@celsoft/platform 0.4.0 → 0.5.0

package/dist/runtime/auth.js

@@ -1,18 +1,26 @@
 import { betterAuth } from "better-auth";
-import { Pool } from "pg";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { admin, organization } from "better-auth/plugins";
+import { adminAc, userAc } from "better-auth/plugins/admin/access";
+import { sql } from "drizzle-orm";
+import { authSchema } from "../schema.js";
 export const AUTH_PATH = "/api/auth";
-// Better Auth gets its own pg pool: sharing the app's postgres.js client through a Kysely
-// dialect stalls on Workers, while pg is the driver Cloudflare documents for Hyperdrive.
-export function authPool(connectionString) {
-    return new Pool({ connectionString, max: 1 });
-}
-// Shared by the Worker and by `platform deploy`, which creates the auth tables from it.
-export function authOptions({ pool, secret, baseURL, email, requireVerification }) {
-    return {
+export const OWNER_ROLE = "owner";
+export function createAuth({ db, secret, baseURL, email, requireVerification }) {
+    return betterAuth({
         secret,
         baseURL,
         basePath: AUTH_PATH,
-        database: pool,
+        database: drizzleAdapter(db, { provider: "pg", schema: authSchema }),
+        // Postgres fills every id with uuidv7(), so Better Auth leaves the column out.
+        advanced: { database: { generateId: "uuid" } },
+        // The Workers rate limiting binding guards these routes before Better Auth sees them.
+        rateLimit: { enabled: false },
+        session: {
+            // Most requests read the session from a signed cookie instead of the database; a revoked
+            // session therefore keeps working until this copy expires.
+            cookieCache: { enabled: true, maxAge: 5 * 60 },
+        },
         emailAndPassword: {
             enabled: true,
             requireEmailVerification: requireVerification,
@@ -27,9 +35,31 @@ export function authOptions({ pool, secret, baseURL, email, requireVerification
                 await email.send({ to: user.email, subject: "Confirm your email", text: `Confirm your email address:\n\n${url}` });
             },
         },
-    };
-}
-export function createAuth(settings) {
-    return betterAuth(authOptions(settings));
+        databaseHooks: {
+            user: {
+                create: {
+                    // The first account becomes the owner; a single statement, so two at once cannot both win.
+                    after: async (user) => {
+                        await db.execute(sql `update "user" set role = ${OWNER_ROLE} where id = ${user.id} and not exists (select 1 from "user" where role = ${OWNER_ROLE})`);
+                    },
+                },
+            },
+        },
+        // Always installed so its tables and types never change; the runtime hides its routes
+        // unless platform.jsonc turns organizations on.
+        plugins: [
+            admin({ defaultRole: "user", adminRoles: [OWNER_ROLE, "admin"], roles: { [OWNER_ROLE]: adminAc, admin: adminAc, user: userAc } }),
+            organization({
+                teams: { enabled: true },
+                sendInvitationEmail: async ({ email: to, organization: org, inviter, id }) => {
+                    await email.send({
+                        to,
+                        subject: `Join ${org.name}`,
+                        text: `${inviter.user.name} invited you to join ${org.name}:\n\n${baseURL}/login?invitation=${id}`,
+                    });
+                },
+            }),
+        ],
+    });
 }
 //# sourceMappingURL=auth.js.map

