Migrate from Auth0

// BEFORE: server.ts (Auth0)
// Auth0 is not constructed locally. You create a tenant in the dashboard,
// then hit their API with AUTH0_CLIENT_ID, AUTH0_CLIENT_SECRET, AUTH0_DOMAIN.

// AFTER: lib/theauth.ts (TheAuth)
import { createTheAuth } from '@glinr/theauth';
import { organization } from '@glinr/theauth/auth';

export const theauth = await createTheAuth({
  database: { provider: 'postgres', url: process.env.DATABASE_URL! },
  secret: process.env.THEAUTH_SECRET!,
  baseUrl: process.env.AUTH_BASE_URL!, // e.g. https://auth.example.com
  auth: { session: { secret: process.env.SESSION_SECRET! } },
  username: { password: { minLength: 8 } }, // TheAuth's password auth is username-based, see /auth/username
  org: {}, // makes `theauth.org` available, see below
  plugins: [organization()],
});

// BEFORE (Auth0 + Next.js, using nextjs-auth0)
// app/api/auth/[auth0]/route.ts
import { handleAuth } from '@auth0/nextjs-auth0';
export const GET = handleAuth();

// AFTER (TheAuth + Next.js)
// app/api/theauth/[...theauth]/route.ts
import { theAuthNextjs } from '@glinr/theauth-nextjs';
import { theauth } from '@/lib/theauth';

const handlers = theAuthNextjs(theauth);

export const { GET, POST, PATCH, DELETE, OPTIONS } = handlers;

// BEFORE (Auth0 React SDK)
import { useUser } from '@auth0/nextjs-auth0/client';

export function Nav() {
  const { user, isLoading } = useUser();
  if (isLoading) return null;
  return user
    ? <a href="/api/auth/logout">Sign out {user.name}</a>
    : <a href="/api/auth/login">Sign in</a>;
}

// AFTER (@glinr/theauth-react)
import { useUser, useSignOut } from '@glinr/theauth-react';

export function Nav() {
  const { user, isLoading } = useUser();
  const { signOut } = useSignOut();
  if (isLoading) return null;
  return user
    ? <button onClick={() => signOut()}>Sign out {user.name}</button>
    : <a href="/sign-in">Sign in</a>;
}

// BEFORE: Auth0 Action
// onExecutePostLogin: enrich the token with a custom claim
exports.onExecutePostLogin = async (event, api) => {
  if (event.user.email_verified) {
    api.accessToken.setCustomClaim('tenantId', event.user.app_metadata.tenantId);
  }
};

// AFTER: JWT session module with customClaims
import { createJwtSessionModule } from '@glinr/theauth/auth';

const sessions = createJwtSessionModule(
  {
    secret: process.env.JWT_SESSION_SECRET!, // >= 32 chars
    customClaims: (user) => ({ tenantId: lookupTenantId(user.id) }),
  },
  theauth.db,
);

import { createTheAuth } from '@glinr/theauth';

export const theauth = await createTheAuth({
  database: { provider: 'postgres', url: process.env.DATABASE_URL! },
  hooks: {
    beforeAuthorize: async ({ agentId, action, resource }) => {
      if (resource.startsWith('mcp:billing:') && action !== 'read') {
        return { allow: false, reason: 'billing is read-only for agents' };
      }
      return undefined;
    },
  },
});

// BEFORE (Auth0 M2M)
// Each M2M client has a client_id and client_secret. Scopes are assigned per-API.
// Rotation means generating a new secret in the dashboard.

