@giaeulate/baas-sdk 1.3.0 → 1.4.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 1.4.0 — 2026-07-01
+
+Backward-compatible additions tracking the golang-baas gap-fix release (refresh tokens, realtime broadcast/presence + server-side filters, per-bucket storage caps). All existing signatures unchanged.
+
+### Added
+
+- **Auto token refresh** — `HttpClient` retries once on a 401 via `POST /api/auth/refresh` (concurrent requests share a single in-flight refresh), then replays the original request. `onForceLogout` fires only when the refresh itself fails.
+- **Auth**: `auth.refresh()` (manual refresh), `setRefreshToken`/`getRefreshToken`; `login()` stores the refresh token and `logout()` clears both tokens.
+- **Realtime**: `subscribe(table, action, cb, filter?)` server-side value filters (`eq/neq/gt/gte/lt/lte/in/like`, applied per-subscription — shared filter goes server-side, otherwise each subscriber filters client-side); `subscribeBroadcast(channel, cb)` + `broadcast(channel, payload)` (ephemeral, no DB/RLS); `subscribePresence(channel, state, cb)` (sync/join/leave). All re-join automatically on reconnect.
+- **Storage**: `createBucket(name, isPublic?, maxBytes?)` and `updateBucket(id, { isPublic?, maxBytes? })` per-bucket upload caps; `StorageBucket.max_bytes`.
+- **CLI**: `baas gen types [--out file]` generates TypeScript interfaces from the live schema (`GET /api/schemas/types`).
+
 ## 1.3.0 — 2026-06-04
 
 Backward-compatible additions + two dead-route fixes. Validated end-to-end (33 live checks) against a running golang-baas server.

package/dist/cli.js

@@ -1,5 +1,8 @@
 #!/usr/bin/env node
 
+// src/cli/index.ts
+import { writeFileSync as writeFileSync2 } from "fs";
+
 // src/cli/config.ts
 import { readFileSync, existsSync } from "fs";
 import { resolve } from "path";
@@ -297,8 +300,10 @@ Usage:
   baas db list              Alias of status
   baas db push              Apply pending migrations and record them
   baas db baseline          Mark existing files as applied without running them
+  baas gen types            Generate TypeScript types from the live schema
 
 Options:
+  --out <file>     gen types: write to a file instead of stdout
   --dir <path>     Migrations directory (default: cwd or BAAS_MIGRATIONS_DIR)
   --url <url>      BaaS URL (default: BAAS_URL / .env)
   --token <key>    API key (default: BAAS_API_KEY / .env)
@@ -332,6 +337,33 @@ async function main() {
     console.log(HELP);
     return;
   }
+  if (group === "gen") {
+    if (sub !== "types") {
+      console.error(`Unknown gen subcommand: ${sub ?? "(none)"}
+`);
+      console.log(HELP);
+      process.exit(1);
+    }
+    const cfg2 = resolveConfig(argv);
+    if (!cfg2.baasUrl || !cfg2.token) {
+      console.error("ERROR: missing BaaS URL or token (--url/--token, env, or .env).");
+      process.exit(1);
+    }
+    process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+    const res = await fetch(`${cfg2.baasUrl.replace(/\/$/, "")}/api/schemas/types`, {
+      headers: { Authorization: `Bearer ${cfg2.token}` }
+    });
+    const text = await res.text();
+    if (!res.ok) throw new Error(`HTTP ${res.status}: ${text}`);
+    const out = getArg(argv, "out");
+    if (out) {
+      writeFileSync2(out, text);