package/dist/runtime/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/runtime/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAG1B,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AAUrC,0FAA0F;AAC1F,yFAAyF;AACzF,MAAM,UAAU,QAAQ,CAAC,gBAAwB;IAC/C,OAAO,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAgB;IAC7F,OAAO;QACL,MAAM;QACN,OAAO;QACP,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,IAAI;QACd,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,wBAAwB,EAAE,mBAAmB;YAC7C,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBACzC,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,2BAA2B,GAAG,qDAAqD,EAAE,CAAC,CAAC;YAClK,CAAC;SACF;QACD,iBAAiB,EAAE;YACjB,YAAY,EAAE,IAAI;YAClB,2BAA2B,EAAE,IAAI;YACjC,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC7C,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,kCAAkC,GAAG,EAAE,EAAE,CAAC,CAAC;YACrH,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAsB;IAC/C,OAAO,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/runtime/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AACrC,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC;AAUlC,MAAM,UAAU,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAgB;IAC1F,OAAO,UAAU,CAAC;QAChB,MAAM;QACN,OAAO;QACP,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACpE,+EAA+E;QAC/E,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE;QAC9C,sFAAsF;QACtF,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7B,OAAO,EAAE;YACP,yFAAyF;YACzF,2DAA2D;YAC3D,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;SAC/C;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,wBAAwB,EAAE,mBAAmB;YAC7C,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBACzC,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,2BAA2B,GAAG,qDAAqD,EAAE,CAAC,CAAC;YAClK,CAAC;SACF;QACD,iBAAiB,EAAE;YACjB,YAAY,EAAE,IAAI;YAClB,2BAA2B,EAAE,IAAI;YACjC,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC7C,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,kCAAkC,GAAG,EAAE,EAAE,CAAC,CAAC;YACrH,CAAC;SACF;QACD,aAAa,EAAE;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,2FAA2F;oBAC3F,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;wBACpB,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,4BAA4B,UAAU,eAAe,IAAI,CAAC,EAAE,sDAAsD,UAAU,GAAG,CAAC,CAAC;oBACvJ,CAAC;iBACF;aACF;SACF;QACD,sFAAsF;QACtF,gDAAgD;QAChD,OAAO,EAAE;YACP,KAAK,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;YACjI,YAAY,CAAC;gBACX,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;gBACxB,mBAAmB,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE;oBAC3E,MAAM,KAAK,CAAC,IAAI,CAAC;wBACf,EAAE;wBACF,OAAO,EAAE,QAAQ,GAAG,CAAC,IAAI,EAAE;wBAC3B,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,wBAAwB,GAAG,CAAC,IAAI,QAAQ,OAAO,qBAAqB,EAAE,EAAE;qBACnG,CAAC,CAAC;gBACL,CAAC;aACF,CAAC;SACH;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/runtime/files.js

@@ -1,3 +1,4 @@
+import { BUCKET_MARKER } from "../ownership.js";
 // Paths are "folder/sub/file.json"; "/" makes folders. Previews share one bucket, so each
 // preview's prefix is added here and never seen by app code.
 export function createFiles(env) {
@@ -25,7 +26,9 @@ export function createFiles(env) {
             let cursor;
             do {
                 const page = await bucket().list({ prefix: base, delimiter: "/", ...(cursor && { cursor }) });
-                result.files.push(...page.objects.map((o) => ({ path: o.key.slice(prefix.length), size: o.size, uploaded: o.uploaded })));
+                // The platform's ownership marker sits at the bucket root and is never the app's file.
+                const objects = page.objects.filter((o) => o.key !== BUCKET_MARKER);
+                result.files.push(...objects.map((o) => ({ path: o.key.slice(prefix.length), size: o.size, uploaded: o.uploaded })));
                 result.folders.push(...page.delimitedPrefixes.map((p) => p.slice(prefix.length)));
                 cursor = page.truncated ? page.cursor : undefined;
             } while (cursor);

