@celsoft/platform 0.4.0 → 0.6.0

package/dist/runtime/auth.js

@@ -1,18 +1,26 @@
 import { betterAuth } from "better-auth";
-import { Pool } from "pg";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { admin, organization } from "better-auth/plugins";
+import { adminAc, userAc } from "better-auth/plugins/admin/access";
+import { sql } from "drizzle-orm";
+import { authSchema } from "../schema.js";
 export const AUTH_PATH = "/api/auth";
-// Better Auth gets its own pg pool: sharing the app's postgres.js client through a Kysely
-// dialect stalls on Workers, while pg is the driver Cloudflare documents for Hyperdrive.
-export function authPool(connectionString) {
-    return new Pool({ connectionString, max: 1 });
-}
-// Shared by the Worker and by `platform deploy`, which creates the auth tables from it.
-export function authOptions({ pool, secret, baseURL, email, requireVerification }) {
-    return {
+export const OWNER_ROLE = "owner";
+export function createAuth({ db, secret, baseURL, email, requireVerification }) {
+    return betterAuth({
         secret,
         baseURL,
         basePath: AUTH_PATH,
-        database: pool,
+        database: drizzleAdapter(db, { provider: "pg", schema: authSchema }),
+        // Postgres fills every id with uuidv7(), so Better Auth leaves the column out.
+        advanced: { database: { generateId: "uuid" } },
+        // The Workers rate limiting binding guards these routes before Better Auth sees them.
+        rateLimit: { enabled: false },
+        session: {
+            // Most requests read the session from a signed cookie instead of the database; a revoked
+            // session therefore keeps working until this copy expires.
+            cookieCache: { enabled: true, maxAge: 5 * 60 },
+        },
         emailAndPassword: {
             enabled: true,
             requireEmailVerification: requireVerification,
@@ -27,9 +35,31 @@ export function authOptions({ pool, secret, baseURL, email, requireVerification
                 await email.send({ to: user.email, subject: "Confirm your email", text: `Confirm your email address:\n\n${url}` });
             },
         },
-    };
-}
-export function createAuth(settings) {
-    return betterAuth(authOptions(settings));
+        databaseHooks: {
+            user: {
+                create: {
+                    // The first account becomes the owner; a single statement, so two at once cannot both win.
+                    after: async (user) => {
+                        await db.execute(sql `update "user" set role = ${OWNER_ROLE} where id = ${user.id} and not exists (select 1 from "user" where role = ${OWNER_ROLE})`);
+                    },
+                },
+            },
+        },
+        // Always installed so its tables and types never change; the runtime hides its routes
+        // unless platform.jsonc turns organizations on.
+        plugins: [
+            admin({ defaultRole: "user", adminRoles: [OWNER_ROLE, "admin"], roles: { [OWNER_ROLE]: adminAc, admin: adminAc, user: userAc } }),
+            organization({
+                teams: { enabled: true },
+                sendInvitationEmail: async ({ email: to, organization: org, inviter, id }) => {
+                    await email.send({
+                        to,
+                        subject: `Join ${org.name}`,
+                        text: `${inviter.user.name} invited you to join ${org.name}:\n\n${baseURL}/login?invitation=${id}`,
+                    });
+                },
+            }),
+        ],
+    });
 }
 //# sourceMappingURL=auth.js.map

package/dist/runtime/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/runtime/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAG1B,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AAUrC,0FAA0F;AAC1F,yFAAyF;AACzF,MAAM,UAAU,QAAQ,CAAC,gBAAwB;IAC/C,OAAO,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAgB;IAC7F,OAAO;QACL,MAAM;QACN,OAAO;QACP,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,IAAI;QACd,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,wBAAwB,EAAE,mBAAmB;YAC7C,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBACzC,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,2BAA2B,GAAG,qDAAqD,EAAE,CAAC,CAAC;YAClK,CAAC;SACF;QACD,iBAAiB,EAAE;YACjB,YAAY,EAAE,IAAI;YAClB,2BAA2B,EAAE,IAAI;YACjC,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC7C,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,kCAAkC,GAAG,EAAE,EAAE,CAAC,CAAC;YACrH,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAsB;IAC/C,OAAO,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/runtime/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AACrC,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC;AAUlC,MAAM,UAAU,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAgB;IAC1F,OAAO,UAAU,CAAC;QAChB,MAAM;QACN,OAAO;QACP,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACpE,+EAA+E;QAC/E,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE;QAC9C,sFAAsF;QACtF,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7B,OAAO,EAAE;YACP,yFAAyF;YACzF,2DAA2D;YAC3D,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;SAC/C;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,wBAAwB,EAAE,mBAAmB;YAC7C,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBACzC,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,2BAA2B,GAAG,qDAAqD,EAAE,CAAC,CAAC;YAClK,CAAC;SACF;QACD,iBAAiB,EAAE;YACjB,YAAY,EAAE,IAAI;YAClB,2BAA2B,EAAE,IAAI;YACjC,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC7C,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,kCAAkC,GAAG,EAAE,EAAE,CAAC,CAAC;YACrH,CAAC;SACF;QACD,aAAa,EAAE;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,2FAA2F;oBAC3F,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;wBACpB,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,4BAA4B,UAAU,eAAe,IAAI,CAAC,EAAE,sDAAsD,UAAU,GAAG,CAAC,CAAC;oBACvJ,CAAC;iBACF;aACF;SACF;QACD,sFAAsF;QACtF,gDAAgD;QAChD,OAAO,EAAE;YACP,KAAK,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;YACjI,YAAY,CAAC;gBACX,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;gBACxB,mBAAmB,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE;oBAC3E,MAAM,KAAK,CAAC,IAAI,CAAC;wBACf,EAAE;wBACF,OAAO,EAAE,QAAQ,GAAG,CAAC,IAAI,EAAE;wBAC3B,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,wBAAwB,GAAG,CAAC,IAAI,QAAQ,OAAO,qBAAqB,EAAE,EAAE;qBACnG,CAAC,CAAC;gBACL,CAAC;aACF,CAAC;SACH;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/runtime/files.js