+      console.error(`Wrote ${out}`);
+    } else {
+      process.stdout.write(text);
+    }
+    return;
+  }
   if (group !== "db") {
     console.error(`Unknown command: ${group}
 `);

package/dist/index.cjs

@@ -32,8 +32,10 @@ var HttpClient = class {
   apiKey = "";
   keyType;
   token = null;
+  refreshToken = null;
   environment = "prod";
   _onForceLogout = null;
+  _refreshing = null;
   constructor(url, apiKey, options) {
     let baseUrl = url || (typeof window !== "undefined" ? window.location.origin : "http://localhost:8080");
     this.url = baseUrl.endsWith("/") ? baseUrl.slice(0, -1) : baseUrl;
@@ -41,6 +43,7 @@ var HttpClient = class {
     this.keyType = options?.keyType ?? "service_role";
     this.warnIfUnsafeKey();
     this.token = typeof localStorage !== "undefined" ? this.cleanValue(localStorage.getItem("baas_token")) : null;
+    this.refreshToken = typeof localStorage !== "undefined" ? this.cleanValue(localStorage.getItem("baas_refresh_token")) : null;
   }
   /** SECURITY: a service_role key bypasses RLS and grants admin over every
    *  tenant. If it ends up in a browser bundle, anyone can extract it. Warn
@@ -59,12 +62,59 @@ var HttpClient = class {
    */
   setToken(token) {
     this.token = token;
+    if (typeof localStorage === "undefined") return;
     if (token) {
       localStorage.setItem("baas_token", token);
     } else {
       localStorage.removeItem("baas_token");
     }
   }
+  /** Persist the rotating refresh token (used by auto-refresh on 401). In the
+   *  browser the server also sets an HttpOnly `baas_refresh` cookie, so storing
+   *  it here is mainly for non-cookie clients (React Native). */
+  setRefreshToken(token) {
+    this.refreshToken = token;
+    if (typeof localStorage === "undefined") return;
+    if (token) {
+      localStorage.setItem("baas_refresh_token", token);
+    } else {
+      localStorage.removeItem("baas_refresh_token");
+    }
+  }
+  getRefreshToken() {
+    const ls = typeof localStorage !== "undefined" ? localStorage.getItem("baas_refresh_token") : null;
+    return this.cleanValue(this.refreshToken || ls);
+  }
+  /** Attempts a single token refresh, deduped across concurrent 401s. Sends the
+   *  stored refresh token (falls back to the HttpOnly cookie in browsers). */
+  tryRefresh() {
+    if (!this._refreshing) {
+      this._refreshing = this.doRefresh().finally(() => {
+        this._refreshing = null;
+      });
+    }
+    return this._refreshing;
+  }
+  async doRefresh() {
+    try {
+      const body = {};
+      const rt = this.getRefreshToken();
+      if (rt) body.refresh_token = rt;
+      const res = await fetch(`${this.url}/api/auth/refresh`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", apikey: this.apiKey },
+        credentials: "include",
+        body: JSON.stringify(body)
+      });
+      if (!res.ok) return false;
+      const data = await res.json().catch(() => null);
+      if (data?.token) this.setToken(data.token);
+      if (data?.refresh_token) this.setRefreshToken(data.refresh_token);
+      return Boolean(data?.token);
+    } catch {
+      return false;
+    }
+  }
   /**
    * Register a callback invoked on forced logout (401).
    * Use this in React Native instead of the default window.location redirect.