package/dist/runtime/files.js.map

@@ -1 +1 @@
-{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/runtime/files.ts"],"names":[],"mappings":"AAyCA,0FAA0F;AAC1F,6DAA6D;AAC7D,MAAM,UAAU,WAAW,CAAC,GAAkB;IAC5C,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC9F,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAEnD,MAAM,KAAK,GAAU;QACnB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW;YAC/B,MAAM,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnG,CAAC;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,KAAK,CAAC,OAAO,CAAI,IAAY;YAC3B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrC,OAAO,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,CAAC;QACD,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;QACpF,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE;YACpB,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,MAAM,GAAW,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAClD,IAAI,MAA0B,CAAC;YAC/B,GAAG,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC9F,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC1H,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAClF,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACpD,CAAC,QAAQ,MAAM,EAAE;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,IAAI,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3K,CAAC;KACF,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IACnE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC"}
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/runtime/files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AA2ChD,0FAA0F;AAC1F,6DAA6D;AAC7D,MAAM,UAAU,WAAW,CAAC,GAAkB;IAC5C,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC9F,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAEnD,MAAM,KAAK,GAAU;QACnB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW;YAC/B,MAAM,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnG,CAAC;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,KAAK,CAAC,OAAO,CAAI,IAAY;YAC3B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrC,OAAO,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,CAAC;QACD,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;QACpF,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE;YACpB,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,MAAM,GAAW,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAClD,IAAI,MAA0B,CAAC;YAC/B,GAAG,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC9F,uFAAuF;gBACvF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC;gBACpE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrH,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAClF,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACpD,CAAC,QAAQ,MAAM,EAAE;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,IAAI,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3K,CAAC;KACF,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IACnE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC"}

package/dist/runtime/guard.d.ts

@@ -0,0 +1,12 @@
+export declare const PUBLIC_API = "/api/public/";
+export declare const PLATFORM_API = "/api/platform/";
+export declare function isCrossSiteForm(request: Request, url: URL): boolean;
+export declare function needsSession(pathname: string): boolean;
+export interface RateLimiter {
+    limit(options: {
+        key: string;
+    }): Promise<{
+        success: boolean;
+    }>;
+}
+export declare function rateLimited(request: Request, pathname: string, limiter: RateLimiter | undefined): Promise<boolean>;

package/dist/runtime/guard.js

@@ -0,0 +1,42 @@
+import { AUTH_PATH } from "./auth.js";
+export const PUBLIC_API = "/api/public/";
+export const PLATFORM_API = "/api/platform/";
+const FORM_TYPES = ["application/x-www-form-urlencoded", "multipart/form-data", "text/plain"];
+const UNSAFE = ["POST", "PUT", "PATCH", "DELETE"];
+// A browser sends any site's form to any other without asking, cookies included; it always
+// sends an Origin with it, so a missing or foreign one is refused.
+export function isCrossSiteForm(request, url) {
+    if (!UNSAFE.includes(request.method))
+        return false;
+    const type = request.headers.get("content-type")?.split(";", 1)[0].trim().toLowerCase() ?? "";
+    if (!FORM_TYPES.includes(type))
+        return false;
+    return request.headers.get("origin") !== url.origin;
+}
+// Every /api route needs a signed-in user unless its path says otherwise.
+export function needsSession(pathname) {
+    if (!pathname.startsWith("/api/"))
+        return false;
+    return !(pathname.startsWith(`${AUTH_PATH}/`) || pathname.startsWith(PUBLIC_API) || pathname.startsWith(PLATFORM_API));
+}
+// Guessing passwords is limited per account, signing up per address.
+const LIMITED = {
+    [`${AUTH_PATH}/sign-in/email`]: "email",
+    [`${AUTH_PATH}/request-password-reset`]: "email",
+    [`${AUTH_PATH}/reset-password`]: "ip",
+    [`${AUTH_PATH}/sign-up/email`]: "ip",
+    [`${PLATFORM_API}recover`]: "email",
+};
+export async function rateLimited(request, pathname, limiter) {
+    const by = LIMITED[pathname];
+    if (!limiter || !by || request.method !== "POST")
+        return false;
+    let subject = request.headers.get("cf-connecting-ip") ?? "unknown";
+    if (by === "email") {
+        const body = (await request.clone().json().catch(() => ({})));
+        if (typeof body.email === "string")
+            subject = body.email.trim().toLowerCase();
+    }
+    return !(await limiter.limit({ key: `${pathname}:${subject}` })).success;
+}
+//# sourceMappingURL=guard.js.map

