Files
cfw-auth/src/plugins.ts

78 lines
2.0 KiB
TypeScript

import { passkey } from "@better-auth/passkey";
import type { BetterAuthPlugin } from "better-auth";
import {
admin,
captcha,
emailOTP,
genericOAuth,
haveIBeenPwned,
jwt,
lastLoginMethod,
multiSession,
openAPI,
twoFactor,
bearer,
} from "better-auth/plugins";
import { buildAuthEmail, sendEmail } from "./email";
import { booleanEnv, type Env } from "./env";
import { createGenericOAuthProviders } from "./oauth";
export function createAuthPlugins(env: Env): BetterAuthPlugin[] {
const plugins: BetterAuthPlugin[] = [
openAPI(),
haveIBeenPwned({
customPasswordCompromisedMessage: "This password has appeared in a data breach.",
}),
emailOTP({
otpLength: 6,
expiresIn: 300,
allowedAttempts: 3,
storeOTP: "hashed",
sendVerificationOnSignUp: true,
overrideDefaultEmailVerification: false,
sendVerificationOTP: async ({ email, otp }) => {
await sendEmail(env, buildAuthEmail({ kind: "email-otp", to: email, otp }));
},
}),
twoFactor(),
multiSession({ maximumSessions: 10 }),
lastLoginMethod({ storeInDatabase: true }),
admin(),
];
if (env.CAPTCHA_PROVIDER === "cloudflare-turnstile" && env.CAPTCHA_SECRET_KEY) {
plugins.push(
captcha({
provider: "cloudflare-turnstile",
secretKey: env.CAPTCHA_SECRET_KEY,
endpoints: ["/sign-up/email", "/sign-in/email", "/forget-password"],
}),
);
}
const genericProviders = createGenericOAuthProviders(env);
if (genericProviders.length > 0) {
plugins.push(genericOAuth({ config: genericProviders }));
}
if (env.PASSKEY_RP_ID && env.PASSKEY_RP_NAME && env.PASSKEY_ORIGIN) {
plugins.push(
passkey({
rpID: env.PASSKEY_RP_ID,
rpName: env.PASSKEY_RP_NAME,
origin: env.PASSKEY_ORIGIN,
}),
);
}
if (booleanEnv(env.ENABLE_JWT)) {
plugins.push(jwt());
}
if (booleanEnv(env.ENABLE_BEARER)) {
plugins.push(bearer());
}
return plugins;
}