotted suffix shared by both hosts. For
    // api.superlog.sh / superlog.sh that yields "superlog.sh".
    const a = apiHost.split(".");
    const b = webHost.split(".");
    const parts: string[] = [];
    while (a.length && b.length && a[a.length - 1] === b[b.length - 1]) {
      parts.unshift(a.pop() as string);
      b.pop();
    }
    if (parts.length < 2) return undefined; // needs at least eTLD+1
    return `.${parts.join(".")}`;
  } catch {
    return undefined;
  }
}

const COOKIE_DOMAIN = sharedCookieDomain();

// Autumn billing plugin. Maps each org (a Better Auth "organization") to an
// Autumn customer, auto-created on first sign-in, so billing is per-org. Only
// enabled when AUTUMN_SECRET_KEY is present, so local dev / worktrees without
// billing config keep working — same opt-in pattern as the social providers.
const autumnPlugins = process.env.AUTUMN_SECRET_KEY
  ? [autumn({ customerScope: "organization" })]
  : [];

// Fail loud and early if the signing secret is missing. Better Auth doesn't
// throw on undefined `secret` — depending on the build it falls back to a
// fresh random value per process start, which silently invalidates every
// session on every deploy. Match the previous CLERK_SECRET_KEY guard so
// missing config surfaces as a startup error, not a slow-burn outage.
const BETTER_AUTH_SECRET = process.env.BETTER_AUTH_SECRET;
if (!BETTER_AUTH_SECRET) throw new Error("BETTER_AUTH_SECRET is required");

// Both providers stay disabled when their client IDs are missing — Better
// Auth's `socialProviders` map only enables what's present, so dropping the
// keys here is enough to hide the buttons in dev without breaking sign-up.
const googleProvider =
  process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET
    ? {
        clientId: process.env.GOOGLE_CLIENT_ID,
        clientSecret: process.env.GOOGLE_CLIENT_SECRET,
      }
    : undefined;

const githubProvider =
  process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET
    ? {
        clientId: process.env.GITHUB_CLIENT_ID,
        clientSecret: process.env.GITHUB_CLIENT_SECRET,
        // GitHub returns email: null in /user when the address is set to
        // "Keep my email addresses private". user:email scope lets Better Auth
        // fall back to /user/emails for the verified primary. Has no effect on
        // GitHub Apps (which derive scopes from the App's User permissions) —
        // for those, enable the "Email addresses" user permission on the App.
        scope: ["user:email", "read:user"],
      }
    : undefined;

// Picks the org to make active for a session. Prefers an explicit override
// (set via the org plugin's setActive API) then falls back to the user's
// first membership. Returns null if the user has no memberships — that's an
// error state callers can decide how to handle.
async function pickActiveOrgId(userId: string): Promise<string | null> {
  const membership = await db.query.orgMembers.findFirst({
    where: eq(schema.orgMembers.userId, userId),
  });
  return membership?.orgId ?? null;
}

