Authentication

// packages/auth/src/config.ts
import NextAuth from "next-auth";
import Credentials from "next-auth/providers/credentials";
import Google from "next-auth/providers/google";
import GitHub from "next-auth/providers/github";
import { DrizzleAdapter } from "@auth/drizzle-adapter";
import { db } from "@obeya/db";

export const { handlers, auth, signIn, signOut } = NextAuth({
  adapter: DrizzleAdapter(db),
  providers: [
    Credentials({
      credentials: {
        email: { type: "email" },
        password: { type: "password" },
      },
      authorize: async (credentials) => {
        const user = await db.query.users.findFirst({
          where: eq(users.email, credentials.email),
        });
        if (!user || !await verifyPassword(credentials.password, user.passwordHash)) {
          return null;
        }
        return { id: user.id, email: user.email, name: user.name };
      },
    }),
    Google({
      clientId: process.env.GOOGLE_CLIENT_ID,
      clientSecret: process.env.GOOGLE_CLIENT_SECRET,
    }),
    GitHub({
      clientId: process.env.GITHUB_CLIENT_ID,
      clientSecret: process.env.GITHUB_CLIENT_SECRET,
    }),
  ],
  session: { strategy: "jwt" },
  callbacks: {
    jwt: async ({ token, user }) => {
      if (user) {
        token.userId = user.id;
        // Load organization memberships
        token.memberships = await loadMemberships(user.id);
      }
      return token;
    },
    session: async ({ session, token }) => {
      session.user.id = token.userId;
      session.user.memberships = token.memberships;
      return session;
    },
  },
});

1. User submits credentials (or OAuth callback)
      │
2. Auth.js validates credentials
      │
3. JWT token is issued with user ID + memberships
      │
4. Token stored in HTTP-only cookie (`authjs.session-token`)
      │
5. On each request, middleware reads the JWT
      │
6. tRPC context receives the authenticated user
      │
7. Procedures enforce authorization checks

// packages/api/src/trpc.ts
export const createTRPCContext = async (opts: { headers: Headers }) => {
  const session = await auth();
  const tenantId = opts.headers.get("x-tenant-id");

  return {
    db,
    session,
    tenant: tenantId ? { id: tenantId } : null,
    userId: session?.user?.id,
  };
};

// Protected procedure - requires authentication
export const protectedProcedure = t.procedure.use(({ ctx, next }) => {
  if (!ctx.session?.user) {
    throw new TRPCError({ code: "UNAUTHORIZED" });
  }
  return next({
    ctx: {
      ...ctx,
      session: ctx.session,
      userId: ctx.session.user.id,
    },
  });
});

// Admin procedure - requires admin role
export const adminProcedure = protectedProcedure.use(({ ctx, next }) => {
  const membership = ctx.session.user.memberships
    .find(m => m.organizationId === ctx.tenant?.id);

  if (!membership || !["owner", "admin"].includes(membership.role)) {
    throw new TRPCError({ code: "FORBIDDEN" });
  }
  return next({ ctx });
});

curl https://acme.obeya.cloud/api/trpc/items.list \
  -H "Authorization: Bearer oby_pat_xxxxxxxxxxxxx" \
  -H "Content-Type: application/json"

import { hash, verify } from "@node-rs/argon2";

const passwordHash = await hash(password, {
  memoryCost: 65536,   // 64 MB
  timeCost: 3,         // 3 iterations
  parallelism: 4,      // 4 parallel threads
  outputLen: 32,       // 32-byte hash
});