@@ -105,7 +155,7 @@ var HttpClient = class {
   /**
    * Core HTTP request method - DRY principle
    */
-  async request(endpoint, options = {}) {
+  async request(endpoint, options = {}, _isRetry = false) {
     const { method = "GET", body, headers: customHeaders, skipAuth = false } = options;
     const headers = { ...this.getHeaders(), ...customHeaders };
     const fetchOptions = {
@@ -123,6 +173,9 @@ var HttpClient = class {
     const data = await res.json().catch(() => null);
     if (!res.ok) {
       if (res.status === 401 && !skipAuth) {
+        if (!_isRetry && await this.tryRefresh()) {
+          return this.request(endpoint, options, true);
+        }
         this.forceLogout();
       }
       if (res.status === 403 && data?.error === "ip_not_allowed") {
@@ -167,7 +220,11 @@ var HttpClient = class {
   }
   logout() {
     this.token = null;
-    localStorage.removeItem("baas_token");
+    this.refreshToken = null;
+    if (typeof localStorage !== "undefined") {
+      localStorage.removeItem("baas_token");
+      localStorage.removeItem("baas_refresh_token");
+    }
   }
   forceLogout() {
     this.logout();
@@ -408,17 +465,27 @@ function createAuthModule(client) {
         throw new Error(data?.error || `Login failed: ${res.status}`);
       }
       if (data.token) {
-        client.token = data.token;
-        localStorage.setItem("baas_token", data.token);
+        client.setToken(data.token);
       }
+      if (data.refresh_token) {
+        client.setRefreshToken(data.refresh_token);
+      }
+      return data;
+    },
+    /** Manually refresh the access token via the rotating refresh token. The
+     *  HttpClient also does this automatically on a 401. */
+    async refresh() {
+      const rt = client.refreshToken;
+      const data = await post("/api/auth/refresh", rt ? { refresh_token: rt } : {});
+      if (data?.token) client.setToken(data.token);
+      if (data?.refresh_token) client.setRefreshToken(data.refresh_token);
       return data;
     },
     async logout() {
       try {
         await post("/api/logout");
       } finally {
-        client.token = null;
-        localStorage.removeItem("baas_token");
+        client.logout();
       }
     },
     // Anonymous sign-in (Supabase parity). Response carries access_token (+ a
@@ -703,11 +770,11 @@ function createStorageModule(client) {
     async deleteFile(fileId) {
       return del(`/api/storage/files/${fileId}`);
     },
-    async createBucket(name, isPublic = false) {
-      return post("/api/storage/buckets", { name, is_public: isPublic });
+    async createBucket(name, isPublic = false, maxBytes) {
+      return post("/api/storage/buckets", { name, is_public: isPublic, max_bytes: maxBytes });
     },
     async updateBucket(bucketId, opts) {
-      return put(`/api/storage/buckets/${bucketId}`, { is_public: opts.isPublic });
+      return put(`/api/storage/buckets/${bucketId}`, { is_public: opts.isPublic, max_bytes: opts.maxBytes });
     },
     async listBuckets() {
       return get("/api/storage/buckets");
@@ -924,9 +991,18 @@ function createEmailModule(client) {
     async getConfig() {
       return get("/api/email/config");
     },
+    async listConfigs() {
+      return get("/api/email/configs");
+    },
     async saveConfig(config) {
       return post("/api/email/config", config);
     },
+    async setDefaultConfig(id) {
+      return post(`/api/email/configs/${id}/default`);
+    },
+    async deleteConfig(id) {
+      return del(`/api/email/configs/${id}`);
+    },
     async createTemplate(template) {
       return post("/api/email/templates", template);
     },
@@ -1078,6 +1154,9 @@ function createAuditModule(client) {
     },
     async purge(olderThanDays) {
       return del(`/api/audit/purge?older_than_days=${olderThanDays}`);
+    },
+    async clearAll() {
+      return del(`/api/audit/clear`);
     }
   };
 }
@@ -1178,6 +1257,16 @@ var RealtimeService = class {
   }
   socket = null;
   subscribers = /* @__PURE__ */ new Map();
+  // The server-side value filter currently REGISTERED per table (e.g.
+  // { status: 'eq.pending' }). The server keeps one filter per (connection,table),
+  // so this is only set when every subscriber on the table shares the same filter;
+  // otherwise the table runs unfiltered server-side and each subscriber's filter is
+  // applied client-side in handleEvent (see computeServerFilter).
+  filters = /* @__PURE__ */ new Map();
+  // Ephemeral Broadcast / Presence channel handlers.