@@ -1,3 +1,4 @@
+import { BUCKET_MARKER } from "../ownership.js";
 // Paths are "folder/sub/file.json"; "/" makes folders. Previews share one bucket, so each
 // preview's prefix is added here and never seen by app code.
 export function createFiles(env) {
@@ -25,7 +26,9 @@ export function createFiles(env) {
             let cursor;
             do {
                 const page = await bucket().list({ prefix: base, delimiter: "/", ...(cursor && { cursor }) });
-                result.files.push(...page.objects.map((o) => ({ path: o.key.slice(prefix.length), size: o.size, uploaded: o.uploaded })));
+                // The platform's ownership marker sits at the bucket root and is never the app's file.
+                const objects = page.objects.filter((o) => o.key !== BUCKET_MARKER);
+                result.files.push(...objects.map((o) => ({ path: o.key.slice(prefix.length), size: o.size, uploaded: o.uploaded })));
                 result.folders.push(...page.delimitedPrefixes.map((p) => p.slice(prefix.length)));
                 cursor = page.truncated ? page.cursor : undefined;
             } while (cursor);

package/dist/runtime/files.js.map

@@ -1 +1 @@
-{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/runtime/files.ts"],"names":[],"mappings":"AAyCA,0FAA0F;AAC1F,6DAA6D;AAC7D,MAAM,UAAU,WAAW,CAAC,GAAkB;IAC5C,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC9F,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAEnD,MAAM,KAAK,GAAU;QACnB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW;YAC/B,MAAM,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnG,CAAC;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,KAAK,CAAC,OAAO,CAAI,IAAY;YAC3B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrC,OAAO,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,CAAC;QACD,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;QACpF,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE;YACpB,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,MAAM,GAAW,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAClD,IAAI,MAA0B,CAAC;YAC/B,GAAG,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC9F,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC1H,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAClF,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACpD,CAAC,QAAQ,MAAM,EAAE;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,IAAI,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3K,CAAC;KACF,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IACnE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC"}
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/runtime/files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AA2ChD,0FAA0F;AAC1F,6DAA6D;AAC7D,MAAM,UAAU,WAAW,CAAC,GAAkB;IAC5C,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC9F,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAEnD,MAAM,KAAK,GAAU;QACnB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW;YAC/B,MAAM,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnG,CAAC;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,KAAK,CAAC,OAAO,CAAI,IAAY;YAC3B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrC,OAAO,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,CAAC;QACD,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;QACpF,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE;YACpB,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,MAAM,GAAW,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAClD,IAAI,MAA0B,CAAC;YAC/B,GAAG,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC9F,uFAAuF;gBACvF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC;gBACpE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrH,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAClF,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACpD,CAAC,QAAQ,MAAM,EAAE;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,IAAI,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3K,CAAC;KACF,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IACnE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC"}

package/dist/runtime/guard.d.ts

@@ -0,0 +1,11 @@
+export declare const PUBLIC_API = "/api/public/";
+export declare function isCrossSiteForm(request: Request, url: URL): boolean;
+export declare function needsSession(pathname: string): boolean;
+export interface RateLimiter {
+    limit(options: {
+        key: string;
+    }): Promise<{
+        success: boolean;
+    }>;
+}
+export declare function rateLimited(request: Request, pathname: string, limiter: RateLimiter | undefined): Promise<boolean>;

