@hachej/boring-core 0.1.81 → 0.1.83

package/dist/{chunk-VB2N2DG5.js → chunk-YFCR6SAS.js}

@@ -13,7 +13,7 @@ import {
   workspaceRuntimes,
   workspaceSettings,
   workspaces
-} from "./chunk-H5BQOHWR.js";
+} from "./chunk-RVVE5WOB.js";
 import {
   noopTelemetry,
   safeCapture
@@ -25,10 +25,12 @@ import {
   ConfigValidationError,
   ERROR_CODES,
   HttpError
-} from "./chunk-QZGYKLXB.js";
+} from "./chunk-H7EYII35.js";
 
 // src/server/config/schema.ts
 import { z } from "zod";
+import proxyAddr from "@fastify/proxy-addr";
+import { isIP } from "net";
 var VALID_MAIL_SCHEMES = ["resend://", "smtp://", "smtps://", "console://", "console-capture://"];
 var logLevelSchema = z.enum([
   "fatal",
@@ -42,6 +44,22 @@ var rateLimitEndpointOverrideSchema = z.object({
   max: z.number().int().positive(),
   window: z.string().min(1)
 });
+var proxyCidrSchema = z.string().refine((value) => {
+  const parts = value.split("/");
+  if (parts.length !== 2 || isIP(parts[0]) === 0 || !/^\d+$/.test(parts[1])) return false;
+  try {
+    proxyAddr.compile(value);
+    return true;
+  } catch {
+    return false;
+  }
+}, "Expected an IPv4 or IPv6 CIDR");
+var trustedProxyPolicySchema = z.object({
+  cidrs: z.array(proxyCidrSchema).min(1).superRefine((cidrs, context) => {
+    if (new Set(cidrs).size !== cidrs.length) context.addIssue({ code: z.ZodIssueCode.custom, message: "Duplicate proxy CIDR" });
+  }),
+  hops: z.number().int().min(1).max(8)
+});
 var mailTransportUrlSchema = z.string().refine(
   (url) => VALID_MAIL_SCHEMES.some((s) => url.startsWith(s)),
   {
@@ -68,7 +86,8 @@ var coreConfigSchema = z.object({
     csp: z.object({
       enabled: z.boolean(),
       upgradeInsecureRequests: z.boolean().optional()
-    })
+    }),
+    trustedProxy: z.union([trustedProxyPolicySchema, z.literal("legacy-unsafe")]).nullable().optional()
   }).optional(),
   encryption: z.object({
     workspaceSettingsKey: z.string().min(1)
@@ -104,6 +123,81 @@ var coreConfigSchema = z.object({
 import { readFileSync, existsSync } from "fs";
 import { resolve } from "path";
 import { parse as parseTOML } from "smol-toml";
+
+// src/server/config/fileSecrets.ts
+import { closeSync, constants, fstatSync, openSync, readSync } from "fs";
+import path from "path";
+var MAX_SECRET_BYTES = 64 * 1024;
+var SECRET_PAIRS = [
+  ["DATABASE_URL", "DATABASE_URL_FILE"],
+  ["BETTER_AUTH_SECRET", "BETTER_AUTH_SECRET_FILE"],
+  ["WORKSPACE_SETTINGS_ENCRYPTION_KEY", "WORKSPACE_SETTINGS_ENCRYPTION_KEY_FILE"]
+];
+function invalid(variable, message = "secret file is invalid") {
+  throw new ConfigValidationError([{ message, path: ["env", variable] }]);
+}
+function decodeSecret(bytes) {
+  let value;
+  try {
+    value = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    return void 0;
+  }
+  if (value.endsWith("\n")) value = value.slice(0, -1);
+  if (!value || /[\0\r\n]/.test(value)) return void 0;
+  return value;
+}
+function readConfigFileSecret(variable, filePath, options = {}) {
+  if (!path.isAbsolute(filePath) || path.normalize(filePath) !== filePath || /[\0-\x1f\x7f]/.test(filePath)) invalid(variable);
+  const expectedOwnerUid = options.expectedOwnerUid ?? (typeof process.geteuid === "function" ? process.geteuid() : -1);
+  if (!Number.isSafeInteger(expectedOwnerUid) || expectedOwnerUid < 0) invalid(variable);
+  let fd;
+  let failure = false;
+  let value;
+  try {
+    fd = openSync(filePath, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== expectedOwnerUid || (stat.mode & 4095) !== 256 || stat.size > MAX_SECRET_BYTES) {
+      failure = true;
+    } else {
+      const buffer = Buffer.allocUnsafe(MAX_SECRET_BYTES + 1);