package/dist/runtime/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/runtime/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC;AACzC,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAE7C,MAAM,UAAU,GAAG,CAAC,mCAAmC,EAAE,qBAAqB,EAAE,YAAY,CAAC,CAAC;AAC9F,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAElD,2FAA2F;AAC3F,mEAAmE;AACnE,MAAM,UAAU,eAAe,CAAC,OAAgB,EAAE,GAAQ;IACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC/F,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC;AACtD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;AACzH,CAAC;AAMD,qEAAqE;AACrE,MAAM,OAAO,GAAmC;IAC9C,CAAC,GAAG,SAAS,gBAAgB,CAAC,EAAE,OAAO;IACvC,CAAC,GAAG,SAAS,yBAAyB,CAAC,EAAE,OAAO;IAChD,CAAC,GAAG,SAAS,iBAAiB,CAAC,EAAE,IAAI;IACrC,CAAC,GAAG,SAAS,gBAAgB,CAAC,EAAE,IAAI;IACpC,CAAC,GAAG,YAAY,SAAS,CAAC,EAAE,OAAO;CACpC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,QAAgB,EAAE,OAAgC;IACpG,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;IACnE,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAwB,CAAC;QACrF,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChF,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,QAAQ,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3E,CAAC"}

package/dist/runtime/index.d.ts

@@ -1,35 +1,45 @@
-import postgres from "postgres";
+import { type NodePgDatabase } from "drizzle-orm/node-postgres";
+import { Pool } from "pg";
 import { type Auth } from "./auth.js";
 import { type Email, type EmailBindings } from "./email.js";
 import { type Files, type FilesBindings } from "./files.js";
+import { type RateLimiter } from "./guard.js";
 export type { Auth } from "./auth.js";
 export type { Email, EmailMessage } from "./email.js";
 export type { FileEntry, Files, Folder, StoredObject } from "./files.js";
-export type Sql = postgres.Sql;
 export interface PlatformBindings extends EmailBindings, FilesBindings {
     DB?: {
         connectionString: string;
     };
     APP_URL?: string;
+    APP_NAME?: string;
     BETTER_AUTH_SECRET?: string;
+    AUTH_ORGANIZATIONS?: string;
+    AUTH_LIMIT?: RateLimiter;
 }
 export interface ExecutionContext {
     waitUntil(promise: Promise<unknown>): void;
 }
 export type Session = NonNullable<Awaited<ReturnType<Auth["api"]["getSession"]>>>;
-export interface AppContext<Env> {
+export type User = Session["user"];
+export interface AppContext<Env, Schema extends Record<string, unknown>> {
     env: Env;
-    readonly sql: Sql;
+    readonly db: NodePgDatabase<Schema>;
     readonly email: Email;
     readonly files: Files;
     readonly auth: Auth;
     session(): Promise<Session | null>;
+    requireUser(): Promise<User>;
     waitUntil(promise: Promise<unknown>): void;
 }
-export type Handler<Env> = (request: Request, app: AppContext<Env>) => Response | Promise<Response>;
-export interface AppOptions {
-    connect?: (connectionString: string) => Sql;
+export type Handler<Env, Schema extends Record<string, unknown>> = (request: Request, app: AppContext<Env, Schema>) => Response | Promise<Response>;
+export interface AppOptions<Schema extends Record<string, unknown>> {
+    schema?: Schema;
+    screens?: {
+        stylesheet?: string;
+    };
+    pool?: (connectionString: string) => Pool;
 }
-export declare function defineApp<Secrets extends object = object>(handler: Handler<Secrets & PlatformBindings>, options?: AppOptions): {
+export declare function defineApp<Secrets extends object = object, Schema extends Record<string, unknown> = Record<string, never>>(handler: Handler<Secrets & PlatformBindings, Schema>, options?: AppOptions<Schema>): {
     fetch(request: Request, env: Secrets & PlatformBindings, ctx: ExecutionContext): Promise<Response>;
 };