package/dist/runtime/guard.js

@@ -0,0 +1,40 @@
+import { AUTH_PATH } from "./auth.js";
+export const PUBLIC_API = "/api/public/";
+const FORM_TYPES = ["application/x-www-form-urlencoded", "multipart/form-data", "text/plain"];
+const UNSAFE = ["POST", "PUT", "PATCH", "DELETE"];
+// A browser sends any site's form to any other without asking, cookies included; it always
+// sends an Origin with it, so a missing or foreign one is refused.
+export function isCrossSiteForm(request, url) {
+    if (!UNSAFE.includes(request.method))
+        return false;
+    const type = request.headers.get("content-type")?.split(";", 1)[0].trim().toLowerCase() ?? "";
+    if (!FORM_TYPES.includes(type))
+        return false;
+    return request.headers.get("origin") !== url.origin;
+}
+// Every /api route needs a signed-in user unless its path says otherwise.
+export function needsSession(pathname) {
+    if (!pathname.startsWith("/api/"))
+        return false;
+    return !(pathname.startsWith(`${AUTH_PATH}/`) || pathname.startsWith(PUBLIC_API));
+}
+// Guessing passwords is limited per account, signing up per address.
+const LIMITED = {
+    [`${AUTH_PATH}/sign-in/email`]: "email",
+    [`${AUTH_PATH}/request-password-reset`]: "email",
+    [`${AUTH_PATH}/reset-password`]: "ip",
+    [`${AUTH_PATH}/sign-up/email`]: "ip",
+};
+export async function rateLimited(request, pathname, limiter) {
+    const by = LIMITED[pathname];
+    if (!limiter || !by || request.method !== "POST")
+        return false;
+    let subject = request.headers.get("cf-connecting-ip") ?? "unknown";
+    if (by === "email") {
+        const body = (await request.clone().json().catch(() => ({})));
+        if (typeof body.email === "string")
+            subject = body.email.trim().toLowerCase();
+    }
+    return !(await limiter.limit({ key: `${pathname}:${subject}` })).success;
+}
+//# sourceMappingURL=guard.js.map

package/dist/runtime/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/runtime/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC;AAEzC,MAAM,UAAU,GAAG,CAAC,mCAAmC,EAAE,qBAAqB,EAAE,YAAY,CAAC,CAAC;AAC9F,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAElD,2FAA2F;AAC3F,mEAAmE;AACnE,MAAM,UAAU,eAAe,CAAC,OAAgB,EAAE,GAAQ;IACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC/F,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC;AACtD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;AACpF,CAAC;AAMD,qEAAqE;AACrE,MAAM,OAAO,GAAmC;IAC9C,CAAC,GAAG,SAAS,gBAAgB,CAAC,EAAE,OAAO;IACvC,CAAC,GAAG,SAAS,yBAAyB,CAAC,EAAE,OAAO;IAChD,CAAC,GAAG,SAAS,iBAAiB,CAAC,EAAE,IAAI;IACrC,CAAC,GAAG,SAAS,gBAAgB,CAAC,EAAE,IAAI;CACrC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,QAAgB,EAAE,OAAgC;IACpG,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;IACnE,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAwB,CAAC;QACrF,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChF,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,QAAQ,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3E,CAAC"}

package/dist/runtime/index.d.ts

@@ -1,35 +1,45 @@
-import postgres from "postgres";
+import { type NodePgDatabase } from "drizzle-orm/node-postgres";
+import { Pool } from "pg";
 import { type Auth } from "./auth.js";
 import { type Email, type EmailBindings } from "./email.js";
 import { type Files, type FilesBindings } from "./files.js";
+import { type RateLimiter } from "./guard.js";
 export type { Auth } from "./auth.js";
 export type { Email, EmailMessage } from "./email.js";
 export type { FileEntry, Files, Folder, StoredObject } from "./files.js";
-export type Sql = postgres.Sql;
 export interface PlatformBindings extends EmailBindings, FilesBindings {
     DB?: {
         connectionString: string;
     };
     APP_URL?: string;
+    APP_NAME?: string;
     BETTER_AUTH_SECRET?: string;
+    AUTH_ORGANIZATIONS?: string;
+    AUTH_LIMIT?: RateLimiter;
 }
 export interface ExecutionContext {
     waitUntil(promise: Promise<unknown>): void;
 }
 export type Session = NonNullable<Awaited<ReturnType<Auth["api"]["getSession"]>>>;
-export interface AppContext<Env> {
+export type User = Session["user"];
+export interface AppContext<Env, Schema extends Record<string, unknown>> {
     env: Env;
-    readonly sql: Sql;
+    readonly db: NodePgDatabase<Schema>;
     readonly email: Email;
     readonly files: Files;
     readonly auth: Auth;
     session(): Promise<Session | null>;
+    requireUser(): Promise<User>;
     waitUntil(promise: Promise<unknown>): void;
 }
-export type Handler<Env> = (request: Request, app: AppContext<Env>) => Response | Promise<Response>;
-export interface AppOptions {
-    connect?: (connectionString: string) => Sql;
+export type Handler<Env, Schema extends Record<string, unknown>> = (request: Request, app: AppContext<Env, Schema>) => Response | Promise<Response>;
+export interface AppOptions<Schema extends Record<string, unknown>> {
+    schema?: Schema;
+    screens?: {
+        stylesheet?: string;
+    };
+    pool?: (connectionString: string) => Pool;
 }
-export declare function defineApp<Secrets extends object = object>(handler: Handler<Secrets & PlatformBindings>, options?: AppOptions): {
+export declare function defineApp<Secrets extends object = object, Schema extends Record<string, unknown> = Record<string, never>>(handler: Handler<Secrets & PlatformBindings, Schema>, options?: AppOptions<Schema>): {
     fetch(request: Request, env: Secrets & PlatformBindings, ctx: ExecutionContext): Promise<Response>;
 };

