Authentification

import { betterAuth } from "better-auth";
import { drizzleAdapter } from "better-auth/adapters/drizzle";
import { organization, magicLink } from "better-auth/plugins";
import { db } from "@bell/db";
import * as schema from "@bell/db/schema/auth";
import { sendMail } from "./mail";

const baseDomain = process.env.NODE_ENV === "production" ? ".hoaiy.com" : undefined;

export const auth = betterAuth({
  database: drizzleAdapter(db, { provider: "pg", schema }),

  trustedOrigins: [
    "http://localhost:3001",
    "http://localhost:3002",
    "https://bell-app.hoaiy.com",
    "https://bell-staff.hoaiy.com",
    "https://bell-docs.hoaiy.com",
  ],

  emailAndPassword: {
    enabled: true,
    requireEmailVerification: true,
    sendResetPassword: async ({ user, url }) => {
      await sendMail({
        to: user.email,
        template: "passwordReset",
        data: { url },
      });
    },
  },

  advanced: {
    defaultCookieAttributes: {
      sameSite: "lax",
      secure: process.env.NODE_ENV === "production",
      httpOnly: true,
      domain: baseDomain,              // ".hoaiy.com" en prod, undefined en dev
    },
  },

  plugins: [
    organization({
      sendInvitationEmail: async (data) => {
        const acceptUrl = `${process.env.BETTER_AUTH_URL}/api/auth/organization/accept-invitation?invitationId=${data.invitation.id}`;
        await sendMail({
          to: data.email,
          template: "invitation",
          data: {
            orgName: data.organization.name,
            inviterName: data.inviter.user.name ?? data.inviter.user.email,
            role: data.role,
            acceptUrl,
          },
        });
      },
    }),
    magicLink({
      expiresIn: 600,                  // 10 min
      sendMagicLink: async ({ email, url }) => {
        await sendMail({ to: email, template: "magicLink", data: { url } });
      },
    }),
  ],
});

export type Session = Awaited<ReturnType<typeof auth.api.getSession>>;

import { NextResponse } from "next/server";
import type { NextRequest } from "next/server";

const AUTH_PATHS = ["/auth/sign-in", "/auth/sign-up", "/auth/forgot-password"];
const CHECK_IN_FLOW = ["/auth/waiting", "/auth/fast-check-in", "/auth/create-password",
                      "/auth/check-in-confirmation", "/auth/check-in-upsells", "/auth/check-in-payment"];

export async function middleware(req: NextRequest) {
  const sessionCookie = req.cookies.get("better-auth.session_token");

  // Pas de session → /auth/waiting (le seul point d'entrée public)
  if (!sessionCookie) {
    if (req.nextUrl.pathname === "/auth/waiting" || AUTH_PATHS.includes(req.nextUrl.pathname)) {
      return NextResponse.next();
    }
    return NextResponse.redirect(new URL("/auth/waiting", req.url));
  }

  // Session → fetch check-in status depuis l'API
  const statusRes = await fetch(`${process.env.SERVER_URL}/cardex/my-status`, {
    headers: { cookie: req.headers.get("cookie") ?? "" },
  });
  const { status } = await statusRes.json();

  // Pas encore "arrived" → bloque sur le flow check-in
  if (status !== "arrived") {
    if (CHECK_IN_FLOW.includes(req.nextUrl.pathname)) return NextResponse.next();
    return NextResponse.redirect(new URL("/auth/waiting", req.url));
  }

  // "arrived" → accès total
  if (AUTH_PATHS.includes(req.nextUrl.pathname) || CHECK_IN_FLOW.includes(req.nextUrl.pathname)) {
    return NextResponse.redirect(new URL("/", req.url));
  }
  return NextResponse.next();
}

export const config = { matcher: ["/((?!_next|api|.*\\..*).*)"] };

type Session = {
  user: {
    id: string;
    email: string;
    name: string;
    emailVerified: boolean;
    image?: string;
    createdAt: Date;
  };
  session: {
    id: string;
    token: string;                       // le cookie value
    userId: string;
    expiresAt: Date;
    activeOrganizationId: string | null; // rempli par organization plugin
    ipAddress: string;
    userAgent: string;
  };
};

// packages/api/src/plugins/auth.ts
export const authPlugin = new Elysia()
  .derive({ as: "global" }, async ({ request }) => {
    const session = await auth.api.getSession({ headers: request.headers });
    if (!session) return { auth: null };

    // Si activeOrganizationId manquant, fallback sur la première membership
    let orgId = session.session.activeOrganizationId;
    let role: string | null = null;
    if (!orgId) {
      const [m] = await db.select().from(member)
        .where(eq(member.userId, session.user.id))
        .limit(1);
      orgId = m?.organizationId ?? null;
      role = m?.role ?? null;
    } else {
      const [m] = await db.select().from(member)
        .where(and(eq(member.userId, session.user.id), eq(member.organizationId, orgId)))
        .limit(1);
      role = m?.role ?? null;
    }

    return {
      auth: { userId: session.user.id, email: session.user.email, organizationId: orgId, role },
    };
  });

// Dans les callbacks Better Auth (sendInvitationEmail, sendMagicLink, etc.)
await queues.email.add("magic-link", {
  to: email,
  template: "magicLink",
  data: { url },
  skipValidation: true,          // magic link reçu depuis user authentifié, skip Reacher
});