+      let length = 0;
+      while (length <= MAX_SECRET_BYTES) {
+        const read = readSync(fd, buffer, length, buffer.length - length, null);
+        if (read === 0) break;
+        length += read;
+      }
+      if (length > MAX_SECRET_BYTES) failure = true;
+      else {
+        value = decodeSecret(buffer.subarray(0, length));
+        if (value === void 0) failure = true;
+      }
+    }
+  } catch {
+    failure = true;
+  } finally {
+    if (fd !== void 0) try {
+      closeSync(fd);
+    } catch {
+      failure = true;
+    }
+  }
+  if (failure || value === void 0) invalid(variable);
+  return value;
+}
+function resolveConfigFileSecrets(env) {
+  const values = {};
+  for (const [variable, fileVariable] of SECRET_PAIRS) {
+    if (env[variable] !== void 0 && env[fileVariable] !== void 0) {
+      invalid(fileVariable, `${variable} and ${fileVariable} cannot both be set`);
+    }
+    if (env[fileVariable] !== void 0)
+      values[variable] = readConfigFileSecret(fileVariable, env[fileVariable]);
+  }
+  return Object.freeze(values);
+}
+
+// src/server/config/loadConfig.ts
 var THIRTY_DAYS_SECONDS = 60 * 60 * 24 * 30;
 var SIXTEEN_MB = 16 * 1024 * 1024;
 var INSECURE_PLACEHOLDER_SECRET = "0000000000000000000000000000000000000000000000000000000000000000";
@@ -146,6 +240,30 @@ function parseRateLimitOverrides(raw) {
     ]);
   }
 }
+function parseTrustedProxyPolicy(env) {
+  const cidrs = env.TRUST_PROXY_CIDRS;
+  const hops = env.TRUST_PROXY_HOPS;
+  const legacy = env.TRUST_PROXY_LEGACY_UNSAFE;
+  if (legacy !== void 0 && legacy !== "1") {
+    throw new ConfigValidationError([{ message: "TRUST_PROXY_LEGACY_UNSAFE must be exactly 1", path: ["security", "trustedProxy"] }]);
+  }
+  if (legacy === "1") {
+    if (env.BORING_D1_HOST_ID !== void 0 || cidrs !== void 0 || hops !== void 0) {
+      throw new ConfigValidationError([{ message: "Legacy proxy trust cannot be combined with D1 or an exact policy", path: ["security", "trustedProxy"] }]);
+    }
+    return "legacy-unsafe";
+  }
+  if (cidrs === void 0 && hops === void 0) {
+    if (env.BORING_D1_HOST_ID !== void 0) {
+      throw new ConfigValidationError([{ message: "D1 requires an explicit trusted proxy policy", path: ["security", "trustedProxy"] }]);
+    }
+    return void 0;
+  }
+  return {
+    cidrs: (cidrs ?? "").split(",").map((value) => value.trim()),
+    hops: hops !== void 0 && /^[1-8]$/.test(hops) ? Number(hops) : Number.NaN
+  };
+}
 async function loadConfig(options) {
   const env = options?.env ?? process.env;
   const tomlPath = resolve(options?.tomlPath ?? "./boring.app.toml");
@@ -158,6 +276,7 @@ async function loadConfig(options) {
       }
     ]);
   }
+  const fileSecrets = resolveConfigFileSecrets(env);
   let toml = {};
   if (existsSync(tomlPath)) {
     const raw2 = readFileSync(tomlPath, "utf-8");
@@ -168,9 +287,9 @@ async function loadConfig(options) {
   const appLogo = toml.frontend?.branding?.logo ?? null;
   const storesRaw = env.CORE_STORES ?? "postgres";
   const stores = storesRaw === "local" ? "local" : "postgres";
-  let databaseUrl = env.DATABASE_URL ?? null;
-  let authSecret = env.BETTER_AUTH_SECRET ?? "";
-  let encryptionKey = env.WORKSPACE_SETTINGS_ENCRYPTION_KEY ?? "";
+  let databaseUrl = fileSecrets.DATABASE_URL ?? env.DATABASE_URL ?? null;
+  let authSecret = fileSecrets.BETTER_AUTH_SECRET ?? env.BETTER_AUTH_SECRET ?? "";
+  let encryptionKey = fileSecrets.WORKSPACE_SETTINGS_ENCRYPTION_KEY ?? env.WORKSPACE_SETTINGS_ENCRYPTION_KEY ?? "";
   const insecureDefaults = [];
   if (allowMissingSecrets) {
     if (!databaseUrl) {