package/dist/runtime/index.js

@@ -1,25 +1,32 @@
-import postgres from "postgres";
-import { AUTH_PATH, authPool, createAuth } from "./auth.js";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { Pool } from "pg";
+import { AUTH_PATH, createAuth } from "./auth.js";
 import { createEmail } from "./email.js";
 import { createFiles } from "./files.js";
-const defaultConnect = (connectionString) => postgres(connectionString, { max: 5, fetch_types: false });
+import { isCrossSiteForm, needsSession, rateLimited } from "./guard.js";
+import { isScreen, renderScreen } from "./screens.js";
+const defaultPool = (connectionString) => new Pool({ connectionString, max: 5 });
+const json = (body, status = 200) => Response.json(body, { status });
 // `Secrets` names the app's secrets, such as `defineApp<{ SESSION_SECRET: string }>`; the
-// platform's own bindings are added to it. With `auth` on, /api/auth/* is handled for the app.
+// platform's own bindings are added to it. Pass the app's tables as `schema` for a typed `app.db`.
+// A handler may throw a Response, as `requireUser` does, and it is sent as the answer.
 export function defineApp(handler, options = {}) {
-    const connect = options.connect ?? defaultConnect;
+    const openPool = options.pool ?? defaultPool;
     return {
         async fetch(request, env, ctx) {
-            let sql;
+            const url = new URL(request.url);
+            let pool;
+            let db;
             let email;
             let files;
             let auth;
-            let pool;
+            let session;
             const app = {
                 env,
-                get sql() {
+                get db() {
                     if (!env.DB)
                         throw new Error("this app has no database; add `database` to platform.jsonc");
-                    return (sql ??= connect(env.DB.connectionString));
+                    return (db ??= drizzle((pool ??= openPool(env.DB.connectionString)), { schema: options.schema ?? {} }));
                 },
                 get email() {
                     return (email ??= createEmail(env));
@@ -30,34 +37,61 @@ export function defineApp(handler, options = {}) {
                 get auth() {
                     if (!env.BETTER_AUTH_SECRET)
                         throw new Error("this app has no auth; set `auth: true` in platform.jsonc");
-                    if (!env.DB)
-                        throw new Error("auth needs a database; add `database` to platform.jsonc");
                     return (auth ??= createAuth({
-                        pool: (pool ??= authPool(env.DB.connectionString)),
+                        db: app.db,
                         secret: env.BETTER_AUTH_SECRET,
-                        baseURL: env.APP_URL ?? new URL(request.url).origin,
+                        baseURL: env.APP_URL ?? url.origin,
                         email: app.email,
                         requireVerification: env.EMAIL_MODE === "send",
                     }));
                 },
-                async session() {
-                    return env.BETTER_AUTH_SECRET ? app.auth.api.getSession({ headers: request.headers }) : null;
+                session() {
+                    return (session ??= env.BETTER_AUTH_SECRET ? app.auth.api.getSession({ headers: request.headers }) : Promise.resolve(null));
+                },
+                async requireUser() {
+                    const current = await app.session();
+                    if (!current)
+                        throw json({ error: "sign in first" }, 401);
+                    return current.user;
                 },
                 waitUntil: (promise) => ctx.waitUntil(promise),
             };
             try {
-                if (env.BETTER_AUTH_SECRET && new URL(request.url).pathname.startsWith(`${AUTH_PATH}/`)) {
-                    return await app.auth.handler(request);
+                if (isCrossSiteForm(request, url))
+                    return json({ error: "cross-site form submissions are refused" }, 403);
+                if (env.BETTER_AUTH_SECRET) {
+                    const platform = await platformRoute(request, url, env, app, options);
+                    if (platform)
+                        return platform;
                 }
                 return await handler(request, app);
             }
+            catch (thrown) {
+                if (thrown instanceof Response)
+                    return thrown;
+                throw thrown;
+            }
             finally {
-                if (sql)
-                    ctx.waitUntil(sql.end({ timeout: 5 }));
                 if (pool)
                     ctx.waitUntil(pool.end());
             }
         },
     };
 }
+// What the platform answers itself for an app with auth: screens, auth routes, and the sign-in
+// check in front of every private /api route.
+async function platformRoute(request, url, env, app, options) {
+    const path = url.pathname;
+    if (request.method === "GET" && isScreen(path))
+        return renderScreen(path, env.APP_NAME ?? url.hostname, options.screens?.stylesheet);
+    if (await rateLimited(request, path, env.AUTH_LIMIT))
+        return json({ error: "too many attempts; wait a minute" }, 429);
+    if (path.startsWith(`${AUTH_PATH}/organization/`) && env.AUTH_ORGANIZATIONS !== "on")
+        return json({ error: "not found" }, 404);
+    if (path.startsWith(`${AUTH_PATH}/`))
+        return app.auth.handler(request);
+    if (needsSession(path))
+        await app.requireUser();
+    return undefined;
+}
 //# sourceMappingURL=index.js.map

