diff --git a/apps/worker/package.json b/apps/worker/package.json index a7228a0..db08026 100644 --- a/apps/worker/package.json +++ b/apps/worker/package.json @@ -17,7 +17,7 @@ "@acme/ui": "workspace:*", "@tanstack/react-query": "^5.100.13", "@tanstack/react-router": "^1.170.7", - "better-auth": "^1.6.11", + "better-auth": "^1.6.23", "hono": "^4.12.22", "lucide-react": "^1.16.0", "next-themes": "^0.4.6", diff --git a/packages/auth/package.json b/packages/auth/package.json index d67fb3d..aefc7f9 100644 --- a/packages/auth/package.json +++ b/packages/auth/package.json @@ -13,8 +13,8 @@ }, "dependencies": { "@acme/db": "workspace:*", - "@better-auth/kysely-adapter": "^1.6.11", - "better-auth": "^1.6.11", + "@better-auth/kysely-adapter": "^1.6.23", + "better-auth": "^1.6.23", "uuid": "^14.0.0" }, "devDependencies": { diff --git a/packages/auth/src/auth.ts b/packages/auth/src/auth.ts index 794d5fc..ed943e6 100644 --- a/packages/auth/src/auth.ts +++ b/packages/auth/src/auth.ts @@ -4,8 +4,6 @@ import { v7 as uuidv7 } from "uuid"; import { db } from "@acme/db"; -import { hashPassword, verifyPassword } from "./password"; - function requireEnv(name: string): string { const value = process.env[name]?.trim(); if (!value) { @@ -36,10 +34,6 @@ function createAuth() { }, emailAndPassword: { enabled: true, - password: { - hash: hashPassword, - verify: verifyPassword, - }, }, }); } diff --git a/packages/auth/src/password.ts b/packages/auth/src/password.ts deleted file mode 100644 index 000c296..0000000 --- a/packages/auth/src/password.ts +++ /dev/null @@ -1,53 +0,0 @@ -import { randomBytes, scrypt, timingSafeEqual } from "node:crypto"; - -/** - * Native scrypt for Better Auth email/password. - * - * Wrangler resolves `@better-auth/utils/password` to the pure-JS `@noble/hashes` - * fallback (no `workerd` export), which exceeds Workers CPU limits on sign-in. - * This matches `@better-auth/utils/dist/password.node.mjs` (hex salt string, same params). - */ -const SCRYPT = { - N: 16384, - r: 16, - p: 1, - dkLen: 64, - maxmem: 128 * 16384 * 16 * 2, -} as const; - -function deriveKey(password: string, salt: string): Promise { - return new Promise((resolve, reject) => { - scrypt( - password.normalize("NFKC"), - salt, - SCRYPT.dkLen, - { N: SCRYPT.N, r: SCRYPT.r, p: SCRYPT.p, maxmem: SCRYPT.maxmem }, - (error, key) => { - if (error) reject(error); - else resolve(key); - }, - ); - }); -} - -export async function hashPassword(password: string): Promise { - const salt = randomBytes(16).toString("hex"); - const key = await deriveKey(password, salt); - return `${salt}:${key.toString("hex")}`; -} - -export async function verifyPassword({ - hash, - password, -}: { - hash: string; - password: string; -}): Promise { - const [salt, keyHex] = hash.split(":"); - if (!salt || !keyHex) return false; - - const derived = await deriveKey(password, salt); - const expected = Buffer.from(keyHex, "hex"); - if (derived.length !