package/dist/runtime/index.js

@@ -1,25 +1,33 @@
-import postgres from "postgres";
-import { AUTH_PATH, authPool, createAuth } from "./auth.js";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { Pool } from "pg";
+import { AUTH_PATH, createAuth } from "./auth.js";
 import { createEmail } from "./email.js";
 import { createFiles } from "./files.js";
-const defaultConnect = (connectionString) => postgres(connectionString, { max: 5, fetch_types: false });
+import { isCrossSiteForm, needsSession, PLATFORM_API, rateLimited } from "./guard.js";
+import { issueRecoveryCode, recoverOwner } from "./owner.js";
+import { isScreen, renderScreen } from "./screens.js";
+const defaultPool = (connectionString) => new Pool({ connectionString, max: 5 });
+const json = (body, status = 200) => Response.json(body, { status });
 // `Secrets` names the app's secrets, such as `defineApp<{ SESSION_SECRET: string }>`; the
-// platform's own bindings are added to it. With `auth` on, /api/auth/* is handled for the app.
+// platform's own bindings are added to it. Pass the app's tables as `schema` for a typed `app.db`.
+// A handler may throw a Response, as `requireUser` does, and it is sent as the answer.
 export function defineApp(handler, options = {}) {
-    const connect = options.connect ?? defaultConnect;
+    const openPool = options.pool ?? defaultPool;
     return {
         async fetch(request, env, ctx) {
-            let sql;
+            const url = new URL(request.url);
+            let pool;
+            let db;
             let email;
             let files;
             let auth;
-            let pool;
+            let session;
             const app = {
                 env,
-                get sql() {
+                get db() {
                     if (!env.DB)
                         throw new Error("this app has no database; add `database` to platform.jsonc");
-                    return (sql ??= connect(env.DB.connectionString));
+                    return (db ??= drizzle((pool ??= openPool(env.DB.connectionString)), { schema: options.schema ?? {} }));
                 },
                 get email() {
                     return (email ??= createEmail(env));
@@ -30,34 +38,74 @@ export function defineApp(handler, options = {}) {
                 get auth() {
                     if (!env.BETTER_AUTH_SECRET)
                         throw new Error("this app has no auth; set `auth: true` in platform.jsonc");
-                    if (!env.DB)
-                        throw new Error("auth needs a database; add `database` to platform.jsonc");
                     return (auth ??= createAuth({
-                        pool: (pool ??= authPool(env.DB.connectionString)),
+                        db: app.db,
                         secret: env.BETTER_AUTH_SECRET,
-                        baseURL: env.APP_URL ?? new URL(request.url).origin,
+                        baseURL: env.APP_URL ?? url.origin,
                         email: app.email,
                         requireVerification: env.EMAIL_MODE === "send",
                     }));
                 },
-                async session() {
-                    return env.BETTER_AUTH_SECRET ? app.auth.api.getSession({ headers: request.headers }) : null;
+                session() {
+                    return (session ??= env.BETTER_AUTH_SECRET ? app.auth.api.getSession({ headers: request.headers }) : Promise.resolve(null));
+                },
+                async requireUser() {
+                    const current = await app.session();
+                    if (!current)
+                        throw json({ error: "sign in first" }, 401);
+                    return current.user;
                 },
                 waitUntil: (promise) => ctx.waitUntil(promise),
             };
             try {
-                if (env.BETTER_AUTH_SECRET && new URL(request.url).pathname.startsWith(`${AUTH_PATH}/`)) {
-                    return await app.auth.handler(request);
+                if (isCrossSiteForm(request, url))
+                    return json({ error: "cross-site form submissions are refused" }, 403);
+                if (env.BETTER_AUTH_SECRET) {
+                    const platform = await platformRoute(request, url, env, app, options);
+                    if (platform)
+                        return platform;
                 }
                 return await handler(request, app);
             }
+            catch (thrown) {
+                if (thrown instanceof Response)
+                    return thrown;
+                throw thrown;
+            }
             finally {
-                if (sql)
-                    ctx.waitUntil(sql.end({ timeout: 5 }));
                 if (pool)
                     ctx.waitUntil(pool.end());
             }
         },
     };
 }
+// What the platform answers itself for an app with auth: screens, auth routes, owner recovery,
+// and the sign-in check in front of every private /api route.
+async function platformRoute(request, url, env, app, options) {
+    const path = url.pathname;
+    if (request.method === "GET" && isScreen(path))
+        return renderScreen(path, env.APP_NAME ?? url.hostname, options.screens?.stylesheet);
+    if (await rateLimited(request, path, env.AUTH_LIMIT))
+        return json({ error: "too many attempts; wait a minute" }, 429);
+    if (path.startsWith(`${AUTH_PATH}/organization/`) && env.AUTH_ORGANIZATIONS !== "on")
+        return json({ error: "not found" }, 404);
+    if (path.startsWith(`${AUTH_PATH}/`))
+        return app.auth.handler(request);
+    const db = app.db;
+    if (path === `${PLATFORM_API}recovery-code` && request.method === "POST") {
+        const user = await app.requireUser();
+        return json({ code: await issueRecoveryCode(db, user.id) });
+    }
+    if (path === `${PLATFORM_API}recover` && request.method === "POST") {
+        const body = (await request.json().catch(() => ({})));
+        const { email, code, password } = body;
+        if (typeof email !== "string" || typeof code !== "string" || typeof password !== "string" || password.length < 8) {
+            return json({ error: "email, code and a password of at least 8 characters are required" }, 400);
+        }
+        return json({ ok: await recoverOwner(db, app.auth, { email, code, password }) });
+    }
+    if (needsSession(path))
+        await app.requireUser();
+    return undefined;
+}
 //# sourceMappingURL=index.js.map