package/dist/runtime/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAa,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,WAAW,EAAkC,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,WAAW,EAAkC,MAAM,YAAY,CAAC;AAoCzE,MAAM,cAAc,GAAG,CAAC,gBAAwB,EAAE,EAAE,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;AAEhH,0FAA0F;AAC1F,+FAA+F;AAC/F,MAAM,UAAU,SAAS,CAAkC,OAA4C,EAAE,OAAO,GAAe,EAAE;IAC/H,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC;IAElD,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAA+B,EAAE,GAAqB;YAClF,IAAI,GAAoB,CAAC;YACzB,IAAI,KAAwB,CAAC;YAC7B,IAAI,KAAwB,CAAC;YAC7B,IAAI,IAAsB,CAAC;YAC3B,IAAI,IAAsB,CAAC;YAE3B,MAAM,GAAG,GAA2C;gBAClD,GAAG;gBACH,IAAI,GAAG;oBACL,IAAI,CAAC,GAAG,CAAC,EAAE;wBAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;oBAC3F,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBACpD,CAAC;gBACD,IAAI,KAAK;oBACP,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtC,CAAC;gBACD,IAAI,KAAK;oBACP,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtC,CAAC;gBACD,IAAI,IAAI;oBACN,IAAI,CAAC,GAAG,CAAC,kBAAkB;wBAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;oBACzG,IAAI,CAAC,GAAG,CAAC,EAAE;wBAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;oBACxF,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;wBAC1B,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;wBAClD,MAAM,EAAE,GAAG,CAAC,kBAAkB;wBAC9B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM;wBACnD,KAAK,EAAE,GAAG,CAAC,KAAK;wBAChB,mBAAmB,EAAE,GAAG,CAAC,UAAU,KAAK,MAAM;qBAC/C,CAAC,CAAC,CAAC;gBACN,CAAC;gBACD,KAAK,CAAC,OAAO;oBACX,OAAO,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC/F,CAAC;gBACD,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC;aAC/C,CAAC;YAEF,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,kBAAkB,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;oBACxF,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACzC,CAAC;gBACD,OAAO,MAAM,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACrC,CAAC;oBAAS,CAAC;gBACT,IAAI,GAAG;oBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBAChD,IAAI,IAAI;oBAAE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAuB,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAa,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAkC,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,WAAW,EAAkC,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAoB,MAAM,YAAY,CAAC;AAC1F,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAyCtD,MAAM,WAAW,GAAG,CAAC,gBAAwB,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AAEzF,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAE9E,0FAA0F;AAC1F,mGAAmG;AACnG,uFAAuF;AACvF,MAAM,UAAU,SAAS,CACvB,OAAoD,EACpD,OAAO,GAAuB,EAAE;IAEhC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAE7C,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAA+B,EAAE,GAAqB;YAClF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,IAAsB,CAAC;YAC3B,IAAI,EAAsC,CAAC;YAC3C,IAAI,KAAwB,CAAC;YAC7B,IAAI,KAAwB,CAAC;YAC7B,IAAI,IAAsB,CAAC;YAC3B,IAAI,OAA4C,CAAC;YAEjD,MAAM,GAAG,GAAmD;gBAC1D,GAAG;gBACH,IAAI,EAAE;oBACJ,IAAI,CAAC,GAAG,CAAC,EAAE;wBAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;oBAC3F,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAK,EAAa,EAAE,CAAC,CAAC,CAAC;gBACtH,CAAC;gBACD,IAAI,KAAK;oBACP,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtC,CAAC;gBACD,IAAI,KAAK;oBACP,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtC,CAAC;gBACD,IAAI,IAAI;oBACN,IAAI,CAAC,GAAG,CAAC,kBAAkB;wBAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;oBACzG,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;wBAC1B,EAAE,EAAE,GAAG,CAAC,EAA6C;wBACrD,MAAM,EAAE,GAAG,CAAC,kBAAkB;wBAC9B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,MAAM;wBAClC,KAAK,EAAE,GAAG,CAAC,KAAK;wBAChB,mBAAmB,EAAE,GAAG,CAAC,UAAU,KAAK,MAAM;qBAC/C,CAAC,CAAC,CAAC;gBACN,CAAC;gBACD,OAAO;oBACL,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC9H,CAAC;gBACD,KAAK,CAAC,WAAW;oBACf,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;oBACpC,IAAI,CAAC,OAAO;wBAAE,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC1D,OAAO,OAAO,CAAC,IAAI,CAAC;gBACtB,CAAC;gBACD,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC;aAC/C,CAAC;YAEF,IAAI,CAAC;gBACH,IAAI,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC1G,IAAI,GAAG,CAAC,kBAAkB,EAAE,CAAC;oBAC3B,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;oBACtE,IAAI,QAAQ;wBAAE,OAAO,QAAQ,CAAC;gBAChC,CAAC;gBACD,OAAO,MAAM,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,IAAI,MAAM,YAAY,QAAQ;oBAAE,OAAO,MAAM,CAAC;gBAC9C,MAAM,MAAM,CAAC;YACf,CAAC;oBAAS,CAAC;gBACT,IAAI,IAAI;oBAAE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,8CAA8C;AAC9C,KAAK,UAAU,aAAa,CAC1B,OAAgB,EAChB,GAAQ,EACR,GAAQ,EACR,GAA4B,EAC5B,OAA2B;IAE3B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACrI,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,CAAC,CAAC;IACtH,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,gBAAgB,CAAC,IAAI,GAAG,CAAC,kBAAkB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/H,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEvE,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;IAChD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/runtime/screens.d.ts