== expected.length) return false; - return timingSafeEqual(derived, expected); -} diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 1a28a32..a1faf10 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -48,8 +48,8 @@ importers: specifier: ^1.170.7 version: 1.170.7(react-dom@19.2.6)(react@19.2.6) better-auth: - specifier: ^1.6.11 - version: 1.6.11(@cloudflare/workers-types@5.20260718.1)(react-dom@19.2.6)(react@19.2.6) + specifier: ^1.6.23 + version: 1.6.23(@cloudflare/workers-types@5.20260718.1)(react-dom@19.2.6)(react@19.2.6) hono: specifier: ^4.12.22 version: 4.12.22 @@ -109,11 +109,11 @@ importers: specifier: workspace:* version: link:../db '@better-auth/kysely-adapter': - specifier: ^1.6.11 - version: 1.6.11(@better-auth/core@1.6.11)(@better-auth/utils@0.4.0)(kysely@0.28.17) + specifier: ^1.6.23 + version: 1.6.23(@better-auth/core@1.6.23)(@better-auth/utils@0.4.2)(kysely@0.28.17) better-auth: - specifier: ^1.6.11 - version: 1.6.11(@cloudflare/workers-types@5.20260718.1)(react-dom@19.2.6)(react@19.2.6) + specifier: ^1.6.23 + version: 1.6.23(@cloudflare/workers-types@5.20260718.1)(react-dom@19.2.6)(react@19.2.6) uuid: specifier: ^14.0.0 version: 14.0.0 @@ -518,14 +518,14 @@ packages: '@babel/helper-validator-identifier': 7.28.5 dev: false - /@better-auth/core@1.6.11(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@cloudflare/workers-types@5.20260718.1)(better-call@1.3.5)(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0): - resolution: {integrity: sha512-LrwidLCV8azdMGjvtwp30nj9tIv1BwI3VhtC0UaGSjQkAVWw4bN42I8qwbxRziPeSQoj+zUVkOpxZzAWBDARtQ==} + /@better-auth/core@1.6.23(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@5.20260718.1)(better-call@1.3.7)(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0): + resolution: {integrity: sha512-beEhOs0uVeOxYOZKUfIEBd/nQV2Bd4/6wyLxZ0OFkn6CMTK2Vi+hXuZLnyPBeB6RdHpebEoJWiHqwHxBIxgPDQ==} peerDependencies: - '@better-auth/utils': 0.4.0 - '@better-fetch/fetch': 1.1.21 + '@better-auth/utils': 0.4.2 + '@better-fetch/fetch': 1.3.1 '@cloudflare/workers-types': '>=4' '@opentelemetry/api': ^1.9.0 - better-call: 1.3.5 + better-call: 1.3.7 jose: ^6.1.0 kysely: 0.28.17 nanostores: ^1.0.1 @@ -535,76 +535,76 @@ packages: '@opentelemetry/api': optional: true dependencies: - '@better-auth/utils': 0.4.0 - '@better-fetch/fetch': 1.1.21 + '@better-auth/utils': 0.4.2 + '@better-fetch/fetch': 1.3.1 '@cloudflare/workers-types': 5.20260718.1 '@opentelemetry/semantic-conventions': 1.41.1 '@standard-schema/spec': 1.1.0 - better-call: 1.3.5(zod@4.4.3) + better-call: 1.3.7(zod@4.4.3) jose: 6.2.3 kysely: 0.28.17 nanostores: 1.3.0 zod: 4.4.3 dev: false - /@better-auth/drizzle-adapter@1.6.11(@better-auth/core@1.6.11)(@better-auth/utils@0.4.0): - resolution: {integrity: sha512-4jpkETIGZOHCf7BK4jnu22fdN6jjomH0/HhEzkaWy3+Eppi5PYlHTF/460jrTmA3Xc+Vqwp9t282ymHiEPypGw==} + /@better-auth/drizzle-adapter@1.6.23(@better-auth/core@1.6.23)(@better-auth/utils@0.4.2): + resolution: {integrity: sha512-2+/PTVfIP9E7iz6af8TB3lhnowHUj9ljC66kECmHaFEdUqPgzHoWux9epotKwO7XDg2ui4ttWQ8CMeNFLvQeKQ==} peerDependencies: - '@better-auth/core': ^1.6.11 - '@better-auth/utils': 0.4.0 + '@better-auth/core': ^1.6.23 + '@better-auth/utils': 0.4.2 drizzle-orm: ^0.45.2 peerDependenciesMeta: drizzle-orm: optional: true dependencies: - '@better-auth/core': 1.6.11(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@cloudflare/workers-types@5.20260718.1)(better-call@1.3.5)(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0) - '@better-auth/utils': 0.4.0 + '@better-auth/core': 1.6.23(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@5.20260718.1)(better-call@1.3.7)(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0) + '@better-auth/utils': 0.4.2 dev: false - /@better-auth/kysely-adapter@1.6.11(@better-auth/core@1.6.11)(@better-auth/utils@0.4.0)(kysely@0.28.17): - resolution: {integrity: sha512-/g8M9RfIjdcZDnbstSUvQiINkvdNlCeZr248zwqx2/PVksQI1MhQofbzUn3RnQnbPKp0EPwpX/dR3oudRFenUg==} + /@better-auth/kysely-adapter@1.6.23(@better-auth/core@1.6.23)(@better-auth/utils@0.4.2)(kysely@0.28.17): + resolution: {integrity: sha512-zbNJsMbG09exfkGyvFqBLLqWoMPAUWjxCuUnEK5AsjbYoZeIjj/QGZgdf4CapVWryKxjA9Q6Jlr6fbiPpC3VAg==} peerDependencies: - '@better-auth/core': ^1.6.11 - '@better-auth/utils': 0.4.0 + '@better-auth/core': ^1.6.23 + '@better-auth/utils': 0.4.2 kysely: 0.28.17 peerDependenciesMeta: kysely: optional: true dependencies: - '@better-auth/core': 1.6.11(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@cloudflare/workers-types@5.20260718.1)(better-call@1.3.5)(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0) - '@better-auth/utils': 0.4.0 + '@better-auth/core': 1.6.23(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@5.20260718.1)(better-call@1.3.7)(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0) + '@better-auth/utils': 0.4.2 kysely: 0.28.17 dev: false - /@better-auth/memory-adapter@1.6.11(@better-auth/core@1.6.11)(@better-auth/utils@0.4.0): - resolution: {integrity: sha512-hpdfw0BBf8MuzLkIdmbcUZICbY9r/bhLO2RxSnkzT5+/O+0I0u2I8+m0YUP7vNllP/ZCKASHOYgXPLO75Z0f9Q==} + /@better-auth/memory-adapter@1.6.23(@better-auth/core@1.6.23)(@better-auth/utils@0.4.2): + resolution: {integrity: sha512-krIiR0pIVkaKlAzm690n5bcMW4NGbqeMg0HQSD9fz/KcQF/eWLqcq9gG/BhHTj2i/y96qH+W5JWPmaSOS5iTgQ==} peerDependencies: - '@better-auth/core': ^1.6.11 - '@better-auth/utils': 0.4.0 + '@better-auth/core': ^1.6.23 + '@better-auth/utils': 0.4.2 dependencies: - '@better-auth/core': 1.6.11(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@cloudflare/workers-types@5.20260718.1)(better-call@1.3.5)(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0) - '@better-auth/utils': 0.4.0 + '@better-auth/core': 1.6.23(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@5.20260718.1)(better-call@1.3.7)(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0) + '@better-auth/utils': 0.4.2 dev: false - /@better-auth/mongo-adapter@1.6.11(@better-auth/core@1.6.11)(@better-auth/utils@0.4.0): - resolution: {integrity: sha512-3Tor8rSv8vSEIMEaV2PFpPEuVhqc1gNoZ6eGvoh3LwExXXuj8madew6ob+H1pH7Aphn3Ar5PQ08AguT8TbwFAA==} + /@better-auth/mongo-adapter@1.6.23(@better-auth/core@1.6.23)(@better-auth/utils@0.4.2): + resolution: {integrity: sha512-7+QdevitGlKBbP6JbiSk5SBnzPsKV/mDrQBGBn8hwByQLeJwqpqbuBPw7ZI8vzUlFfAAnyFiqwP3Eb8mxnp7pA==} peerDependencies: - '@better-auth/core': ^1.6.11 - '@better-auth/utils': 0.4.0 + '@better-auth/core': ^1.6.23 + '@better-auth/utils': 0.4.2 mongodb: ^6.0.0 || ^7.0.0 peerDependenciesMeta: mongodb: optional: true dependencies: - '@better-auth/core': 1.6.11(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@cloudflare/workers-types@5.20260718.1)(better-call@1.3.5)(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0) - '@better-auth/utils': 