@@ -231,7 +350,8 @@ async function loadConfig(options) {
       csp: {
         enabled: cspEnabled,
         upgradeInsecureRequests: cspUpgradeInsecureRequests
-      }
+      },
+      trustedProxy: parseTrustedProxyPolicy(env)
     },
     encryption: {
       workspaceSettingsKey: encryptionKey
@@ -304,6 +424,7 @@ function buildRuntimeConfigPayload(config) {
 import Fastify from "fastify";
 import cors from "@fastify/cors";
 import helmet from "@fastify/helmet";
+import proxyAddr2 from "@fastify/proxy-addr";
 import { randomBytes, randomUUID } from "crypto";
 
 // src/server/app/errorHandler.ts
@@ -378,9 +499,9 @@ function extractFirstValidationMessage(error) {
   const err = error;
   if (err.validation && err.validation.length > 0) {
     const first = err.validation[0];
-    const path = first.instancePath ?? "";
+    const path2 = first.instancePath ?? "";
     const msg = first.message ?? first.params?.issue ?? "Invalid value";
-    return path ? `${path}: ${msg}` : msg;
+    return path2 ? `${path2}: ${msg}` : msg;
   }
   return error.message || "Validation failed";
 }
@@ -689,8 +810,11 @@ function installShutdownHandlers(app) {
 }
 async function createCoreApp(config, options) {
   const redactionKeywords = [...DEFAULT_REDACTION_KEYWORDS];
+  const proxyPolicy = config.security?.trustedProxy;
+  const trustedProxy = proxyPolicy && proxyPolicy !== "legacy-unsafe" ? { hops: proxyPolicy.hops, matches: proxyAddr2.compile([...proxyPolicy.cidrs]) } : null;
   const app = Fastify({
-    trustProxy: true,
+    // Temporary compatibility is deliberately impossible to enable by omission.
+    trustProxy: proxyPolicy === "legacy-unsafe" ? true : trustedProxy ? (address, index) => index < trustedProxy.hops && trustedProxy.matches(address, index) : false,
     bodyLimit: config.bodyLimit,
     genReqId: (req) => {
       const incoming = req.headers["x-request-id"];
@@ -783,6 +907,32 @@ async function createCoreApp(config, options) {
     } : false
   });
   registerErrorHandler(app);
+  if (options?.requestScopeResolver) {
+    const resolveRequestScope = options.requestScopeResolver;
+    app.decorateRequest("requestScope");
+    app.addHook("onRequest", async (request) => {
+      let scope;
+      try {
+        scope = await resolveRequestScope(request);
+      } catch (error) {
+        if (typeof error === "object" && error !== null && "code" in error && error.code === ERROR_CODES.D1_HOST_SCOPE_VIOLATION) {
+          throw new HttpError({
+            status: 421,
+            code: ERROR_CODES.D1_HOST_SCOPE_VIOLATION,
+            message: ERROR_CODES.D1_HOST_SCOPE_VIOLATION
+          });
+        }
+        throw error;
+      }
+      if (scope === void 0) return;
+      request.requestScope = Object.freeze({
+        bindingId: scope.bindingId,
+        workspaceId: scope.workspaceId,
+        defaultDeploymentId: scope.defaultDeploymentId,
+        activeRevision: scope.activeRevision
+      });
+    });
+  }
   registerCapabilities(app);
   await registerRateLimits(app);
   const manageShutdown = options?.manageShutdown ?? true;
@@ -817,10 +967,18 @@ import { z as z2 } from "zod";
 // src/server/auth/deleteUserCompletely.ts
 import { and, eq, isNotNull, isNull, sql } from "drizzle-orm";
 var RETRYABLE_TX_ERROR_CODES = /* @__PURE__ */ new Set(["40001", "40P01"]);
+var MEMBERSHIP_USER_FK = "workspace_members_user_id_users_id_fk";
 var SERIALIZATION_RETRY_LIMIT = 5;
 var BASE_RETRY_DELAY_MS = 25;
-function isRetryableTxFailure(error) {
-  return typeof error === "object" && error !== null && "code" in error && RETRYABLE_TX_ERROR_CODES.has(String(error.code));