+  broadcastHandlers = /* @__PURE__ */ new Map();
+  presenceHandlers = /* @__PURE__ */ new Map();
+  presenceStates = /* @__PURE__ */ new Map();
   reconnectAttempts = 0;
   maxReconnectAttempts = 5;
   reconnectInterval = 3e3;
@@ -1206,6 +1295,12 @@ var RealtimeService = class {
         for (const table of this.subscribers.keys()) {
           this.sendSub("subscribe", table);
         }
+        for (const channel of this.broadcastHandlers.keys()) {
+          this.send({ event: "broadcast_subscribe", channel });
+        }
+        for (const channel of this.presenceHandlers.keys()) {
+          this.send({ event: "presence_subscribe", channel, state: this.presenceStates.get(channel) ?? {} });
+        }
         resolve();
       };
       socket.onmessage = (event) => {
@@ -1241,17 +1336,15 @@ var RealtimeService = class {
   /**
    * Subscribe to changes on a specific table
    */
-  async subscribe(table, action, callback) {
+  async subscribe(table, action, callback, filter) {
     await this.connect();
     const isNewTable = !this.subscribers.has(table);
     if (isNewTable) {
       this.subscribers.set(table, /* @__PURE__ */ new Set());
     }
-    const sub = { action, callback };
+    const sub = { action, callback, filter: filter && Object.keys(filter).length > 0 ? filter : void 0 };
     this.subscribers.get(table).add(sub);
-    if (isNewTable && table !== "*") {
-      this.sendSub("subscribe", table);
-    }
+    if (table !== "*") this.syncServerFilter(table, isNewTable);
     return {
       unsubscribe: () => {
         const tableSubs = this.subscribers.get(table);
@@ -1259,39 +1352,194 @@ var RealtimeService = class {
           tableSubs.delete(sub);
           if (tableSubs.size === 0) {
             this.subscribers.delete(table);
+            this.filters.delete(table);
             if (table !== "*") this.sendSub("unsubscribe", table);
+          } else if (table !== "*") {
+            this.syncServerFilter(table, false);
           }
         }
       }
     };
   }
-  /** Send a subscribe/unsubscribe control frame to the server. */
+  /**
+   * Recompute the effective server-side filter for a table and (re)register it
+   * when it changed (or when force is set, e.g. a brand-new table). The server
+   * stores exactly one filter per (connection, table): a plain `subscribe`
+   * clears it, a filtered `subscribe` replaces it.
+   */
+  syncServerFilter(table, force) {
+    const desired = this.computeServerFilter(table);
+    const current = this.filters.get(table);
+    const changed = JSON.stringify(desired ?? null) !== JSON.stringify(current ?? null);
+    if (!force && !changed) return;
+    if (desired) this.filters.set(table, desired);
+    else this.filters.delete(table);
+    this.sendSub("subscribe", table);
+  }
+  /**
+   * The server-side filter safe to apply for a table: the shared filter iff
+   * EVERY subscriber requested the identical (non-empty) filter. If any
+   * subscriber is unfiltered or filters conflict, returns undefined so the
+   * server delivers all rows and each subscriber filters client-side.
+   */
+  computeServerFilter(table) {
+    const subs = this.subscribers.get(table);
+    if (!subs || subs.size === 0) return void 0;
+    let chosen;
+    for (const sub of subs) {
+      const key = sub.filter && Object.keys(sub.filter).length > 0 ? JSON.stringify(sub.filter) : "";
+      if (key === "") return void 0;
+      if (chosen === void 0) chosen = key;
+      else if (chosen !== key) return void 0;
+    }
+    return chosen ? JSON.parse(chosen) : void 0;
+  }
+  /** Send a subscribe/unsubscribe control frame to the server (with any filter). */
   sendSub(event, table) {
+    const frame = { event, table };
+    if (event === "subscribe") {
+      const filter = this.filters.get(table);
+      if (filter) frame.filter = filter;
+    }
+    this.send(frame);
+  }
+  /** Send an arbitrary control frame if the socket is open. */
+  send(frame) {
     if (this.socket?.readyState === WebSocket.OPEN) {
-      this.socket.send(JSON.stringify({ event, table }));
+      this.socket.send(JSON.stringify(frame));
     }
   }
+  /**
+   * Subscribe to an ephemeral Broadcast channel (no DB, no RLS — UI sync/chat).