0.4.0 + '@better-auth/core': 1.6.23(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@5.20260718.1)(better-call@1.3.7)(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0) + '@better-auth/utils': 0.4.2 dev: false - /@better-auth/prisma-adapter@1.6.11(@better-auth/core@1.6.11)(@better-auth/utils@0.4.0): - resolution: {integrity: sha512-Pw+7q7zTp+VSci1V+CYMvuxIbAeVMZLe4lRo46LJoAKMHfjFl5T/ycsyFvWs/DkWC7n9gZZzRDEbHp0I5FiKKw==} + /@better-auth/prisma-adapter@1.6.23(@better-auth/core@1.6.23)(@better-auth/utils@0.4.2): + resolution: {integrity: sha512-2qSdzidq4tkb1eS5TTqb4Nzg0mdZWm3Qky9SYeXeb8PpVQbC2sxqJhEM5mK7y12uU6I8hc64wO9f7AFVNL+6UQ==} peerDependencies: - '@better-auth/core': ^1.6.11 - '@better-auth/utils': 0.4.0 + '@better-auth/core': ^1.6.23 + '@better-auth/utils': 0.4.2 '@prisma/client': ^5.0.0 || ^6.0.0 || ^7.0.0 prisma: ^5.0.0 || ^6.0.0 || ^7.0.0 peerDependenciesMeta: @@ -613,30 +613,30 @@ packages: prisma: optional: true dependencies: - '@better-auth/core': 1.6.11(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@cloudflare/workers-types@5.20260718.1)(better-call@1.3.5)(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0) - '@better-auth/utils': 0.4.0 + '@better-auth/core': 1.6.23(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@5.20260718.1)(better-call@1.3.7)(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0) + '@better-auth/utils': 0.4.2 dev: false - /@better-auth/telemetry@1.6.11(@better-auth/core@1.6.11)(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21): - resolution: {integrity: sha512-hsjDHc8MZbm6/AHeNdtywrWedXevnBjmdvnHTcZub+rTVjOv+Td0roI8USKuC6uUibmrl//2rJfVCsGbopihNA==} + /@better-auth/telemetry@1.6.23(@better-auth/core@1.6.23)(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1): + resolution: {integrity: sha512-/R2Kb+z2BpDOOWwVHqOk+c0VNpuwfCv4Hp5Yr9003WIZPax/zyNraGLB9CFE8qF2gZW8Dsz419k4I8CPrGzpDA==} peerDependencies: - '@better-auth/core': ^1.6.11 - '@better-auth/utils': 0.4.0 - '@better-fetch/fetch': 1.1.21 + '@better-auth/core': ^1.6.23 + '@better-auth/utils': 0.4.2 + '@better-fetch/fetch': 1.3.1 dependencies: - '@better-auth/core': 1.6.11(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@cloudflare/workers-types@5.20260718.1)(better-call@1.3.5)(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0) - '@better-auth/utils': 0.4.0 - '@better-fetch/fetch': 1.1.21 + '@better-auth/core': 1.6.23(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@5.20260718.1)(better-call@1.3.7)(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0) + '@better-auth/utils': 0.4.2 + '@better-fetch/fetch': 1.3.1 dev: false - /@better-auth/utils@0.4.0: - resolution: {integrity: sha512-RpMtLUIQAEWMgdPLNVbIF5ON2mm+CH0U3rCdUCU1VyeAUui4m38DyK7/aXMLZov2YDjG684pS1D0MBllrmgjQA==} + /@better-auth/utils@0.4.2: + resolution: {integrity: sha512-AUxrvu+HaaODsUyzDxFgwd/8RZ1yZaYo42LXKSrU2oGgR38pS1ij8nqQKNgtTWoYGpNevNXtCfgTy6loHveW9A==} dependencies: '@noble/hashes': 2.2.0 dev: false - /@better-fetch/fetch@1.1.21: - resolution: {integrity: sha512-/ImESw0sskqlVR94jB+5+Pxjf+xBwDZF/N5+y2/q4EqD7IARUTSpPfIo8uf39SYpCxyOCtbyYpUrZ3F/k0zT4A==} + /@better-fetch/fetch@1.3.1: + resolution: {integrity: