Merge pull request #307 from GTBitsOfGood/claude/festive-lamport-l3btp7

Keep localhost sign-in working with a tenant BETTER_AUTH_URL, and stop the seed duplicating notifications

Author: shaply

docs/VISIONARIES_DEVELOPMENT.md

@@ -12,12 +12,20 @@ email configuration for ordinary development.
 
 Add `visionariestothethrone.lvh.me` to the comma-separated `ALLOWED_DEV_ORIGINS`
 value in your local `.env` (preserve any existing entries). Restart Next.js after
-changing it. For this tenant's auth work, set:
+changing it.
+
+Leave `BETTER_AUTH_URL` at the template's `http://localhost:3000`. Visionaries,
+ServiceStart at `localhost:3000`, and the other seeded tenants all work with it
+at the same time. Change it only when you need links that Better Auth builds,
+such as the password reset link, to open on the Visionaries host:
 
 ```dotenv
 BETTER_AUTH_URL=http://visionariestothethrone.lvh.me:3000
 ```
 
+`localhost:3000` keeps working with either value. Restart Next.js after changing
+it.
+
 With your **local development database** configured, run:
 
 ```bash

lib/auth.ts

@@ -28,21 +28,28 @@ const baseURL = process.env.BETTER_AUTH_URL || getBaseUrl();
  * Tenants are served from subdomains of the tenant root domain (`<slug>.lvh.me`
  * in local development). Better Auth only trusts its base URL by default and
  * rejects cookie-bearing requests from other origins, so trust the tenant
- * hosts too. These are static patterns rather than a per-request function
- * because Better Auth stores per-request origins on a context shared by
- * concurrent requests.
+ * hosts too. Outside production, also trust localhost, which serves the
+ * default tenant locally, so it keeps working when BETTER_AUTH_URL points at
+ * another tenant's host. These are static patterns rather than a per-request
+ * function because Better Auth stores per-request origins on a context shared
+ * by concurrent requests.
  */
-function tenantTrustedOrigins(): string[] {
-  const { protocol, port } = new URL(baseURL);
+export function tenantTrustedOrigins(authBaseURL: string): string[] {
+  const { protocol, port } = new URL(authBaseURL);
   const suffix = port ? `:${port}` : "";
+  const isProduction = process.env.NODE_ENV === "production";
   const roots = [getTenantRootDomain()];
-  if (process.env.NODE_ENV !== "production" && !roots.includes("lvh.me")) {
+  if (!isProduction && !roots.includes("lvh.me")) {
     roots.push("lvh.me");
   }
-  return roots.flatMap((root) => [
+  const origins = roots.flatMap((root) => [
     `${protocol}//${root}${suffix}`,
     `${protocol}//*.${root}${suffix}`,
   ]);
+  if (!isProduction) {
+    origins.push(`${protocol}//localhost${suffix}`);
+  }
+  return origins;
 }
 
 export const auth = betterAuth({
@@ -177,7 +184,7 @@ export const auth = betterAuth({
     },
   },
   baseURL,
-  trustedOrigins: tenantTrustedOrigins(),
+  trustedOrigins: tenantTrustedOrigins(baseURL),
   database: drizzleAdapter(db, {
     provider: "pg",
     usePlural: true,

scripts/seed.ts

@@ -1,5 +1,4 @@
 import "dotenv/config"; //must be first to load environment variables
-import { randomUUID } from "node:crypto";
 import { EventVisibility, JoinRequestStatus, schema } from "../lib/schema";
 import db from "../lib/db";
 import { auth } from "@/lib/auth";
@@ -580,15 +579,33 @@ export async function main() {
 
   for (const email of memberEmails) {
     for (const org of ORGS) {
-      const notificationValues = notificationTemplates.map((tmpl) => ({
-        id: randomUUID(),
-        userId: userIdsByOrganization.get(org.id)!.get(email)!,
-        organizationId: org.id,
-        type: tmpl.type,
-        text: tmpl.text,
-        read: tmpl.read,
-        createdAt: new Date(Date.now() - tmpl.minutesAgo * 60 * 1000),
-      }));