@@ -0,0 +1,4 @@
+export declare const SCREEN_PATHS: readonly ["/login", "/signup", "/forgot", "/reset"];
+export type ScreenPath = (typeof SCREEN_PATHS)[number];
+export declare function isScreen(pathname: string): pathname is ScreenPath;
+export declare function renderScreen(path: ScreenPath, appName: string, stylesheet: string | undefined): Response;

package/dist/runtime/screens.js

@@ -0,0 +1,145 @@
+// Sign-in, sign-up and password screens every app with auth gets. Class names are part of the
+// public interface: an app restyles them with its own stylesheet, loaded after this one.
+export const SCREEN_PATHS = ["/login", "/signup", "/forgot", "/reset"];
+// Password managers pair a saved password with the field marked "username", even when it holds an email.
+const email = { name: "email", label: "Email", type: "email", autocomplete: "username" };
+const password = (autocomplete, label = "Password") => ({ name: "password", label, type: "password", autocomplete });
+const SCREENS = {
+    "/login": {
+        title: "Sign in",
+        fields: [email, password("current-password")],
+        button: "Sign in",
+        links: [["/signup", "Create an account"], ["/forgot", "Forgot your password?"]],
+    },
+    "/signup": {
+        title: "Create an account",
+        fields: [{ name: "name", label: "Name", type: "text", autocomplete: "name" }, email, password("new-password")],
+        button: "Create account",
+        links: [["/login", "Already have an account? Sign in"]],
+    },
+    "/forgot": {
+        title: "Reset your password",
+        intro: "Enter your email and we'll send you a link to choose a new password.",
+        fields: [email],
+        button: "Send reset link",
+        links: [["/login", "Back to sign in"]],
+    },
+    "/reset": {
+        title: "Choose a new password",
+        fields: [password("new-password", "New password")],
+        button: "Change password",
+        links: [["/login", "Back to sign in"]],
+    },
+};
+export function isScreen(pathname) {
+    return SCREEN_PATHS.includes(pathname);
+}
+export function renderScreen(path, appName, stylesheet) {
+    const screen = SCREENS[path];
+    const fields = screen.fields
+        .map((f) => `<label class="platform-field"><span class="platform-label">${f.label}</span>` +
+        `<input class="platform-input" id="${f.name}" name="${f.name}" type="${f.type}" autocomplete="${f.autocomplete}" required${f.type === "password" ? ' minlength="8"' : ""}></label>`)
+        .join("");
+    const links = screen.links.map(([href, text]) => `<a href="${href}" data-carry>${text}</a>`).join("");
+    const html = `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${screen.title} · ${escape(appName)}</title>
+<style>${STYLE}</style>${stylesheet ? `<link rel="stylesheet" href="${escape(stylesheet)}">` : ""}
+</head><body class="platform-screen" data-page="${path.slice(1)}">
+<main class="platform-card">
+<p class="platform-app">${escape(appName)}</p>
+<h1 class="platform-title">${screen.title}</h1>
+${screen.intro ? `<p class="platform-intro">${screen.intro}</p>` : ""}
+<form class="platform-form" method="post" action="${path}" novalidate>${path === "/reset" ? '<input id="email" name="email" type="email" autocomplete="username" hidden>' : ""}${fields}
+<p class="platform-error" role="alert" hidden></p>
+<button class="platform-button" type="submit">${screen.button}</button></form>
+<div class="platform-message" role="status" hidden></div>
+<nav class="platform-links">${links}</nav>
+</main>
+<script>${SCRIPT}</script>
+</body></html>`;
+    return new Response(html, { headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" } });
+}
+function escape(text) {
+    return text.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+}
+const STYLE = `
+:root{--platform-bg:#f4f6f8;--platform-card:#fff;--platform-fg:#1b2430;--platform-muted:#5d6a78;--platform-line:#d5dce3;--platform-accent:#2554c7;--platform-on-accent:#fff;--platform-error:#b42318;color-scheme:light dark}
+@media (prefers-color-scheme:dark){:root{--platform-bg:#11161c;--platform-card:#19212a;--platform-fg:#e6ebf0;--platform-muted:#9aa7b4;--platform-line:#2c3742;--platform-accent:#7aa2ff;--platform-on-accent:#0b1220;--platform-error:#ff8a80}}
+*{box-sizing:border-box}
+[hidden]{display:none!important}
+body.platform-screen{margin:0;min-height:100vh;display:grid;place-items:center;padding:24px 16px;background:var(--platform-bg);color:var(--platform-fg);font:16px/1.5 system-ui,-apple-system,"Segoe UI",sans-serif}
+.platform-card{width:100%;max-width:380px;background:var(--platform-card);border:1px solid var(--platform-line);border-radius:12px;padding:28px 24px;display:flex;flex-direction:column;gap:16px}
