34 lines
1.9 KiB
TypeScript
34 lines
1.9 KiB
TypeScript
// SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0
|
|
// What of this app's Better Auth configuration shapes its tables. ./schema.ts is generated from it
|
|
// (test/better-auth.test.ts checks the two agree; `pnpm exec vitest run test/better-auth.test.ts -u`
|
|
// regenerates the schema after a change here), and ../auth.ts builds Better Auth with it.
|
|
//
|
|
// - email and password sign-in, without e-mail verification (an app that sends mail turns it on)
|
|
// - the person's own account deletion (`/delete-user`): the revocation relay hands it to the app's
|
|
// account flow, which erases the person's data in every module (apps/web/src/server/better-auth.ts)
|
|
// - the admin plugin: an administrator disables (`banned`) a user, which ends every session of the
|
|
// user and refuses the next sign-in; the session validation refuses a disabled user as well
|
|
// - rate limits kept in the deployment's own table, since a Convex function keeps no memory
|
|
import { convex } from "@convex-dev/better-auth/plugins"
|
|
import type { BetterAuthOptions } from "better-auth/minimal"
|
|
import { admin } from "better-auth/plugins/admin"
|
|
import type { AuthConfig } from "convex/server"
|
|
|
|
export const MIN_PASSWORD_LENGTH = 12
|
|
|
|
/** The administrators the admin plugin accepts, by Better Auth user ID (BETTER_AUTH_ADMIN_USER_IDS, comma-separated). */
|
|
const adminUserIds = (): string[] =>
|
|
(process.env.BETTER_AUTH_ADMIN_USER_IDS ?? "")
|
|
.split(",")
|
|
.map((id) => id.trim())
|
|
.filter(Boolean)
|
|
|
|
export function betterAuthOptions(authConfig: AuthConfig) {
|
|
return {
|
|
emailAndPassword: { enabled: true, requireEmailVerification: false, minPasswordLength: MIN_PASSWORD_LENGTH },
|
|
user: { deleteUser: { enabled: true } },
|
|
rateLimit: { enabled: true, storage: "database" },
|
|
plugins: [convex({ authConfig }), admin({ adminUserIds: adminUserIds() })],
|
|
} satisfies Omit<BetterAuthOptions, "database">
|
|
}
|