export const auth = betterAuth({
  baseURL: API_ORIGIN,
  secret: BETTER_AUTH_SECRET,
  trustedOrigins: [WEB_ORIGIN],
  database: drizzleAdapter(db, {
    provider: "pg",
    schema: {
      user: schema.users,
      session: schema.sessions,
      account: schema.accounts,
      verification: schema.verifications,
      organization: schema.orgs,
      member: schema.orgMembers,
      invitation: schema.invitations,
    },
  }),
  advanced: {
    database: {
      generateId: () => crypto.randomUUID(),
    },
    // Web and API often live on different subdomains of the same parent
    // domain (e.g. `superlog.sh` + `api.superlog.sh`). The OAuth state
    // cookie has to round-trip from BA's `/api/auth/sign-in/social` response
    // through the provider and back to `/api/auth/callback/<provider>`; if
    // the cookie is pinned to the API host instead of the parent domain it
    // can fail to ride along on some browsers and BA returns
    // `State mismatch: verification not found`. When the hosts share an
    // eTLD+1, scope to the parent. localhost / *.localhost are skipped
    // because browsers reject Domain= on those.
    ...(COOKIE_DOMAIN
      ? {
          crossSubDomainCookies: { enabled: true, domain: COOKIE_DOMAIN },
          defaultCookieAttributes: { sameSite: "lax" as const, secure: true },
        }
      : {}),
  },
  emailAndPassword: {
    enabled: true,
    // Sign-ups still land logged-in immediately to keep dev/worktree flows
    // fast — the verification email is still sent (see `emailVerification`
    // below) so the user can confirm at their leisure. Flip this to true once
    // we want to gate /api/* access on a verified address.
    requireEmailVerification: false,
    sendResetPassword: async ({ user, url }) => {
      const body = passwordResetEmailBody(url);
      await sendEmail({ to: user.email, subject: "Reset your Superlog password", ...body });
    },
  },
  emailVerification: {
    sendOnSignUp: true,
    autoSignInAfterVerification: true,
    sendVerificationEmail: async ({ user, url }) => {
      const body = verificationEmailBody(url);
      await sendEmail({ to: user.email, subject: "Confirm your email for Superlog", ...body });
    },
  },
  socialProviders: {
    ...(googleProvider ? { google: googleProvider } : {}),
    ...(githubProvider ? { github: githubProvider } : {}),
  },
  plugins: [
    organization({
      schema: {
        // Our `org_members` table uses `orgId` (TS) / `org_id` (SQL) instead
        // of Better Auth's expected `organizationId`. Same for `invitations`.
        member: {
          fields: { organizationId: "orgId" },
        },
        invitation: {
          fields: { organizationId: "orgId" },
        },
      },
      sendInvitationEmail: async ({ id, email, role, organization, inviter }) => {
        const url = `${WEB_ORIGIN}/accept-invitation?id=${encodeURIComponent(id)}`;
        const body = orgInvitationEmailBody({
          url,
          orgName: organization.name,
          inviterEmail: inviter.user.email,
          inviterName: inviter.user.name,
          role,
        });
        await sendEmail({
          to: email,
          subject: `You're invited to ${organization.name} on Superlog`,
          ...body,
        });
      },
    }),
    admin(),
    ...autumnPlugins,
  ],
  databaseHooks: {
    session: {
      create: {
        before: async (session) => {
          // Seed the active org so the first request after sign-in already
          // has org context. If the user has no memberships yet (e.g. on a
          // bootstrap race) leave it null; callers handle that.
          if (session.activeOrganizationId) return { data: session };
          const activeOrganizationId = await pickActiveOrgId(session.userId);
          return { data: { ...session, activeOrganizationId } };
        },
      },
    },
  },
});

export type Auth = typeof auth;

	import { db, schema } from "@superlog/db";
	import { betterAuth } from "better-auth";
	import { drizzleAdapter } from "better-auth/adapters/drizzle";
	import { admin, organization } from "better-auth/plugins";
	import { autumn } from "autumn-js/better-auth";
	import { eq } from "drizzle-orm";
	import {
	orgInvitationEmailBody,
	passwordResetEmailBody,
	sendEmail,
	verificationEmailBody,
	} from "./email.js";

	// Better Auth server config. Mounted at /api/auth/* by apps/api/src/index.ts.
	//
	// Schema mapping: we reuse our existing `users`, `orgs`, `org_members` tables
	// instead of letting Better Auth own parallel ones. The drizzle adapter
	// accepts a `schema` map keyed by the model names BA expects. The
	// organization plugin's `member.organizationId` and `invitation.organizationId`
	// columns live on the `orgId` TS property in our schema, so we map those
	// explicitly via the plugin's `schema.X.fields` config.
	//
	// Identity is UUID end-to-end: `advanced.database.generateId` makes BA emit
	// UUIDs for new rows so foreign keys to our existing uuid columns line up.