+      const userId = userIdsByOrganization.get(org.id)!.get(email)!;
+      // Skip the ones the user already has. Seeds before the IDs below were
+      // stable gave them random IDs, which onConflictDoNothing can't match.
+      const existing = await db
+        .select({ text: schema.notifications.text })
+        .from(schema.notifications)
+        .where(
+          and(
+            eq(schema.notifications.userId, userId),
+            eq(schema.notifications.organizationId, org.id),
+          ),
+        );
+      const existingTexts = new Set(existing.map((row) => row.text));
+      const notificationValues = notificationTemplates
+        .map((tmpl, index) => ({
+          // Stable, so a seed running at the same time hits
+          // onConflictDoNothing instead of inserting a second copy.
+          id: `notif_${org.id}_${userId}_${index}`,
+          userId,
+          organizationId: org.id,
+          type: tmpl.type,
+          text: tmpl.text,
+          read: tmpl.read,
+          createdAt: new Date(Date.now() - tmpl.minutesAgo * 60 * 1000),
+        }))
+        .filter((notification) => !existingTexts.has(notification.text));
+      if (notificationValues.length === 0) continue;
 
       await db
         .insert(schema.notifications)

tests/unit/lib/auth.test.ts

@@ -1,8 +1,8 @@
 // @vitest-environment node
-import { describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 import { and, eq } from "drizzle-orm";
 import db from "@/lib/db";
-import { auth } from "@/lib/auth";
+import { auth, tenantTrustedOrigins } from "@/lib/auth";
 import { eventRsvps, members, MemberType, shiftRSVPs } from "@/lib/schema";
 import {
   addMember,
@@ -207,6 +207,29 @@ describe("trusted origins", () => {
   });
 });
 
+describe(tenantTrustedOrigins, () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("keeps trusting localhost when the base URL is a tenant's host", () => {
+    const origins = tenantTrustedOrigins(
+      "http://visionariestothethrone.lvh.me:3000",
+    );
+
+    expect(origins).toContain("http://localhost:3000");
+    expect(origins).toContain("http://*.lvh.me:3000");
+  });
+
+  it("doesn't trust localhost in production", () => {
+    vi.stubEnv("NODE_ENV", "production");
+
+    const origins = tenantTrustedOrigins("https://acme.servicestart.com");
+
+    expect(origins.some((origin) => origin.includes("localhost"))).toBe(false);
+  });
+});
+
 describe("member type", () => {
   it("is returned with the member", async () => {
     const org = await createOrganization("member-type-read");

tests/unit/scripts/seed.test.ts

@@ -13,12 +13,13 @@ import {
   formComponents,
   FormStatus,
   MemberType,
+  notifications,
 } from "@/lib/schema";
 import { FormDefinitionSchema } from "@/lib/forms/schema";
 import { OrganizationConfigService } from "@/lib/services/OrganizationConfigService";
 import { hashPassword } from "better-auth/crypto";
 import { main } from "@/scripts/seed";
-import { and, asc, eq, isNull } from "drizzle-orm";
+import { and, asc, count, eq, isNull } from "drizzle-orm";
 import { expect, it } from "vitest";
 import {
   createForm,
@@ -54,6 +55,16 @@ it("should not create duplicate organizations on multiple runs", async () => {
   expect(orgs.length).toBe(1); // Only one organization with the slug 'servicestart' should exist
 });
 
+it("doesn't duplicate notifications on multiple runs", async () => {
+  await main();
+  const [first] = await db.select({ count: count() }).from(notifications);
+  await main();
+  const [second] = await db.select({ count: count() }).from(notifications);
+
+  expect(first.count).toBeGreaterThan(0);
+  expect(second.count).toBe(first.count);
+});
+
 it("creates users/accounts such that they can be signed into", async () => {
   await main();