import { Layer } from "effect"; import { IdentityProvider } from "@executor-js/api/server"; import type { SelfHostDbHandle } from "../db/self-host-db";import { BetterAuth, buildBetterAuth, type BetterAuthHandle } from "./better-auth";import { betterAuthIdentityLayer } from "./identity";import { consentRedirectClientId, withClientName, withForcedMcpConsent } from "./force-mcp-consent"; export { BetterAuth, buildBetterAuth, type BetterAuthHandle } from "./better-auth";export { betterAuthIdentityLayer } from "./identity"; // ---------------------------------------------------------------------------// Resolve the self-host auth providers.//// Build the Better Auth instance over the shared libSQL file, expose its// `IdentityProvider` (cookie/bearer/api-key) and its web handler (mounted at// /api/auth/*). Returns the live `BetterAuthHandle` so the composition root can// build the account API and the Better Auth MCP OAuth seam.//// This is the one and only production auth path. Tests that need a fake identity// (single-admin / header-driven) compose `ExecutorApp.make` directly through// `makeSelfHostTestApp` (src/testing/test-app.ts) rather than passing through// here, so this resolution is unconditional.// --------------------------------------------------------------------------- export interface ResolvedAuthProviders {  /** The resolved Better Auth `IdentityProvider` seam (cookie/bearer/api-key). */  readonly identityLayer: Layer.Layer<IdentityProvider>;  /** Better Auth's web handler (`/api/auth/*`). */  readonly authHandler: (request: Request) => Promise<Response>;  /** The live Better Auth handle (account API + Better Auth MCP OAuth seam). */  readonly betterAuth: BetterAuthHandle;} export const resolveAuthProviders = async (  dbHandle: SelfHostDbHandle,): Promise<ResolvedAuthProviders> => {  const betterAuth = await buildBetterAuth(dbHandle.client);  const betterAuthLayer = Layer.succeed(BetterAuth)(betterAuth);   // The consent redirect from Better Auth's authorize only carries the opaque  // client_id; look the registered client_name up (its adapter sees the  // just-written DCR row) so the approval screen reads "Connect Codex?" not a  // random id. Self-declared at open DCR — a label, not a trust signal.  const lookupClientName = async (clientId: string): Promise<string | null> => {    const ctx = await betterAuth.auth.$context;    const app = await ctx.adapter.findOne<{ name?: string | null }>({      model: "oauthApplication",      where: [{ field: "clientId", value: clientId }],    });    return app?.name ?? null;  };   // Force the MCP approval screen: inject `prompt=consent` on every MCP  // authorize so a connecting client is gated on /mcp-consent rather than  // silently granted a token (see ./force-mcp-consent), and enrich the  // resulting consent redirect with the registered client name.  const authHandler = async (request: Request): Promise<Response> => {    const response = await betterAuth.handler(withForcedMcpConsent(request));    if (response.status !== 302) return response;    const clientId = consentRedirectClientId(response.headers.get("location"));    if (!clientId) return response;    const name = await lookupClientName(clientId);    if (!name) return response;    // Preserve the rest of the response — notably the signed consent cookie.    const headers = new Headers(response.headers);    headers.set("location", withClientName(response.headers.get("location")!, name));    return new Response(null, { status: 302, headers });  };   return {    identityLayer: betterAuthIdentityLayer.pipe(Layer.provide(betterAuthLayer)),    authHandler,    betterAuth,  };};