	const WEB_ORIGIN = process.env.WEB_ORIGIN ?? "http://localhost:5173";
	const API_ORIGIN = process.env.BETTER_AUTH_URL ?? "http://localhost:4100";

	// Derive the parent domain that web and api share so the OAuth state cookie
	// is scoped to `.<eTLD+1>` instead of pinned to the api host. For prod that's
	// `.superlog.sh`; for localhost / .superlog.localhost it's `undefined`
	// because browsers won't honour Domain= on a TLD or localhost.
	function sharedCookieDomain(): string \| undefined {
	try {
	const apiHost = new URL(API_ORIGIN).hostname;
	const webHost = new URL(WEB_ORIGIN).hostname;
	if (apiHost === webHost) return undefined; // same host, no cross-sub needed
	if (apiHost === "localhost" \|\| webHost === "localhost") return undefined;
	if (apiHost.endsWith(".localhost") \|\| webHost.endsWith(".localhost")) return undefined;
	// Trim to the longest common dotted suffix shared by both hosts. For
	// api.superlog.sh / superlog.sh that yields "superlog.sh".
	const a = apiHost.split(".");
	const b = webHost.split(".");
	const parts: string[] = [];
	while (a.length && b.length && a[a.length - 1] === b[b.length - 1]) {
	parts.unshift(a.pop() as string);
	b.pop();
	}
	if (parts.length < 2) return undefined; // needs at least eTLD+1
	return `.${parts.join(".")}`;
	} catch {
	return undefined;
	}
	}

	const COOKIE_DOMAIN = sharedCookieDomain();

	// Autumn billing plugin. Maps each org (a Better Auth "organization") to an
	// Autumn customer, auto-created on first sign-in, so billing is per-org. Only
	// enabled when AUTUMN_SECRET_KEY is present, so local dev / worktrees without
	// billing config keep working — same opt-in pattern as the social providers.
	const autumnPlugins = process.env.AUTUMN_SECRET_KEY
	? [autumn({ customerScope: "organization" })]
	: [];

	// Fail loud and early if the signing secret is missing. Better Auth doesn't
	// throw on undefined `secret` — depending on the build it falls back to a
	// fresh random value per process start, which silently invalidates every
	// session on every deploy. Match the previous CLERK_SECRET_KEY guard so
	// missing config surfaces as a startup error, not a slow-burn outage.
	const BETTER_AUTH_SECRET = process.env.BETTER_AUTH_SECRET;
	if (!BETTER_AUTH_SECRET) throw new Error("BETTER_AUTH_SECRET is required");

	// Both providers stay disabled when their client IDs are missing — Better
	// Auth's `socialProviders` map only enables what's present, so dropping the
	// keys here is enough to hide the buttons in dev without breaking sign-up.
	const googleProvider =
	process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET
	? {
	clientId: process.env.GOOGLE_CLIENT_ID,
	clientSecret: process.env.GOOGLE_CLIENT_SECRET,
	}
	: undefined;

	const githubProvider =
	process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET
	? {
	clientId: process.env.GITHUB_CLIENT_ID,
	clientSecret: process.env.GITHUB_CLIENT_SECRET,
	// GitHub returns email: null in /user when the address is set to
	// "Keep my email addresses private". user:email scope lets Better Auth
	// fall back to /user/emails for the verified primary. Has no effect on
	// GitHub Apps (which derive scopes from the App's User permissions) —
	// for those, enable the "Email addresses" user permission on the App.
	scope: ["user:email", "read:user"],
	}
	: undefined;