package/dist/runtime/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAa,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,WAAW,EAAkC,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,WAAW,EAAkC,MAAM,YAAY,CAAC;AAoCzE,MAAM,cAAc,GAAG,CAAC,gBAAwB,EAAE,EAAE,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;AAEhH,0FAA0F;AAC1F,+FAA+F;AAC/F,MAAM,UAAU,SAAS,CAAkC,OAA4C,EAAE,OAAO,GAAe,EAAE;IAC/H,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC;IAElD,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAA+B,EAAE,GAAqB;YAClF,IAAI,GAAoB,CAAC;YACzB,IAAI,KAAwB,CAAC;YAC7B,IAAI,KAAwB,CAAC;YAC7B,IAAI,IAAsB,CAAC;YAC3B,IAAI,IAAsB,CAAC;YAE3B,MAAM,GAAG,GAA2C;gBAClD,GAAG;gBACH,IAAI,GAAG;oBACL,IAAI,CAAC,GAAG,CAAC,EAAE;wBAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;oBAC3F,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBACpD,CAAC;gBACD,IAAI,KAAK;oBACP,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtC,CAAC;gBACD,IAAI,KAAK;oBACP,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtC,CAAC;gBACD,IAAI,IAAI;oBACN,IAAI,CAAC,GAAG,CAAC,kBAAkB;wBAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;oBACzG,IAAI,CAAC,GAAG,CAAC,EAAE;wBAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;oBACxF,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;wBAC1B,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;wBAClD,MAAM,EAAE,GAAG,CAAC,kBAAkB;wBAC9B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM;wBACnD,KAAK,EAAE,GAAG,CAAC,KAAK;wBAChB,mBAAmB,EAAE,GAAG,CAAC,UAAU,KAAK,MAAM;qBAC/C,CAAC,CAAC,CAAC;gBACN,CAAC;gBACD,KAAK,CAAC,OAAO;oBACX,OAAO,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC/F,CAAC;gBACD,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC;aAC/C,CAAC;YAEF,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,kBAAkB,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;oBACxF,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACzC,CAAC;gBACD,OAAO,MAAM,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACrC,CAAC;oBAAS,CAAC;gBACT,IAAI,GAAG;oBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBAChD,IAAI,IAAI;oBAAE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAuB,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAa,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAkC,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,WAAW,EAAkC,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAoB,MAAM,YAAY,CAAC;AACxG,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAyCtD,MAAM,WAAW,GAAG,CAAC,gBAAwB,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AAEzF,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAE9E,0FAA0F;AAC1F,mGAAmG;AACnG,uFAAuF;AACvF,MAAM,UAAU,SAAS,CACvB,OAAoD,EACpD,OAAO,GAAuB,EAAE;IAEhC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAE7C,