feat: expose request origin in server auth context (#304)

Author: onmax

docs/content/1.getting-started/2.configuration.md

@@ -198,16 +198,28 @@ import { defineServerAuth } from '@onmax/nuxt-better-auth/config'
 export default defineServerAuth((ctx) => ({
   emailAndPassword: { enabled: true },
 
-  // Access the database connection via ctx.db when using NuxtHub
-  // Example: pass ctx.db to your own plugin/helper.
-  // Do not set `database` here when using module-managed adapters.
   appName: ctx.runtimeConfig.public.siteUrl ? 'Better Auth App' : 'Better Auth',
+}))
+```
+
+- `ctx.runtimeConfig`: Nuxt runtime config.
+- `ctx.db`: NuxtHub database connection when NuxtHub DB is enabled. Do not set `database` when using module-managed adapters.
+- `ctx.requestOrigin`: Current request origin when auth is created with `serverAuth(event)`.
+
+Use `requestOrigin` when Better Auth config needs the current request host, such as trusted origins:
+
+```ts [server/auth.config.ts]
+import { defineServerAuth } from '@onmax/nuxt-better-auth/config'
 
-  // Access runtime config if needed
-  // someValue: ctx.runtimeConfig.customKey
+export default defineServerAuth(({ requestOrigin }) => ({
+  trustedOrigins: requestOrigin ? [requestOrigin] : [],
 }))
 ```
 
+::note
+For configured canonical URLs, read `runtimeConfig.public.siteUrl`. `requestOrigin` is optional and only available when auth is created from a request event. If allowed origins vary while using an explicit `siteUrl`, configure those origins explicitly or use Better Auth's `trustedOrigins` function form, because the auth instance can be cached.
+::
+
 ### Session Enrichment
 
 You can enrich session payloads with Better Auth's `custom-session` plugin through `plugins` in `defineServerAuth`. This module does not provide a separate `requestSession.enrich` option.

src/module/type-templates.ts

@@ -91,13 +91,15 @@ declare module '#nuxt-better-auth' {
   interface ServerAuthContext {
     runtimeConfig: RuntimeConfig
     db: ${hasHubDb ? `typeof import('@nuxthub/db')['db']` : 'undefined'}
+    requestOrigin?: string
   }
   type PluginTypes = InferPluginTypes<_Config>
 }
 
 interface _AugmentedServerAuthContext {
   runtimeConfig: RuntimeConfig
   db: ${hasHubDb ? `typeof import('@nuxthub/db')['db']` : 'undefined'}
+  requestOrigin?: string
 }
 
 declare module '@onmax/nuxt-better-auth/config' {

src/runtime/server/utils/auth.ts

@@ -249,6 +249,7 @@ function withDevTrustedOrigins(
 export function serverAuth(event?: H3Event): AuthInstance {
   const runtimeConfig = useRuntimeConfig()
   const siteUrl = getBaseURL(event)
+  const requestOrigin = resolveEventOrigin(event)
   const hasExplicitSiteUrl = runtimeConfig.public.siteUrl && typeof runtimeConfig.public.siteUrl === 'string'
   const cacheKey = hasExplicitSiteUrl ? '__explicit__' : siteUrl
 
@@ -257,7 +258,7 @@ export function serverAuth(event?: H3Event): AuthInstance {
     return cached
 
   const database = createDatabase()
-  const userConfig = createServerAuth({ runtimeConfig, db }) as BetterAuthOptions & {
+  const userConfig = createServerAuth({ runtimeConfig, db, requestOrigin }) as BetterAuthOptions & {
     secondaryStorage?: BetterAuthOptions['secondaryStorage']
   }
   const trustedOrigins = withDevTrustedOrigins(userConfig.trustedOrigins, Boolean(hasExplicitSiteUrl))

src/runtime/types/augment.ts

@@ -30,6 +30,7 @@ export interface AuthSession {
 export interface ServerAuthContext {
   runtimeConfig: Record<string, unknown>
   db: unknown
+  requestOrigin?: string
 }
 
 // Extended by generated types from configured socialProviders keys.

test/cases/base-url-inference/nuxt.config.ts

@@ -1,3 +1,10 @@
+import { fileURLToPath } from 'node:url'
+
+const serverConfig = fileURLToPath(new URL('./server/auth.config', import.meta.url))
+
 export default defineNuxtConfig({
   extends: ['../_base-module'],
+  auth: {
+    serverConfig,
+  },
 })

test/cases/base-url-inference/server/api/test/base-url.get.ts

@@ -1,4 +1,4 @@
 export default defineEventHandler((event) => {
-  const auth = serverAuth(event) as { options?: { baseURL?: string } }
-  return { baseURL: auth.options?.baseURL }
+  const auth = serverAuth(event) as { options?: { appName?: string, baseURL?: string } }
+  return { appName: auth.options?.appName, baseURL: auth.options?.baseURL }
 })

test/cases/base-url-inference/server/auth.config.ts

@@ -0,0 +1,8 @@
+import { defineServerAuth } from '../../../../src/runtime/config'
+
+export default defineServerAuth(({ requestOrigin }) => ({
+  appName: requestOrigin || 'missing-request-origin',
+  socialProviders: {
+    github: { clientId: 'test', clientSecret: 'test' },
+  },
+}))

test/cases/plugins-type-inference/server/auth.config.ts

@@ -24,7 +24,7 @@ function customAdminLikePlugin() {
   } as const
 }
 
-export default defineServerAuth({
+export default defineServerAuth(() => ({
   emailAndPassword: { enabled: true },
   plugins: [customAdminLikePlugin(), username()] as const,
   user: {
@@ -35,4 +35,4 @@ export default defineServerAuth({
       },
     },
   },
-})
+}))

test/schema-generator.test.ts

@@ -157,6 +157,15 @@ describe('defineServerAuth', () => {
     expect(factory({ runtimeConfig: {} as any, db: {} as any })).toEqual({ hasDb: true })
     expect(factory({ runtimeConfig: {} as any, db: undefined })).toEqual({ hasDb: false })
   })
+
+  it('function syntax receives requestOrigin context', () => {
+    const factory = defineServerAuth(({ requestOrigin }) => ({ requestOrigin }))
+    expect(factory({
+      runtimeConfig: {} as any,
+      db: undefined,
+      requestOrigin: 'https://example.com',
+    })).toEqual({ requestOrigin: 'https://example.com' })
+  })
 })
 
 describe('defineClientAuth', () => {

test/server-auth-base-url-cache.test.ts

@@ -15,7 +15,7 @@ describe('serverAuth baseURL inference', async () => {
       },
     })
     expect(firstResponse.status).toBe(200)
-    const firstBody = await firstResponse.json() as { baseURL: string | undefined }
+    const firstBody = await firstResponse.json() as { appName: string | undefined, baseURL: string | undefined }
 
     const secondResponse = await fetch(url('/api/test/base-url'), {
       headers: {
@@ -24,9 +24,11 @@ describe('serverAuth baseURL inference', async () => {
       },
     })
     expect(secondResponse.status).toBe(200)
-    const secondBody = await secondResponse.json() as { baseURL: string | undefined }
+    const secondBody = await secondResponse.json() as { appName: string | undefined, baseURL: string | undefined }
 
+    expect(firstBody.appName).toBe('https://first.example.com')
     expect(firstBody.baseURL).toBe('https://first.example.com')
+    expect(secondBody.appName).toBe('https://second.example.com')
     expect(secondBody.baseURL).toBe('https://second.example.com')
   })
 })