Migrate from Auth.js

SELECT count(*) AS users FROM users;
SELECT provider, type, count(*) AS accounts FROM accounts GROUP BY provider, type ORDER BY 3 DESC;
SELECT count(*) AS provider_users FROM users u WHERE EXISTS (SELECT 1 FROM accounts a WHERE a."userId" = u.id);
SELECT count(*) AS import_users FROM users u WHERE NOT EXISTS (SELECT 1 FROM accounts a WHERE a."userId" = u.id);

import { betterIam } from 'better-iam';
import { postgresAdapter } from 'better-iam/adapter-postgres';
import { createOAuthLogin } from 'better-iam/oauth';
import { sendMail } from './mail';

export const iam = betterIam({
  database: postgresAdapter({ connectionString: process.env.DATABASE_URL! }),
  secret: process.env.BETTER_IAM_SECRET!,
  baseURL: process.env.BETTER_IAM_BASE_URL!,
  authentication: {
    passwordlessEmail: true, // replaces the Auth.js Email provider
    sendEmail: async (message) => sendMail(message),
  },
  permissions: {
    identityAttributes: { legacyId: 'string' }, // the Auth.js users.id, as principal.legacyId
    resourceTypes: {
      post: { actions: ['posts:read', 'posts:write'] },
    },
  },
});

const tenantId = process.env.IAM_TENANT_ID; // set after the next step
const origin = 'https://app.example.com';

// createOAuthLogin refuses a connection without a tenant ID, so the connections start once the tenant exists.
if (tenantId)
  iam.useProtocol(
    createOAuthLogin({
      ...iam.protocolHost,
      basePath: '/api/iam/oauth/login',
      trustedOrigins: [origin],
      connections: [
        {
          id: 'google',
          tenantId,
          kind: 'google',
          clientId: process.env.AUTH_GOOGLE_ID!,
          clientSecret: process.env.AUTH_GOOGLE_SECRET!,
          redirectUri: `${origin}/api/iam/oauth/google/callback`,
        },
        {
          id: 'github',
          tenantId,
          kind: 'github',
          clientId: process.env.AUTH_GITHUB_ID!,
          clientSecret: process.env.AUTH_GITHUB_SECRET!,
          redirectUri: `${origin}/api/iam/oauth/github/callback`,
        },
      ],
    }),
  );

npx better-iam login --config better-iam.config.mjs --tenant <root-tenant-id> --email root@example.com
export BETTER_IAM_TOKEN=$(npx better-iam token --config better-iam.config.mjs)
export ROOT_TENANT_ID=<root-tenant-id>
export AUTHJS_DATABASE_URL=postgres://...

import { iam } from '../../lib/iam';

const admin = { token: process.env.BETTER_IAM_TOKEN! };

const { tenant } = await iam.api.tenants.create(admin, {
  parentId: process.env.ROOT_TENANT_ID!,
  type: 'organization',
  name: 'Example App',
  slug: 'app',
  ownerEmail: 'you@example.com',
  activate: true, // active now; the owner's account is created without an invitation
  ownerName: 'You',
});
console.log('IAM_TENANT_ID =', tenant.id);

import pg from 'pg';
import { iam } from '../../lib/iam';

const source = new pg.Pool({ connectionString: process.env.AUTHJS_DATABASE_URL });
const admin = { token: process.env.BETTER_IAM_TOKEN! };
const tenantId = process.env.IAM_TENANT_ID!;
const ownerEmail = 'you@example.com'; // the tenant owner already exists: tenants.create created them

/**
 * Auth.js accounts.provider -> the Better IAM connection that replaces it (the connections in lib/iam.ts).
 * providerId is the connection's id; issuer is the provider's `iss`, exactly. accounts."providerAccountId" is the
 * subject: Google's `sub`, or the numeric GitHub user ID.
 */
const connections: Record<string, { providerId: string; issuer: string }> = {
  google: { providerId: 'google', issuer: 'https://accounts.google.com' },
  github: { providerId: 'github', issuer: 'https://github.com' },
};

const roles = await iam.api.roles.list(admin, { tenantId });
const memberRole =
  roles.find((role) => role.name === 'Member') ??
  (await iam.api.roles.create(admin, { tenantId, name: 'Member', permissions: ['posts:read', 'posts:write'] }));
const adminRole =
  roles.find((role) => role.name === 'Admin') ??
  (await iam.api.roles.create(admin, {
    tenantId,
    name: 'Admin',
    permissions: ['posts:read', 'posts:write', 'iam:identities:read', 'iam:bindings:create', 'iam:bindings:read'],
  }));

await source.query('ALTER TABLE users ADD COLUMN IF NOT EXISTS iam_identity_id text UNIQUE');

const { rows: users } = await source.query<{
  id: string;
  name: string | null;
  email: string;
  verified: boolean;
  role: string | null;
  accounts: Array<{ provider: string; providerAccountId: string }>;
}>(`
  SELECT u.id::text AS id, u.name, u.email, u."emailVerified" IS NOT NULL AS verified, u.role,
         COALESCE((SELECT json_agg(json_build_object('provider', a.provider,
                                                     'providerAccountId', a."providerAccountId"))
                     FROM accounts a WHERE a."userId" = u.id), '[]') AS accounts
    FROM users u
   WHERE u.email IS NOT NULL
     AND u.iam_identity_id IS NULL
     AND lower(u.email) <> lower($1)
   ORDER BY u.id`, [ownerEmail]);

for (let start = 0; start < users.length; start += 100) {
  const batch = users.slice(start, start + 100);
  const { identities } = await iam.api.identities.createMany(admin, {
    tenantId,
    identities: batch.map((user) => ({
      email: user.email,
      name: user.name?.trim() || user.email.split('@')[0]!,
      emailVerified: user.verified,
      providers: user.accounts.flatMap((account) => {
        const connection = connections[account.provider];
        return connection ? [{ ...connection, subject: account.providerAccountId }] : [];
      }),
      attributes: { legacyId: user.id },
      roleIds: [user.role === 'admin' ? adminRole.id : memberRole.id],
    })),
  });
  // identities[i] replaces batch[i].
  for (const [i, identity] of identities.entries())
    await source.query('UPDATE users SET iam_identity_id = $1 WHERE id::text = $2', [identity.id, batch[i]!.id]);
  console.log(`${start + batch.length}/${users.length}`);
}

await source.end();

import pg from 'pg';
import { iamNext } from './iam-next';

const db = new pg.Pool({ connectionString: process.env.AUTHJS_DATABASE_URL });

/** The application's users row for the signed-in person. */
export async function currentUser() {
  const { identity } = await iamNext.requireSession();
  const mapped = await db.query('SELECT * FROM users WHERE iam_identity_id = $1', [identity.id]);
  return mapped.rows[0];
}