Application authentication

Application session
  → application auth provider
  → { subject, tenantId }
  → tenant-isolated Hookfish operations

pnpm add @hookfish/auth-better-auth better-auth

import { createHookfish } from '@hookfish/api'
import { betterAuth } from '@hookfish/auth-better-auth'
import { auth } from './auth'

export const hookfish = await createHookfish({
  db,
  providers,
  auth: betterAuth(auth),
})

import type { ApplicationAuthProvider } from '@hookfish/api'

export const applicationAuth: ApplicationAuthProvider = {
  async authenticate(request) {
    const grant = await verifyApplicationSession(request)
    if (!grant) {
      return {
        authenticated: false,
        response: Response.json(
          { error: { code: 'application_auth_required' } },
          { status: 401 },
        ),
      }
    }

    return {
      authenticated: true,
      principal: {
        subject: grant.userId,
        tenantId: grant.verifiedOrganizationId,
        roles: grant.roles,
      },
    }
  },
}