Release v2.20.1: migrate authentication to Better Auth

test/auth-account-sync.test.js

@@ -0,0 +1,27 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { createSyntheticAuthEmail, isSyntheticAuthEmail, toVisibleEmail, setCredentialPassword } = require('../src/data/auth-accounts');
+
+test('credential password is stored directly on the Better Auth account', async () => {
+  const queries = [];
+  const pool = {
+    async query(sql, params) {
+      queries.push([String(sql), params]);
+      if (String(sql).includes('SELECT id, created_at, modified_at FROM a_users')) return [[{ id: 12, created_at: new Date(), modified_at: new Date() }]];
+      return [{ affectedRows: 1 }];
+    }
+  };
+
+  assert.equal(await setCredentialPassword(pool, 12, 'pbkdf2-sha256$310000$salt$hash'), true);
+  assert.ok(queries.some(([sql, params]) => sql.includes('INSERT INTO a_accounts') && params[3] === 'pbkdf2-sha256$310000$salt$hash'));
+  assert.equal(queries.some(([sql]) => sql.includes('auth_email') || sql.includes('email_verified_at')), false);
+});
+
+test('synthetic Better Auth emails stay hidden from app-facing views', () => {
+  const syntheticEmail = createSyntheticAuthEmail(13);
+  assert.match(syntheticEmail, /@identity\.invalid$/);
+  assert.equal(isSyntheticAuthEmail(syntheticEmail), true);
+  assert.equal(toVisibleEmail(syntheticEmail), '');
+  assert.equal(isSyntheticAuthEmail('person@example.com'), false);
+  assert.equal(toVisibleEmail('person@example.com'), 'person@example.com');
+});