+function isRetryableTxFailure(error, retryMembershipUserFk) {
+  let candidate = error;
+  for (let depth = 0; depth < 4 && typeof candidate === "object" && candidate !== null; depth += 1) {
+    const details = candidate;
+    if (RETRYABLE_TX_ERROR_CODES.has(String(details.code))) return true;
+    if (retryMembershipUserFk && details.code === "23503" && details.constraint_name === MEMBERSHIP_USER_FK) return true;
+    candidate = details.cause;
+  }
+  return false;
 }
 function sleep(ms) {
   return new Promise((resolve3) => setTimeout(resolve3, ms));
@@ -830,6 +988,25 @@ async function deleteUserCompletely(userId, deps) {
     try {
       await deps.db.transaction(async (tx) => {
         await tx.execute(sql`SET TRANSACTION ISOLATION LEVEL SERIALIZABLE`);
+        let protectedUser;
+        if (deps.protectedWorkspaceId) {
+          const [lockedUser] = await tx.select({ email: users.email }).from(users).where(eq(users.id, userId)).limit(1).for("update");
+          protectedUser = lockedUser;
+          await tx.execute(sql`
+            SELECT user_id FROM workspace_members
+            WHERE workspace_id = ${deps.protectedWorkspaceId} AND user_id = ${userId}
+            FOR UPDATE
+          `);
+          const [membership] = await tx.select({ role: workspaceMembers.role }).from(workspaceMembers).where(and(
+            eq(workspaceMembers.workspaceId, deps.protectedWorkspaceId),
+            eq(workspaceMembers.userId, userId)
+          )).limit(1);
+          if (membership?.role === "owner") throw new HttpError({
+            status: 403,
+            code: ERROR_CODES.D1_MANAGED_WORKSPACE_MUTATION_FORBIDDEN,
+            message: ERROR_CODES.D1_MANAGED_WORKSPACE_MUTATION_FORBIDDEN
+          });
+        }
         const ownerWorkspaces = await tx.select({ id: workspaces.id }).from(workspaces).innerJoin(
           workspaceMembers,
           and(
@@ -924,7 +1101,7 @@ async function deleteUserCompletely(userId, deps) {
           await tx.delete(workspaceMembers).where(eq(workspaceMembers.workspaceId, workspace.id));
           await tx.delete(workspaces).where(eq(workspaces.id, workspace.id));
         }
-        const [userRow] = await tx.select({ email: users.email }).from(users).where(eq(users.id, userId)).limit(1);
+        const userRow = protectedUser ?? (await tx.select({ email: users.email }).from(users).where(eq(users.id, userId)).limit(1))[0];
         if (userRow?.email) {
           await tx.delete(verification_tokens).where(eq(verification_tokens.identifier, userRow.email));
         }
@@ -937,7 +1114,7 @@ async function deleteUserCompletely(userId, deps) {
       });
       return;
     } catch (error) {
-      if (attempt < SERIALIZATION_RETRY_LIMIT && isRetryableTxFailure(error)) {
+      if (attempt < SERIALIZATION_RETRY_LIMIT && isRetryableTxFailure(error, Boolean(deps.protectedWorkspaceId))) {
         await sleep(BASE_RETRY_DELAY_MS * attempt);
         continue;
       }
@@ -1084,7 +1261,7 @@ var routesPlugin = async (app, opts) => {
       { event: "user.delete.start", userId: user.id },
       "user.delete.start"
     );
-    await deleteUserCompletely(user.id, { db });
+    await deleteUserCompletely(user.id, { db, protectedWorkspaceId: request.requestScope?.workspaceId });
     const signOutResponse = await app.auth.api.signOut({
       headers: toHeaders(request.headers),
       asResponse: true
@@ -1282,8 +1459,8 @@ var ConsoleCaptureTransport = class {
     };
     console.info("[mail:console-capture]", JSON.stringify(logEntry));
     const { appendFileSync } = await import("fs");
-    const path = this.outputPath ?? `/tmp/test-mail-${process.pid}.log`;
