Use and extend auth

import { createApp } from "@voyant-travel/hono"
import type { VoyantRequestAuthContext } from "@voyant-travel/hono/types"

export const app = createApp({
  db: dbFromEnv,
  auth: {
    // Swap in any identity source here. Read whatever credential you issued
    // (a cookie, a provider token) off the request and normalize it.
    async resolve({ request, env }): Promise<VoyantRequestAuthContext | null> {
      const session = await verifyMyProviderSession(request, env)
      if (!session) return null

      return {
        userId: session.userId,
        // Required. For a single-tenant admin app where every session is
        // operator staff, return "staff". A public/customer session must
        // return "customer" (or "partner"/"supplier") so /v1/public/* guards
        // admit it.
        actor: session.isStaff ? "staff" : "customer",
        sessionId: session.id,
        email: session.email,
        // Optional: a staff session's scopes feed member RBAC (see below).
        scopes: session.scopes,
      }
    },
  },
})

import { createBetterAuth } from "@voyant-travel/auth/server"

export const auth = createBetterAuth({
  db,
  // Wire real email delivery; without these the factory logs OTP/reset
  // links to the console.
  async sendVerificationOTP({ email, otp }) {
    await sendEmail(email, `Your code is ${otp}`)
  },
  async sendResetPassword({ user, url }) {
    await sendEmail(user.email, `Reset your password: ${url}`)
  },
  // Revocation-sensitive deployment? Turn off the cookie cache so every
  // request re-checks the session row.
  sessionCookieCache: false,
})

import { createBetterAuth } from "@voyant-travel/auth/server"
import { organization } from "better-auth/plugins"
import { orgTables } from "./schema/org.js" // your Drizzle tables + your migration

export const auth = createBetterAuth({
  db,
  plugins: [organization()],
  // The adapter now knows these tables. Generate and apply their migration
  // yourself. The framework does not.
  extraSchema: orgTables,
})

import { requirePermission } from "@voyant-travel/hono"

adminRoutes.use(
  "/settings/*",
  requirePermission(dbSource, "settings", "update", { auth }),
)