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAA+B,EAAE,GAAqB;YAClF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,IAAsB,CAAC;YAC3B,IAAI,EAAsC,CAAC;YAC3C,IAAI,KAAwB,CAAC;YAC7B,IAAI,KAAwB,CAAC;YAC7B,IAAI,IAAsB,CAAC;YAC3B,IAAI,OAA4C,CAAC;YAEjD,MAAM,GAAG,GAAmD;gBAC1D,GAAG;gBACH,IAAI,EAAE;oBACJ,IAAI,CAAC,GAAG,CAAC,EAAE;wBAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;oBAC3F,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAK,EAAa,EAAE,CAAC,CAAC,CAAC;gBACtH,CAAC;gBACD,IAAI,KAAK;oBACP,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtC,CAAC;gBACD,IAAI,KAAK;oBACP,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtC,CAAC;gBACD,IAAI,IAAI;oBACN,IAAI,CAAC,GAAG,CAAC,kBAAkB;wBAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;oBACzG,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;wBAC1B,EAAE,EAAE,GAAG,CAAC,EAA6C;wBACrD,MAAM,EAAE,GAAG,CAAC,kBAAkB;wBAC9B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,MAAM;wBAClC,KAAK,EAAE,GAAG,CAAC,KAAK;wBAChB,mBAAmB,EAAE,GAAG,CAAC,UAAU,KAAK,MAAM;qBAC/C,CAAC,CAAC,CAAC;gBACN,CAAC;gBACD,OAAO;oBACL,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC9H,CAAC;gBACD,KAAK,CAAC,WAAW;oBACf,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;oBACpC,IAAI,CAAC,OAAO;wBAAE,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC1D,OAAO,OAAO,CAAC,IAAI,CAAC;gBACtB,CAAC;gBACD,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC;aAC/C,CAAC;YAEF,IAAI,CAAC;gBACH,IAAI,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC1G,IAAI,GAAG,CAAC,kBAAkB,EAAE,CAAC;oBAC3B,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;oBACtE,IAAI,QAAQ;wBAAE,OAAO,QAAQ,CAAC;gBAChC,CAAC;gBACD,OAAO,MAAM,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,IAAI,MAAM,YAAY,QAAQ;oBAAE,OAAO,MAAM,CAAC;gBAC9C,MAAM,MAAM,CAAC;YACf,CAAC;oBAAS,CAAC;gBACT,IAAI,IAAI;oBAAE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,8DAA8D;AAC9D,KAAK,UAAU,aAAa,CAC1B,OAAgB,EAChB,GAAQ,EACR,GAAQ,EACR,GAA4B,EAC5B,OAA2B;IAE3B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACrI,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,CAAC,CAAC;IACtH,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,gBAAgB,CAAC,IAAI,GAAG,CAAC,kBAAkB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/H,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEvE,MAAM,EAAE,GAAG,GAAG,CAAC,EAA6C,CAAC;IAC7D,IAAI,IAAI,KAAK,GAAG,YAAY,eAAe,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,YAAY,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QACjF,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjH,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,kEAAkE,EAAE,EAAE,GAAG,CAAC,CAAC;QAClG,CAAC;QACD,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;IAChD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/runtime/owner.d.ts