-    appendFileSync(path, JSON.stringify(logEntry) + "\n");
+    const path2 = this.outputPath ?? `/tmp/test-mail-${process.pid}.log`;
+    appendFileSync(path2, JSON.stringify(logEntry) + "\n");
     return { id };
   }
 };
@@ -1708,6 +1885,55 @@ async function renderWelcome(data) {
 
 // src/server/auth/postSignupHook.ts
 import { createHash } from "crypto";
+
+// src/server/auth/requestWorkspaceScope.ts
+var ROLE_LEVELS = {
+  viewer: 0,
+  editor: 1,
+  owner: 2
+};
+var REQUEST_SCOPE_WORKSPACE_HEADER = "x-boring-internal-request-workspace";
+async function authorizeRequestScopedWorkspace(request, workspaceId, minimumRole) {
+  const scope = request.requestScope;
+  if (!scope) return null;
+  if (workspaceId !== scope.workspaceId) {
+    throw new HttpError({
+      status: 421,
+      code: ERROR_CODES.D1_HOST_SCOPE_VIOLATION,
+      message: ERROR_CODES.D1_HOST_SCOPE_VIOLATION,
+      requestId: request.id
+    });
+  }
+  const role = await request.server.workspaceStore.getMemberRole(scope.workspaceId, request.user.id);
+  if (!role) {
+    throw new HttpError({
+      status: 403,
+      code: ERROR_CODES.NOT_MEMBER,
+      message: "Not a member of this workspace",
+      requestId: request.id
+    });
+  }
+  if (minimumRole && ROLE_LEVELS[role] < ROLE_LEVELS[minimumRole]) {
+    throw new HttpError({
+      status: 403,
+      code: ERROR_CODES.FORBIDDEN,
+      message: `Requires ${minimumRole} role or higher`,
+      requestId: request.id
+    });
+  }
+  const workspace = await request.server.workspaceStore.get(scope.workspaceId);
+  if (!workspace || workspace.appId !== request.server.config.appId) {
+    throw new HttpError({
+      status: 421,
+      code: ERROR_CODES.D1_HOST_SCOPE_VIOLATION,
+      message: ERROR_CODES.D1_HOST_SCOPE_VIOLATION,
+      requestId: request.id
+    });
+  }
+  return workspace;
+}
+
+// src/server/auth/postSignupHook.ts
 function readHeader(ctx, name) {
   if (!ctx) return null;
   const fromGetHeader = ctx.getHeader?.(name);
@@ -1716,15 +1942,26 @@ function readHeader(ctx, name) {
   const req = ctxAny.request;
   return req?.headers?.get?.(name) ?? null;
 }
+function readRequestWorkspaceId(ctx) {
+  const encoded = readHeader(ctx, REQUEST_SCOPE_WORKSPACE_HEADER);
+  if (!encoded) return null;
+  try {
+    const decoded = decodeURIComponent(encoded);
+    return decoded && encodeURIComponent(decoded) === encoded ? decoded : null;
+  } catch {
+    return null;
+  }
+}
 function createPostSignupHook(deps) {
-  const { config, workspaceStore, transport, logger } = deps;
+  const { config, workspaceStore, transport, logger, disableDefaultWorkspaceCreation } = deps;
   return async function postSignupHook(user, rawCtx) {
     const ctx = rawCtx;
     const inviteToken = readHeader(ctx, "x-invite-token");
+    const requestWorkspaceId = disableDefaultWorkspaceCreation ? readRequestWorkspaceId(ctx) : null;
     let inviteAccepted = false;
     if (inviteToken) {
       try {
-        const failureCode = await tryAcceptInvite(user, inviteToken);
+        const failureCode = await tryAcceptInvite(user, inviteToken, requestWorkspaceId);
         if (failureCode) {
           logger?.warn(
             { userId: user.id, email: user.email, code: failureCode },
@@ -1746,7 +1983,7 @@ function createPostSignupHook(deps) {
         );
       }
     }
-    if (!inviteAccepted) {
+    if (!inviteAccepted && !disableDefaultWorkspaceCreation) {
       await workspaceStore.create(user.id, "Default workspace", config.appId, { isDefault: true });
     }
     if (!inviteAccepted && config.features.sendWelcomeEmail !== false && transport) {