+   */
+  async subscribeBroadcast(channel, callback) {
+    await this.connect();
+    const isNew = !this.broadcastHandlers.has(channel);
+    if (isNew) this.broadcastHandlers.set(channel, /* @__PURE__ */ new Set());
+    const handlers = this.broadcastHandlers.get(channel);
+    handlers.add(callback);
+    if (isNew) this.send({ event: "broadcast_subscribe", channel });
+    return {
+      unsubscribe: () => {
+        handlers.delete(callback);
+        if (handlers.size === 0) {
+          this.broadcastHandlers.delete(channel);
+          this.send({ event: "broadcast_unsubscribe", channel });
+        }
+      }
+    };
+  }
+  /** Publish a message to a Broadcast channel. */
+  broadcast(channel, payload) {
+    this.send({ event: "broadcast", channel, payload });
+  }
+  /**
+   * Join a Presence channel. The callback receives sync/join/leave events with
+   * the current member list. Returns a leave() handle.
+   */
+  async subscribePresence(channel, state, callback) {
+    await this.connect();
+    const isNew = !this.presenceHandlers.has(channel);
+    if (isNew) this.presenceHandlers.set(channel, /* @__PURE__ */ new Set());
+    this.presenceStates.set(channel, state ?? {});
+    const handlers = this.presenceHandlers.get(channel);
+    handlers.add(callback);
+    if (isNew) this.send({ event: "presence_subscribe", channel, state: state ?? {} });
+    return {
+      leave: () => {
+        handlers.delete(callback);
+        if (handlers.size === 0) {
+          this.presenceHandlers.delete(channel);
+          this.presenceStates.delete(channel);
+          this.send({ event: "presence_unsubscribe", channel });
+        }
+      }
+    };
+  }
   /**
    * Handle incoming CDC events from the server
    */
   handleEvent(payload) {
-    const tableSubs = this.subscribers.get(payload.table);
-    if (tableSubs) {
-      for (const sub of tableSubs) {
-        if (sub.action === "*" || sub.action.toLowerCase() === payload.action.toLowerCase()) {
-          sub.callback(payload);
+    const kind = payload.type;
+    if (kind === "broadcast") {
+      const handlers = this.broadcastHandlers.get(payload.channel);
+      if (handlers) for (const cb of handlers) cb(payload.payload);
+      return;
+    }
+    if (kind === "presence") {
+      const handlers = this.presenceHandlers.get(payload.channel);
+      if (handlers) for (const cb of handlers) cb(payload);
+      return;
+    }
+    this.dispatchToSubs(this.subscribers.get(payload.table), payload);
+    this.dispatchToSubs(this.subscribers.get("*"), payload);
+  }
+  /**
+   * Fire matching subscribers. Each subscriber's own filter is re-checked
+   * client-side: when subscribers on a table disagree, the server delivers all
+   * rows unfiltered, so client-side filtering is what keeps each callback scoped.
+   */
+  dispatchToSubs(subs, payload) {
+    if (!subs) return;
+    for (const sub of subs) {
+      if (sub.action !== "*" && sub.action.toLowerCase() !== payload.action.toLowerCase()) continue;
+      if (sub.filter && !this.matchFilter(payload.record, sub.filter)) continue;
+      sub.callback(payload);
+    }
+  }
+  /** Evaluate a PostgREST-style filter against a record (mirrors hub_filter.go). */
+  matchFilter(record, filter) {
+    if (record == null) return false;
+    for (const col of Object.keys(filter)) {
+      const spec = filter[col];
+      let op = "eq";
+      let val = spec;
+      const i = spec.indexOf(".");
+      if (i > 0) {
+        const cand = spec.slice(0, i);
+        if (["eq", "neq", "gt", "gte", "lt", "lte", "in", "like"].includes(cand)) {
+          op = cand;
+          val = spec.slice(i + 1);
         }
       }
+      const actualRaw = record[col];
+      if (actualRaw === void 0) return false;
+      const actual = actualRaw === null ? "" : String(actualRaw);
+      if (!this.evalPred(op, actual, val)) return false;
     }
-    const wildcardSubs = this.subscribers.get("*");
-    if (wildcardSubs) {
-      for (const sub of wildcardSubs) {
-        if (sub.action === "*" || sub.action.toLowerCase() === payload.action.toLowerCase()) {