+.platform-app{margin:0;font-size:13px;letter-spacing:.06em;text-transform:uppercase;color:var(--platform-muted)}
+.platform-title{margin:0;font-size:24px;line-height:1.2}
+.platform-intro{margin:0;color:var(--platform-muted)}
+.platform-form{display:flex;flex-direction:column;gap:14px}
+.platform-field{display:flex;flex-direction:column;gap:6px;font-size:14px;font-weight:600}
+.platform-input{font:inherit;font-weight:400;padding:10px 12px;border:1px solid var(--platform-line);border-radius:8px;background:var(--platform-bg);color:inherit}
+.platform-input:focus-visible,.platform-button:focus-visible,.platform-links a:focus-visible{outline:2px solid var(--platform-accent);outline-offset:2px}
+.platform-button{font:inherit;font-weight:600;padding:11px 14px;border:0;border-radius:8px;background:var(--platform-accent);color:var(--platform-on-accent);cursor:pointer}
+.platform-button[disabled]{opacity:.6;cursor:progress}
+.platform-error{margin:0;color:var(--platform-error);font-size:14px}
+.platform-message{display:flex;flex-direction:column;gap:12px}
+.platform-message p{margin:0}
+.platform-code{font:600 18px/1.4 ui-monospace,Menlo,monospace;letter-spacing:.04em;padding:12px;border:1px dashed var(--platform-line);border-radius:8px;text-align:center;word-break:break-all;user-select:all}
+.platform-links{display:flex;flex-direction:column;gap:6px;font-size:14px}
+.platform-links a{color:var(--platform-accent)}
+`;
+const SCRIPT = `
+const page = document.body.dataset.page;
+const params = new URLSearchParams(location.search);
+const next = (p => p && p.startsWith("/") && !p.startsWith("//") ? p : "/")(params.get("next"));
+const carried = new URLSearchParams([...params].filter(([k]) => k === "next" || k === "invitation")).toString();
+for (const a of document.querySelectorAll("[data-carry]")) if (carried) a.href += "?" + carried;
+const form = document.querySelector(".platform-form");
+const error = document.querySelector(".platform-error");
+const message = document.querySelector(".platform-message");
+
+async function post(path, body) {
+  const r = await fetch(path, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body), credentials: "same-origin" });
+  const data = await r.json().catch(() => ({}));
+  if (!r.ok) throw new Error(r.status === 429 ? "Too many attempts. Wait a minute, then try again." : data.message || "That didn't work. Try again.");
+  return data || {};
+}
+
+function say(...parts) {
+  form.hidden = true;
+  message.replaceChildren(...parts.map(p => typeof p === "string" ? Object.assign(document.createElement("p"), { textContent: p }) : p));
+  message.hidden = false;
+}
+
+async function finish() {
+  const invitation = params.get("invitation");
+  if (invitation) await post("/api/auth/organization/accept-invitation", { invitationId: invitation }).catch(() => {});
+  location.assign(next);
+}
+
+const actions = {
+  login: async v => { await post("/api/auth/sign-in/email", { email: v.email, password: v.password }); await finish(); },
+  signup: async v => {
+    const data = await post("/api/auth/sign-up/email", { name: v.name, email: v.email, password: v.password, callbackURL: "/login" + (carried ? "?" + carried : "") });
+    if (data.token) return finish();
+    say("Check your email for a link to confirm your address. It signs you in.");
+  },
+  forgot: async v => { await post("/api/auth/request-password-reset", { email: v.email, redirectTo: "/reset?email=" + encodeURIComponent(v.email) }); say("If that address has an account, a reset link is on its way."); },
+  reset: async v => { await post("/api/auth/reset-password", { newPassword: v.password, token: params.get("token") }); say("Your password is changed. Sign in with it now."); },
+};
+
+form.addEventListener("submit", async e => {
+  e.preventDefault();
+  error.hidden = true;
+  if (!form.reportValidity()) return;
+  const button = form.querySelector("button");
+  button.disabled = true;
+  try { await actions[page](Object.fromEntries(new FormData(form))); }
+  catch (err) { error.textContent = err.message; error.hidden = false; }
+  finally { button.disabled = false; }
+});
+
+// The reset link carries the email, so a password manager knows which saved login to update.
+if (page === "reset") document.getElementById("email").value = params.get("email") || "";
+if (page === "reset" && (params.get("error") || !params.get("token"))) say("That reset link has expired or was already used. Ask for a new one from the sign-in page.");
+if (page === "login") fetch("/api/auth/get-session", { credentials: "same-origin" }).then(r => r.json()).then(s => s && s.session && finish()).catch(() => {});
+`;
+//# sourceMappingURL=screens.js.map