// AFTER (TheAuth agent)
const agent = await theauth.agent.create({
  ownerId: opsUser.id, // the id of an existing row in theauth_users
  name: 'billing-pipeline',
  type: 'service',
  permissions: [
    {
      resource: 'mcp:stripe:*', // `*` matches the rest of the path from that position on
      actions: ['read'],
      constraints: { maxCallsPerHour: 1000 },
    },
    {
      resource: 'mcp:stripe:refund',
      actions: ['execute'],
      constraints: { requireApproval: true },
    },
  ],
});

// agent.token is a kv_... bearer (kv_ plus base64url of 32 random bytes).
// It is returned once and only its SHA-256 hash is stored. Hand it to the service.
// Rotate with theauth.agent.rotate(agent.id) when you need to.
// Revoke with theauth.agent.revoke(agent.id). Authorization decisions are audited.

// scripts/import-auth0.ts
import fs from 'node:fs';
import readline from 'node:readline';
import { randomUUID } from 'node:crypto';
import { Pool } from 'pg';

const pool = new Pool({ connectionString: process.env.DATABASE_URL });

const stream = readline.createInterface({
  input: fs.createReadStream('auth0-users.ndjson'),
});

for await (const line of stream) {
  const u = JSON.parse(line);
  const email = String(u.email).toLowerCase();

  // Pass Auth0's id instead of randomUUID() if your foreign keys depend on it.
  const inserted = await pool.query(
    `INSERT INTO theauth_users
       (id, email, name, email_verified, metadata, force_password_reset, created_at, updated_at)
     VALUES ($1, $2, $3, $4, $5, $6, now(), now())
     ON CONFLICT (email) DO UPDATE SET updated_at = now()
     RETURNING id`,
    [randomUUID(), email, u.name ?? null, Boolean(u.email_verified), JSON.stringify(u.app_metadata ?? {}), Boolean(u.passwordHash)],
  );
  const userId: string = inserted.rows[0].id;

  if (u.passwordHash) {
    // Auth0 releases password hashes through a support request. Social-only users have none.
    await pool.query(
      `INSERT INTO theauth_username_accounts
         (id, user_id, username, password_hash, created_at, updated_at)
       VALUES ($1, $2, $3, 'imported:unusable', now(), now())
       ON CONFLICT DO NOTHING`,
      [randomUUID(), userId, email],
    );
    await pool.query(
      `INSERT INTO legacy_password_hashes (user_id, username, bcrypt_hash) VALUES ($1, $2, $3)
       ON CONFLICT DO NOTHING`,
      [userId, email, u.passwordHash],
    );
  }
}

await pool.end();

import { compare as bcryptCompare } from 'bcrypt';
import { pbkdf2Sync, randomBytes } from 'node:crypto';
import { Pool } from 'pg';
import { theauth } from '../lib/theauth.js';

const pool = new Pool({ connectionString: process.env.DATABASE_URL });

function pbkdf2Format(password: string): string {
  const iterations = 600_000;
  const salt = randomBytes(16);
  const hash = pbkdf2Sync(password, salt, iterations, 32, 'sha256');
  return `pbkdf2:${iterations}:${salt.toString('hex')}:${hash.toString('hex')}`;
}

export async function signInWithLegacyBridge(email: string, password: string) {
  const username = email.toLowerCase();
  const { rows } = await pool.query(
    'SELECT user_id, bcrypt_hash FROM legacy_password_hashes WHERE username = $1',
    [username],
  );
  const legacy = rows[0];

  if (legacy && (await bcryptCompare(password, legacy.bcrypt_hash))) {
    // Legacy hash verified: store a TheAuth-format hash and lift the reset flag.
    await pool.query(
      'UPDATE theauth_username_accounts SET password_hash = $1, updated_at = now() WHERE user_id = $2',
      [pbkdf2Format(password), legacy.user_id],
    );
    await pool.query(
      'UPDATE theauth_users SET force_password_reset = FALSE, updated_at = now() WHERE id = $1',
      [legacy.user_id],
    );
    await pool.query('DELETE FROM legacy_password_hashes WHERE user_id = $1', [legacy.user_id]);
  }

  return theauth.username?.signIn({ username, password });
}

pnpm --filter @glinr/theauth-example-migrate-from-auth0 start
pnpm --filter @glinr/theauth-example-migrate-from-auth0 test