@@ -1766,10 +2003,11 @@ function createPostSignupHook(deps) {
       }
     }
   };
-  async function tryAcceptInvite(user, rawToken) {
+  async function tryAcceptInvite(user, rawToken, requestWorkspaceId) {
     const tokenHash = createHash("sha256").update(rawToken).digest("hex");
     const invite = await workspaceStore.getInviteByTokenHash(tokenHash);
     if (!invite) return "invite_not_found";
+    if (disableDefaultWorkspaceCreation && invite.workspaceId !== requestWorkspaceId) return "invite_not_found";
     if (invite.lockedUntil && new Date(invite.lockedUntil) > /* @__PURE__ */ new Date()) return "invite_not_found";
     if (invite.acceptedAt) return "invite_already_accepted";
     if (new Date(invite.expiresAt) <= /* @__PURE__ */ new Date()) return "invite_expired";
@@ -1880,7 +2118,8 @@ function createAuth(config, db, opts) {
     config,
     workspaceStore: opts.workspaceStore,
     transport,
-    logger: opts.logger
+    logger: opts.logger,
+    disableDefaultWorkspaceCreation: opts.disableDefaultWorkspaceCreation
   }) : void 0;
   const socialProviders = {
     ...config.auth.github ? {
@@ -2036,8 +2275,8 @@ var authHookPlugin = async (app, opts) => {
         request.user = null;
       }
     }
-    const path = request.url.split("?")[0];
-    const isProtectedApi = path.startsWith("/api/v1/") && !publicPatterns.some((re) => re.test(path));
+    const path2 = request.url.split("?")[0];
+    const isProtectedApi = path2.startsWith("/api/v1/") && !publicPatterns.some((re) => re.test(path2));
     if (isProtectedApi && !request.user) {
       throw new HttpError({
         status: 401,
@@ -2059,7 +2298,7 @@ var authHookPlugin = async (app, opts) => {
 var authHook = fp2(authHookPlugin, { name: "auth-hook" });
 
 // src/server/auth/requireWorkspaceMember.ts
-var ROLE_LEVELS = {
+var ROLE_LEVELS2 = {
   viewer: 0,
   editor: 1,
   owner: 2
@@ -2079,6 +2318,7 @@ function requireWorkspaceMember(minimumRole) {
         "requireWorkspaceMember: missing :id param \u2014 route must include :id"
       );
     }
+    if (await authorizeRequestScopedWorkspace(request, workspaceId, minimumRole) !== null) return;
     if (!WORKSPACE_ID_RE.test(workspaceId)) {
       throw new HttpError({
         status: 400,
@@ -2108,7 +2348,7 @@ function requireWorkspaceMember(minimumRole) {
         requestId: request.id
       });
     }
-    if (minimumRole && ROLE_LEVELS[role] < ROLE_LEVELS[minimumRole]) {
+    if (minimumRole && ROLE_LEVELS2[role] < ROLE_LEVELS2[minimumRole]) {
       throw new HttpError({
         status: 403,
         code: ERROR_CODES.FORBIDDEN,
@@ -2207,6 +2447,14 @@ var workspaceRoutesPlugin = async (app) => {
     }
   }
   app.post("/api/v1/workspaces", async (request, reply) => {
+    if (request.requestScope) {
+      throw new HttpError({
+        status: 403,
+        code: ERROR_CODES.D1_MANAGED_WORKSPACE_MUTATION_FORBIDDEN,
+        message: ERROR_CODES.D1_MANAGED_WORKSPACE_MUTATION_FORBIDDEN,
+        requestId: request.id
+      });
+    }
     const parsed = createWorkspaceBody.safeParse(request.body);
     if (!parsed.success) {
       throw new HttpError({
@@ -2225,6 +2473,8 @@ var workspaceRoutesPlugin = async (app) => {
     return { workspace, role: "owner" };
   });
   app.get("/api/v1/workspaces", async (request) => {
+    const requestScopedWorkspace = await authorizeRequestScopedWorkspace(request, request.requestScope?.workspaceId);
+    if (requestScopedWorkspace) return { workspaces: [requestScopedWorkspace] };
     const workspaces2 = await listOrCreateDefaultWorkspace(request.user.id, request);
     return { workspaces: workspaces2 };
