sign-in.mjs

Functions

Imports

It imports apple-secret.mjs. No module of this repo imports it.

Source

1/**
2 * The one way a person signs in to any of the family's sites, as Better Auth options a site spreads into its own
3 * betterAuth({ ... }) beside its database, sessions and hooks. Chosen 2026-10-24 from current practice (passkeys first,
4 * an emailed link as the way in before a passkey exists, social sign-in only where a consumer app wants the reach);
5 * admins are not here, they come through Cloudflare Access (`./access`).
6 *
7 * - PASSKEY: the main way in, phishing-proof because the browser ties it to this site's domain. Its relying party is the
8 *   host of BETTER_AUTH_URL, so a passkey made on the live site works only there. The site's headers need
9 *   PASSKEY_OVERRIDES (`./headers`), or OSHP's Permissions-Policy refuses every passkey sign-in.
10 * - EMAIL LINK: first sign-in, a new device, recovery. No passwords: emailAndPassword is off.
11 * - TURNSTILE on the email link when TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY are both set (a key without its secret
12 *   would show a widget nothing checks; a secret without its key would refuse everyone). The link is the one endpoint
13 *   that mails a stranger. The widget is `./turnstile`.
14 * - GOOGLE AND APPLE only when the site asks (`social: true`) and has the settings: GOOGLE_CLIENT_ID and
15 *   GOOGLE_CLIENT_SECRET; APPLE_CLIENT_ID, APPLE_TEAM_ID, APPLE_KEY_ID and APPLE_PRIVATE_KEY (`./apple-secret` makes the
16 *   secret). Apple comes with Google, since an iPhone app that offers Google sign-in must offer Apple's too.
17 * - ACCOUNTS ARE JOINED ONLY BY A SIGNED-IN PERSON (linkSocial), never by a matching email at sign-in, the recurring
18 *   takeover path.
19 * - RATE LIMITED IN THE DATABASE, keyed on Cloudflare's client address: Better Auth counts each request in one atomic
20 *   database step, in every environment (not only when NODE_ENV says production), and the magic-link plugin adds its
21 *   own five a minute. Sessions and the counts live in the site's D1 (the `session` and `rateLimit` tables), never KV,
22 *   which is eventually consistent: a sign-out would take up to a minute to hold and a count could be lost.
23 *
24 * Async, because Apple's secret is signed with WebCrypto. A site builds its auth once per isolate and keeps the promise.
25 */
26import { passkey } from "@better-auth/passkey";
27import { captcha, magicLink } from "better-auth/plugins";
28
29import { appleClientSecret } from "./apple-secret.mjs";
30
31/** @typedef {Parameters<typeof magicLink>[0]["sendMagicLink"]} SendMagicLink */
32
33/**
34 * The Turnstile site key when the check on the email link is on, else null (the form then shows no widget).
35 * @param {{ TURNSTILE_SITE_KEY?: string, TURNSTILE_SECRET_KEY?: string }} env
36 */
37export function turnstileSiteKey(env) {
38  return env.TURNSTILE_SITE_KEY && env.TURNSTILE_SECRET_KEY ? env.TURNSTILE_SITE_KEY : null;
39}
40
41/**
42 * @param {{
43 *   BETTER_AUTH_URL: string,
44 *   TURNSTILE_SITE_KEY?: string, TURNSTILE_SECRET_KEY?: string,
45 *   GOOGLE_CLIENT_ID?: string, GOOGLE_CLIENT_SECRET?: string,
46 *   APPLE_CLIENT_ID?: string, APPLE_TEAM_ID?: string, APPLE_KEY_ID?: string, APPLE_PRIVATE_KEY?: string,
47 * }} env
48 * @param {{ siteName: string, sendMagicLink: SendMagicLink, social?: boolean }} site
49 */
50export async function signInOptions(env, { siteName, sendMagicLink, social = false }) {
51  const url = new URL(env.BETTER_AUTH_URL);
52  /** @type {any[]} */
53  const plugins = [magicLink({ sendMagicLink }), passkey({ rpID: url.hostname, rpName: siteName, origin: url.origin })];
54  if (turnstileSiteKey(env) && env.TURNSTILE_SECRET_KEY) {
55    plugins.push(
56      captcha({ provider: "cloudflare-turnstile", secretKey: env.TURNSTILE_SECRET_KEY, endpoints: ["/sign-in/magic-link"] }),
57    );
58  }
59
60  /** @type {Record<string, { clientId: string, clientSecret: string }>} */
61  const socialProviders = {};
62  if (social && env.GOOGLE_CLIENT_ID && env.GOOGLE_CLIENT_SECRET) {
63    socialProviders.google = { clientId: env.GOOGLE_CLIENT_ID, clientSecret: env.GOOGLE_CLIENT_SECRET };
64  }
65  const appleSecret = social ? await appleClientSecret(env) : null;
66  if (appleSecret && env.APPLE_CLIENT_ID) {
67    socialProviders.apple = { clientId: env.APPLE_CLIENT_ID, clientSecret: appleSecret };
68  }
69
70  return {
71    emailAndPassword: { enabled: false },
72    plugins,
73    socialProviders,
74    account: { accountLinking: { enabled: true, disableImplicitLinking: true } },
75    rateLimit: { enabled: true, storage: "database" },
76    advanced: { ipAddress: { ipAddressHeaders: ["cf-connecting-ip"] } },
77    // Apple returns to the site with a form POST from its own origin.
78    trustedOrigins: socialProviders.apple ? ["https://appleid.apple.com"] : [],
79  };
80}
81
82/** Which buttons a sign-in page shows, for its loader to hand the page. */
83/** @param {Parameters<typeof signInOptions>[0]} env */
84export function signInMethods(env, { social = false } = {}) {
85  return {
86    google: social && Boolean(env.GOOGLE_CLIENT_ID && env.GOOGLE_CLIENT_SECRET),
87    apple: social && Boolean(env.APPLE_CLIENT_ID && env.APPLE_TEAM_ID && env.APPLE_KEY_ID && env.APPLE_PRIVATE_KEY),
88    turnstileSiteKey: turnstileSiteKey(env),
89  };
90}