@@ -0,0 +1,12 @@
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import { type Auth } from "./auth.js";
+export declare function newRecoveryCode(): string;
+export declare function hashCode(code: string): Promise<string>;
+type Db = NodePgDatabase<Record<string, unknown>>;
+export declare function issueRecoveryCode(db: Db, userId: string): Promise<string | null>;
+export declare function recoverOwner(db: Db, auth: Auth, input: {
+    email: string;
+    code: string;
+    password: string;
+}): Promise<boolean>;
+export {};

package/dist/runtime/owner.js

@@ -0,0 +1,54 @@
+import { and, eq } from "drizzle-orm";
+import { ownerRecovery, user } from "../schema.js";
+import { OWNER_ROLE } from "./auth.js";
+const ALPHABET = "ABCDEFGHJKMNPQRSTUVWXYZ23456789";
+// Five groups of five from 31 characters: about 124 bits, so a plain hash is enough to store it.
+export function newRecoveryCode() {
+    const bytes = crypto.getRandomValues(new Uint8Array(25));
+    const chars = Array.from(bytes, (b) => ALPHABET[b % ALPHABET.length]).join("");
+    return chars.match(/.{5}/g).join("-");
+}
+export async function hashCode(code) {
+    const normalized = code.toUpperCase().replace(/[^A-Z0-9]/g, "");
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(normalized));
+    return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+// Shown once, right after the owner signs in without one; the screen tells them to save it.
+// The role is read from the database: the session's cached copy predates the owner claim.
+export async function issueRecoveryCode(db, userId) {
+    const [row] = await db.select({ role: user.role }).from(user).where(eq(user.id, userId));
+    if (row?.role !== OWNER_ROLE)
+        return null;
+    const code = newRecoveryCode();
+    const inserted = await db
+        .insert(ownerRecovery)
+        .values({ userId, codeHash: await hashCode(code) })
+        .onConflictDoNothing()
+        .returning({ userId: ownerRecovery.userId });
+    return inserted.length > 0 ? code : null;
+}
+// Sets a new password for the owner and signs every session out. The answer never says which
+// part was wrong, so it reveals nothing about who the owner is.
+export async function recoverOwner(db, auth, input) {
+    const [owner] = await db
+        .select({ id: user.id, codeHash: ownerRecovery.codeHash })
+        .from(user)
+        .innerJoin(ownerRecovery, eq(ownerRecovery.userId, user.id))
+        .where(and(eq(user.email, input.email.trim().toLowerCase()), eq(user.role, OWNER_ROLE)));
+    if (!owner || !equal(owner.codeHash, await hashCode(input.code)))
+        return false;
+    const ctx = await auth.$context;
+    await ctx.internalAdapter.updatePassword(owner.id, await ctx.password.hash(input.password));
+    await ctx.internalAdapter.deleteUserSessions(owner.id);
+    await db.delete(ownerRecovery).where(eq(ownerRecovery.userId, owner.id));
+    return true;
+}
+function equal(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+//# sourceMappingURL=owner.js.map

package/dist/runtime/owner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner.js","sourceRoot":"","sources":["../../src/runtime/owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,UAAU,EAAa,MAAM,WAAW,CAAC;AAElD,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AAEnD,iGAAiG;AACjG,MAAM,UAAU,eAAe;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAY;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3F,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC7F,CAAC;AAID,4FAA4F;AAC5F,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAM,EAAE,MAAc;IAC5D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACzF,IAAI,GAAG,EAAE,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,aAAa,CAAC;SACrB,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;SAClD,mBAAmB,EAAE;SACrB,SAAS,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,6FAA6F;AAC7F,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,IAAU,EAAE,KAAwD;IAC7G,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC;SACzD,IAAI,CAAC,IAAI,CAAC;SACV,SAAS,CAAC,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;SAC3D,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;IAChC,MAAM,GAAG,CAAC,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5F,MAAM,GAAG,CAAC,eAAe,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvD,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,KAAK,CAAC,CAAS,EAAE,CAAS;IACjC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}

package/dist/runtime/screens.d.ts

@@ -0,0 +1,4 @@
+export declare const SCREEN_PATHS: readonly ["/login", "/signup", "/forgot", "/reset", "/recover"];
+export type ScreenPath = (typeof SCREEN_PATHS)[number];
+export declare function isScreen(pathname: string): pathname is ScreenPath;
+export declare function renderScreen(path: ScreenPath, appName: string, stylesheet: string | undefined): Response;