   });
@@ -2286,6 +2536,14 @@ var workspaceRoutesPlugin = async (app) => {
     { preHandler: requireWorkspaceMember("owner") },
     async (request) => {
       const { id } = request.params;
+      if (request.requestScope) {
+        throw new HttpError({
+          status: 403,
+          code: ERROR_CODES.D1_MANAGED_WORKSPACE_MUTATION_FORBIDDEN,
+          message: ERROR_CODES.D1_MANAGED_WORKSPACE_MUTATION_FORBIDDEN,
+          requestId: request.id
+        });
+      }
       request.log.info({ workspaceId: id }, "workspace.delete.start");
       const workspace = await store.get(id);
       if (!workspace) {
@@ -2378,8 +2636,9 @@ var memberRoutesPlugin = async (app) => {
           requestId: request.id
         });
       }
-      const existing = await store.getMemberRole(id, parsed.data.userId);
-      if (existing) {
+      const existing = request.requestScope ? null : await store.getMemberRole(id, parsed.data.userId);
+      const member = request.requestScope ? await store.createMemberIfAbsent(id, parsed.data.userId, parsed.data.role) : existing ? null : await store.upsertMember(id, parsed.data.userId, parsed.data.role);
+      if (!member) {
         throw new HttpError({
           status: 409,
           code: ERROR_CODES.VALIDATION_FAILED,
@@ -2387,7 +2646,6 @@ var memberRoutesPlugin = async (app) => {
           requestId: request.id
         });
       }
-      const member = await store.upsertMember(id, parsed.data.userId, parsed.data.role);
       reply.status(201);
       return { member };
     }
@@ -2406,7 +2664,7 @@ var memberRoutesPlugin = async (app) => {
           requestId: request.id
         });
       }
-      const result = await store.updateMemberRole(id, userId, parsed.data.role);
+      const result = await store.updateMemberRole(id, userId, parsed.data.role, request.requestScope ? { forbidExistingOwnerMutation: true } : void 0);
       if (result.member) {
         return { member: result.member };
       }
@@ -2426,6 +2684,14 @@ var memberRoutesPlugin = async (app) => {
           requestId: request.id
         });
       }
+      if (result.code === ERROR_CODES.D1_MANAGED_WORKSPACE_MUTATION_FORBIDDEN) {
+        throw new HttpError({
+          status: 403,
+          code: result.code,
+          message: result.code,
+          requestId: request.id
+        });
+      }
       throw new HttpError({
         status: 500,
         code: ERROR_CODES.INTERNAL_ERROR,
@@ -2451,7 +2717,7 @@ var memberRoutesPlugin = async (app) => {
           });
         }
       }
-      const result = await store.removeMember(id, userId);
+      const result = await store.removeMember(id, userId, request.requestScope ? { forbidExistingOwnerMutation: true } : void 0);
       if (result.removed) {
         return { removed: true };
       }
@@ -2471,6 +2737,14 @@ var memberRoutesPlugin = async (app) => {
           requestId: request.id
         });
       }
+      if (result.code === ERROR_CODES.D1_MANAGED_WORKSPACE_MUTATION_FORBIDDEN) {
+        throw new HttpError({
+          status: 403,
+          code: result.code,
+          message: result.code,
+          requestId: request.id
+        });
+      }
       throw new HttpError({
         status: 500,
         code: ERROR_CODES.INTERNAL_ERROR,
@@ -2648,6 +2922,14 @@ var inviteRoutesPlugin = async (app, opts) => {
           requestId: request.id
         });
       }
+      if (request.requestScope && id !== request.requestScope.workspaceId) {
+        throw new HttpError({
+          status: 421,
+          code: ERROR_CODES.D1_HOST_SCOPE_VIOLATION,
+          message: ERROR_CODES.D1_HOST_SCOPE_VIOLATION,