package/dist/runtime/screens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"screens.js","sourceRoot":"","sources":["../../src/runtime/screens.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,yFAAyF;AAEzF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC;AAkBhF,yGAAyG;AACzG,MAAM,KAAK,GAAU,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AAChG,MAAM,QAAQ,GAAG,CAAC,YAAoB,EAAE,KAAK,GAAG,UAAU,EAAS,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;AAEpI,MAAM,OAAO,GAA+B;IAC1C,QAAQ,EAAE;QACR,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAC7C,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;KAChF;IACD,SAAS,EAAE;QACT,KAAK,EAAE,mBAAmB;QAC1B,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC9G,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,kCAAkC,CAAC,CAAC;KACxD;IACD,SAAS,EAAE;QACT,KAAK,EAAE,qBAAqB;QAC5B,KAAK,EAAE,sEAAsE;QAC7E,MAAM,EAAE,CAAC,KAAK,CAAC;QACf,MAAM,EAAE,iBAAiB;QACzB,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;KACvC;IACD,QAAQ,EAAE;QACR,KAAK,EAAE,uBAAuB;QAC9B,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;QAClD,MAAM,EAAE,iBAAiB;QACzB,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;KACvC;CACF,CAAC;AAEF,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,OAAQ,YAAkC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAgB,EAAE,OAAe,EAAE,UAA8B;IAC5F,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM;SACzB,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CAAC,8DAA8D,CAAC,CAAC,KAAK,SAAS;QACnF,qCAAqC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,YAAY,aAAa,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,WAAW,CACtL;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,IAAI,gBAAgB,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,MAAM,IAAI,GAAG;;SAEN,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,OAAO,CAAC;SACjC,KAAK,WAAW,UAAU,CAAC,CAAC,CAAC,gCAAgC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;kDAC/C,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;;0BAErC,MAAM,CAAC,OAAO,CAAC;6BACZ,MAAM,CAAC,KAAK;EACvC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,6BAA6B,MAAM,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE;oDACjB,IAAI,gBAAgB,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,6EAA6E,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM;;gDAEvI,MAAM,CAAC,MAAM;;8BAE/B,KAAK;;UAEzB,MAAM;eACD,CAAC;IACd,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AACtH,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;CAsBb,CAAC;AAEF,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDd,CAAC"}