sha512-ABkD1WhyfPZprKRQI3bhATjeiFuNWC9PXhfGWqL+sg/gKrM977oFrYkdb4msM3hgUGonr7KlOsOFT5TU2rht9g==} dev: false /@chevrotain/cst-dts-gen@10.5.0: @@ -4354,8 +4354,8 @@ packages: hasBin: true dev: false - /better-auth@1.6.11(@cloudflare/workers-types@5.20260718.1)(react-dom@19.2.6)(react@19.2.6): - resolution: {integrity: sha512-Wwt6+q07dwIhsp6XiM7L1qSXVUWBEtNl+eZvwM778CguFqDZFBN9Pt6LtFaHl55t8Z+Zc//5kxcbgDY8/79vFQ==} + /better-auth@1.6.23(@cloudflare/workers-types@5.20260718.1)(react-dom@19.2.6)(react@19.2.6): + resolution: {integrity: sha512-4vOaRd9UiKGKm9R+ej0jjU1es3MiJIiNc9Qq3VCnYqOZ4/nb5272QqTxWYoDxyUXl5x6A2x2we5KZKQO9teTQQ==} peerDependencies: '@lynx-js/react': '*' '@prisma/client': ^5.0.0 || ^6.0.0 || ^7.0.0 @@ -4416,18 +4416,18 @@ packages: vue: optional: true dependencies: - '@better-auth/core': 1.6.11(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@cloudflare/workers-types@5.20260718.1)(better-call@1.3.5)(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0) - '@better-auth/drizzle-adapter': 1.6.11(@better-auth/core@1.6.11)(@better-auth/utils@0.4.0) - '@better-auth/kysely-adapter': 1.6.11(@better-auth/core@1.6.11)(@better-auth/utils@0.4.0)(kysely@0.28.17) - '@better-auth/memory-adapter': 1.6.11(@better-auth/core@1.6.11)(@better-auth/utils@0.4.0) - '@better-auth/mongo-adapter': 1.6.11(@better-auth/core@1.6.11)(@better-auth/utils@0.4.0) - '@better-auth/prisma-adapter': 1.6.11(@better-auth/core@1.6.11)(@better-auth/utils@0.4.0) - '@better-auth/telemetry': 1.6.11(@better-auth/core@1.6.11)(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21) - '@better-auth/utils': 0.4.0 - '@better-fetch/fetch': 1.1.21 + '@better-auth/core': 1.6.23(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@5.20260718.1)(better-call@1.3.7)(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0) + '@better-auth/drizzle-adapter': 1.6.23(@better-auth/core@1.6.23)(@better-auth/utils@0.4.2) + '@better-auth/kysely-adapter': 1.6.23(@better-auth/core@1.6.23)(@better-auth/utils@0.4.2)(kysely@0.28.17) + '@better-auth/memory-adapter': 1.6.23(@better-auth/core@1.6.23)(@better-auth/utils@0.4.2) + '@better-auth/mongo-adapter': 1.6.23(@better-auth/core@1.6.23)(@better-auth/utils@0.4.2) + '@better-auth/prisma-adapter': 1.6.23(@better-auth/core@1.6.23)(@better-auth/utils@0.4.2) + '@better-auth/telemetry': 1.6.23(@better-auth/core@1.6.23)(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1) + '@better-auth/utils': 0.4.2 + '@better-fetch/fetch': 1.3.1 '@noble/ciphers': 2.2.0 '@noble/hashes': 2.2.0 - better-call: 1.3.5(zod@4.4.3) + better-call: 1.3.7(zod@4.4.3) defu: 6.1.7 jose: 6.2.3 kysely: 0.28.17 @@ -4440,16 +4440,16 @@ packages: - '@opentelemetry/api' dev: false - /better-call@1.3.5(zod@4.4.3): - resolution: {integrity: sha512-kOFJkBP7utAQLEYrobZm3vkTH8mXq5GNgvjc5/XEST1ilVHaxXUXfeDeFlqoETMtyqS4+3/h4ONX2i++ebZrvA==} + /better-call@1.3.7(zod@4.4.3): + resolution: {integrity: sha512-Al51/hjp2SSp6CRTa3F2ptcx4yQVS1xWKoY6jcVXqNYOap6mHFP2jUBn5EwIL4iIed1/Sq4hlQ+Umm6EflZG+w==} peerDependencies: zod: ^4.0.0 peerDependenciesMeta: zod: optional: true dependencies: - '@better-auth/utils': 0.4.0 - '@better-fetch/fetch': 1.1.21 + '@better-auth/utils': 0.4.2 + '@better-fetch/fetch': 1.3.1 rou3: 0.7.12 set-cookie-parser: 3.1.0 zod: 4.4.3