+          requestId: request.id
+        });
+      }
       const parsed = acceptInviteQuery.safeParse(request.query);
       if (!parsed.success) {
         throw new HttpError({
@@ -2738,7 +3020,7 @@ var inviteRoutesPlugin = async (app, opts) => {
     }
     const tokenHash = createHash2("sha256").update(parsed.data.token).digest("hex");
     const invite = await store.getInviteByTokenHash(tokenHash);
-    if (!invite) {
+    if (!invite || request.requestScope && invite.workspaceId !== request.requestScope.workspaceId) {
       throw new HttpError({
         status: 404,
         code: ERROR_CODES.INVITE_NOT_FOUND,
@@ -2791,7 +3073,7 @@ var inviteRoutesPlugin = async (app, opts) => {
     }
     const tokenHash = createHash2("sha256").update(parsed.data.token).digest("hex");
     const invite = await store.getInviteByTokenHash(tokenHash);
-    if (!invite) {
+    if (!invite || request.requestScope && invite.workspaceId !== request.requestScope.workspaceId) {
       throw new HttpError({
         status: 404,
         code: ERROR_CODES.INVITE_NOT_FOUND,
@@ -3039,6 +3321,7 @@ export {
   renderMagicLink,
   renderWorkspaceInvite,
   renderWelcome,
+  REQUEST_SCOPE_WORKSPACE_HEADER,
   createPostSignupHook,
   validatePasswordStrength,
   createAuth,

package/dist/front/index.d.ts

@@ -1,6 +1,6 @@
 import * as react from 'react';
 import { Component, ReactNode, ErrorInfo } from 'react';
-import { R as RuntimeConfig, a as CapabilitiesResponse, W as WorkspaceMember, U as User, b as Workspace, M as MemberRole, S as SessionState } from '../types-DDnayJjI.js';
+import { R as RuntimeConfig, a as CapabilitiesResponse, W as WorkspaceMember, U as User, b as Workspace, M as MemberRole, S as SessionState } from '../types-Di-eoc58.js';
 export { b as CompanyAdminLabels, c as CompanyAdminProvider, d as CompanyAdminProviderProps, e as CompanyAdminStatus, f as CoreFront, C as CoreFrontAuthPagesOverride, a as CoreFrontCompanyAdminOptions, g as CoreFrontProps, L as LoadCompanyAdminStatus, R as RenderCompanyAdminContent, u as useCompanyAdminStatus } from '../CoreFront-DB1OfNJU.js';
 import * as _tanstack_react_query from '@tanstack/react-query';
 import * as better_auth_react from 'better-auth/react';

package/dist/front/index.js

@@ -62,13 +62,13 @@ import {
   useWorkspaceMembers,
   useWorkspaceRole,
   useWorkspaceRouteStatus
-} from "../chunk-3B7LU76T.js";
+} from "../chunk-DGBJFPUK.js";
 import {
   TopBarSlotProvider,
   useTopBarSlot
 } from "../chunk-HYNKZSTF.js";
 import "../chunk-I4PGL4ZD.js";
-import "../chunk-QZGYKLXB.js";
+import "../chunk-H7EYII35.js";
 import "../chunk-MLKGABMK.js";
 export {
   AppErrorBoundary,

package/dist/{loadConfig-C3iHuZNw.d.ts → loadConfig-CuRGCFmt.d.ts}

@@ -1,7 +1,7 @@
 import { FastifyPluginAsync } from 'fastify';
 import { Auth } from 'better-auth';
-import { C as CoreConfig, R as RuntimeConfig } from './types-DDnayJjI.js';
-import { W as WorkspaceStore, D as Database } from './types-Dm11Zm56.js';
+import { C as CoreConfig, R as RuntimeConfig } from './types-Di-eoc58.js';
+import { W as WorkspaceStore, D as Database } from './types-CHdS89JJ.js';
 import { T as TelemetrySink } from './telemetry-DR18MeI0.js';
 
 declare function validatePasswordStrength(password: string): {
@@ -15,6 +15,7 @@ interface CreateAuthOptions {
     };
     /** Telemetry sink for auth.signed_up / auth.session_started (defaults to noop). */
     telemetry?: TelemetrySink;
+    disableDefaultWorkspaceCreation?: boolean;
 }
 declare function createAuth(config: CoreConfig, db: Database, opts?: CreateAuthOptions): Auth<any>;
 type BetterAuthInstance = Auth<any>;