-          sub.callback(payload);
-        }
+    return true;
+  }
+  evalPred(op, actual, val) {
+    switch (op) {
+      case "eq":
+        return actual === val;
+      case "neq":
+        return actual !== val;
+      case "in":
+        return val.split(",").includes(actual);
+      case "like":
+        return this.likeMatch(actual, val);
+      case "gt":
+      case "gte":
+      case "lt":
+      case "lte": {
+        const a = parseFloat(actual);
+        const b = parseFloat(val);
+        if (Number.isNaN(a) || Number.isNaN(b)) return false;
+        if (op === "gt") return a > b;
+        if (op === "gte") return a >= b;
+        if (op === "lt") return a < b;
+        return a <= b;
       }
+      default:
+        return false;
     }
   }
+  /** SQL LIKE with '%' (any run) and '_' (any single char), anchored, case-sensitive. */
+  likeMatch(s, pattern) {
+    const re = "^" + pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/%/g, ".*").replace(/_/g, ".") + "$";
+    return new RegExp(re).test(s);
+  }
   /**
    * Attempt to reconnect on connection loss
    */
@@ -1329,8 +1577,17 @@ function createRealtimeModule(client) {
     typeof WebSocket !== "undefined" ? WebSocket : void 0
   );
   return {
-    async subscribe(table, action, callback) {
-      return service.subscribe(table, action, callback);
+    async subscribe(table, action, callback, filter) {
+      return service.subscribe(table, action, callback, filter);
+    },
+    async subscribeBroadcast(channel, callback) {
+      return service.subscribeBroadcast(channel, callback);
+    },
+    broadcast(channel, payload) {
+      service.broadcast(channel, payload);
+    },
+    async subscribePresence(channel, state, callback) {
+      return service.subscribePresence(channel, state, callback);
     }
   };
 }
@@ -1353,6 +1610,9 @@ function createApiKeysModule(client) {
     async delete(keyId) {
       return del(`/api/api-keys/${keyId}`);
     },
+    async setBrand(keyId, emailConfigId) {
+      return post(`/api/api-keys/${keyId}/brand`, { email_config_id: emailConfigId });
+    },
     async getInstanceToken() {
       return get("/api/api-keys/instance");
     },
@@ -1671,8 +1931,8 @@ var BaasClient = class extends HttpClient {
   async deleteStorageFile(fileId) {
     return this.storage.deleteFile(fileId);
   }
-  async createStorageBucket(name, isPublic) {
-    return this.storage.createBucket(name, isPublic);
+  async createStorageBucket(name, isPublic, maxBytes) {
+    return this.storage.createBucket(name, isPublic, maxBytes);
   }
   async listStorageBuckets() {
     return this.storage.listBuckets();
@@ -1703,6 +1963,9 @@ var BaasClient = class extends HttpClient {
   async deleteApiKey(keyId) {
     return this.apiKeys.delete(keyId);
   }
+  async setApiKeyBrand(keyId, emailConfigId) {
+    return this.apiKeys.setBrand(keyId, emailConfigId);
+  }
   async getInstanceToken() {
     return this.apiKeys.getInstanceToken();
   }
@@ -1777,9 +2040,18 @@ var BaasClient = class extends HttpClient {
   async getEmailConfig() {
     return this.email.getConfig();
   }
+  async listEmailConfigs() {
+    return this.email.listConfigs();
+  }
   async saveEmailConfig(config) {
     return this.email.saveConfig(config);
   }
+  async setDefaultEmailConfig(id) {
+    return this.email.setDefaultConfig(id);
+  }
+  async deleteEmailConfig(id) {
+    return this.email.deleteConfig(id);
+  }
   async createEmailTemplate(template) {
     return this.email.createTemplate(template);
   }
@@ -1928,9 +2200,12 @@ var BaasClient = class extends HttpClient {
   async purgeAuditLogs(olderThanDays) {
     return this.audit.purge(olderThanDays);
   }
+  async clearAllAuditLogs() {
+    return this.audit.clearAll();
+  }
   // Realtime shortcuts
-  subscribe(table, action, callback) {
-    return this.realtime.subscribe(table, action, callback);
+  subscribe(table, action, callback, filter) {
+    return this.realtime.subscribe(table, action, callback, filter);
   }
   // Environment shortcuts
   async getEnvironmentStatus() {