	// Picks the org to make active for a session. Prefers an explicit override
	// (set via the org plugin's setActive API) then falls back to the user's
	// first membership. Returns null if the user has no memberships — that's an
	// error state callers can decide how to handle.
	async function pickActiveOrgId(userId: string): Promise<string \| null> {
	const membership = await db.query.orgMembers.findFirst({
	where: eq(schema.orgMembers.userId, userId),
	});
	return membership?.orgId ?? null;
	}

	export const auth = betterAuth({
	baseURL: API_ORIGIN,
	secret: BETTER_AUTH_SECRET,
	trustedOrigins: [WEB_ORIGIN],
	database: drizzleAdapter(db, {
	provider: "pg",
	schema: {
	user: schema.users,
	session: schema.sessions,
	account: schema.accounts,
	verification: schema.verifications,
	organization: schema.orgs,
	member: schema.orgMembers,
	invitation: schema.invitations,
	},
	}),
	advanced: {
	database: {
	generateId: () => crypto.randomUUID(),
	},
	// Web and API often live on different subdomains of the same parent
	// domain (e.g. `superlog.sh` + `api.superlog.sh`). The OAuth state
	// cookie has to round-trip from BA's `/api/auth/sign-in/social` response
	// through the provider and back to `/api/auth/callback/<provider>`; if
	// the cookie is pinned to the API host instead of the parent domain it
	// can fail to ride along on some browsers and BA returns
	// `State mismatch: verification not found`. When the hosts share an
	// eTLD+1, scope to the parent. localhost / *.localhost are skipped
	// because browsers reject Domain= on those.
	...(COOKIE_DOMAIN
	? {
	crossSubDomainCookies: { enabled: true, domain: COOKIE_DOMAIN },
	defaultCookieAttributes: { sameSite: "lax" as const, secure: true },
	}
	: {}),
	},
	emailAndPassword: {
	enabled: true,
	// Sign-ups still land logged-in immediately to keep dev/worktree flows
	// fast — the verification email is still sent (see `emailVerification`
	// below) so the user can confirm at their leisure. Flip this to true once
	// we want to gate /api/* access on a verified address.
	requireEmailVerification: false,
	sendResetPassword: async ({ user, url }) => {
	const body = passwordResetEmailBody(url);
	await sendEmail({ to: user.email, subject: "Reset your Superlog password", ...body });
	},
	},
	emailVerification: {
	sendOnSignUp: true,
	autoSignInAfterVerification: true,
	sendVerificationEmail: async ({ user, url }) => {
	const body = verificationEmailBody(url);
	await sendEmail({ to: user.email, subject: "Confirm your email for Superlog", ...body });
	},
	},
	socialProviders: {
	...(googleProvider ? { google: googleProvider } : {}),
	...(githubProvider ? { github: githubProvider } : {}),
	},
	plugins: [
	organization({
	schema: {
	// Our `org_members` table uses `orgId` (TS) / `org_id` (SQL) instead
	// of Better Auth's expected `organizationId`. Same for `invitations`.
	member: {
	fields: { organizationId: "orgId" },
	},
	invitation: {
	fields: { organizationId: "orgId" },
	},
	},
	sendInvitationEmail: async ({ id, email, role, organization, inviter }) => {
	const url = `${WEB_ORIGIN}/accept-invitation?id=${encodeURIComponent(id)}`;
	const body = orgInvitationEmailBody({
	url,
	orgName: organization.name,
	inviterEmail: inviter.user.email,
	inviterName: inviter.user.name,
	role,
	});
	await sendEmail({
	to: email,
	subject: `You're invited to ${organization.name} on Superlog`,
	...body,
	});
	},
	}),
	admin(),
	...autumnPlugins,
	],
	databaseHooks: {
	session: {
	create: {
	before: async (session) => {
	// Seed the active org so the first request after sign-in already
	// has org context. If the user has no memberships yet (e.g. on a
	// bootstrap race) leave it null; callers handle that.
	if (session.activeOrganizationId) return { data: session };
	const activeOrganizationId = await pickActiveOrgId(session.userId);
	return { data: { ...session, activeOrganizationId } };
	},
	},
	},
	},
	});

	export type Auth = typeof auth;