feat: establish core identity foundation

Adds Core-owned identity contracts, a Core-owned Better Auth database schema (ekklesia_core_user/session/account/verification), a first-class Core-owned migration source that coexists with module-owned migrations under the exact existing migration system, and an explicit Better Auth construction boundary. No authentication endpoint or sign-in UI is exposed yet (ADR 0010). Co-Authored-By: Claude Sonnet 5 <[email protected]>
2026-07-21 16:39:15 -05:00
parent df0f20d8af
commit 679a5d225c
43 changed files with 4259 additions and 64 deletions
@@ -1,7 +1,12 @@
 import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
-import { diagnoseEkklesia, doctorExitCode, formatDoctorReport } from "../diagnostics/index.js";
+import {
+  diagnoseEkklesia,
+  type DoctorOptions,
+  doctorExitCode,
+  formatDoctorReport,
+} from "../diagnostics/index.js";

 interface ModuleSdkPackageDocument {
  readonly version?: unknown;
@@ -31,6 +36,25 @@ function requiredString(value: unknown): string {
  return value;
 }

+function readIdentityConfigurationFromEnvironment(): DoctorOptions["identityConfiguration"] {
+  const secret = process.env.EKKLESIA_IDENTITY_SECRET;
+  const baseUrl = process.env.EKKLESIA_IDENTITY_BASE_URL;
+  const trustedOriginsValue = process.env.EKKLESIA_IDENTITY_TRUSTED_ORIGINS;
+  const trustedOrigins = trustedOriginsValue
+    ? trustedOriginsValue
+        .split(",")
+        .map((origin) => origin.trim())
+        .filter((origin) => origin.length > 0)
+    : undefined;
+
+  return {
+    ...(baseUrl ? { baseUrl } : {}),
+    environment: process.env.NODE_ENV === "development" ? "development" : "production",
+    ...(secret ? { secret } : {}),
+    ...(trustedOrigins ? { trustedOrigins } : {}),
+  };
+}
+
 export async function runDoctorCommand(repositoryRoot = process.cwd()): Promise<number> {
  const [rootValue, moduleSdkValue] = await Promise.all([
    readJson(path.join(repositoryRoot, "package.json")),
@@ -41,6 +65,7 @@ export async function runDoctorCommand(repositoryRoot = process.cwd()): Promise<

  const report = await diagnoseEkklesia({
    databaseUrl: process.env.DATABASE_URL,
+    identityConfiguration: readIdentityConfigurationFromEnvironment(),
    moduleDiscovery: {
      moduleSdkVersion: requiredString(moduleSdkPackage.version),
      modulesDirectory: path.join(repositoryRoot, "modules"),