@lobb-js/lobb-ext-auth 0.13.0 → 0.14.1

package/dist/auth.js

@@ -17,7 +17,7 @@ export class Auth {
     async login(payload) {
         const response = await this.utils.lobb.request({
             method: "POST",
-            route: "/api/collections/auth_sessions",
+            route: "/api/actions/auth_login",
             payload: {
                 data: payload,
             },
@@ -41,8 +41,8 @@ export class Auth {
     }
     async logout() {
         await this.utils.lobb.request({
-            method: "DELETE",
-            route: "/api/extensions/auth/logout",
+            method: "POST",
+            route: "/api/actions/auth_logout",
         });
         localStorage.removeItem("lobb_session");
         const currentPath = window.location.pathname;

package/dist/index.js

@@ -19,36 +19,36 @@ export default function extension(utils) {
             {
                 // Generic auth primitive: callers ask "can the current user access X?"
                 // and pass any combination of { collection, action, role }. The handler
-                // returns a boolean directly; callers read that and decide what to render.
-                // Note: returning a boolean means downstream handlers can't read the
-                // original request — if you ever need multiple extensions to influence
-                // this decision, switch back to a `{ ...input, allowed }` object shape.
+                // takes over with a boolean (`ctx.takeOver(bool)`); callers read that
+                // and decide what to render. A take-over is required because the
+                // dispatch ignores plain returns — a bare `return false` would be
+                // dropped and the caller would default to allow.
                 eventName: "auth.canAccess",
-                handler: async (input) => {
+                handler: async (input, ctx) => {
                     // Admin shortcut — admins bypass everything, regardless of how
                     // their permissions snapshot was populated.
                     const user = utils.ctx.extensions.auth?.user;
                     if (user?.role === "admin")
-                        return true;
+                        return ctx.takeOver(true);
                     // Walk the permissions snapshot. Works for both logged-in non-admin
                     // users (snapshot from their role) and share-token recipients
                     // (snapshot from the share's embedded permissions). If nothing
                     // is populated — anonymous viewer — default to deny.
                     const permissions = utils.ctx.extensions.auth?.permissions;
                     if (permissions === undefined || permissions === null)
-                        return false;
+                        return ctx.takeOver(false);
                     if (permissions === true)
-                        return true;
+                        return ctx.takeOver(true);
                     const action = input.action ?? "read";
                     const requiredCollections = Array.isArray(input.collection)
                         ? input.collection
                         : input.collection ? [input.collection] : [];
                     for (const collectionName of requiredCollections) {
                         if (!isActionAllowed(collectionName, action, permissions)) {
-                            return false;
+                            return ctx.takeOver(false);
                         }
                     }
-                    return true;
+                    return ctx.takeOver(true);
                 },
             },
         ],

package/extensions/auth/database/init.ts

@@ -12,7 +12,7 @@ async function syncincAdminUserInDB(lobb: Lobb, extensionConfig: ExtensionConfig
   // syncinc the admin user in users collection
   const config = extensionConfig;
   const { email, password, ...extraFields } = config.admin;
-  const entries = (await lobb.collectionService.findAll({
+  const entries = (await lobb.collectionStore.findAll({
     collectionName: "auth_users",
     params: {
       filter: {
@@ -23,7 +23,7 @@ async function syncincAdminUserInDB(lobb: Lobb, extensionConfig: ExtensionConfig
   })).data;
   const adminUser = entries[0];
   if (!adminUser) {
-    await lobb.collectionService.createOne({
+    await lobb.collectionStore.createOne({
       collectionName: "auth_users",
       data: {
         ...extraFields,
@@ -39,7 +39,7 @@ async function syncincAdminUserInDB(lobb: Lobb, extensionConfig: ExtensionConfig
     );
 
     if (adminUser.email !== email || !passwordIdentical) {
-      await lobb.collectionService.updateOne({
+      await lobb.collectionStore.updateOne({
         collectionName: "auth_users",
         id: adminUser.id,
         data: {

package/extensions/auth/index.ts

@@ -5,12 +5,14 @@ import { collections } from "./collections/collections.ts";
 import { meta } from "./meta/meta.ts";
 import { migrations } from "./database/migrations.ts";
 import { getWorkflows } from "./workflows/index.ts";
+import { getAuthActions } from "./workflows/actions.ts";
 
 export default function auth(extensionConfig: ExtensionConfig): Extension {
   return {
     name: "auth",
     icon: "Key",
     collections: (lobb) => collections(lobb, extensionConfig),
+    actions: getAuthActions(extensionConfig),
     migrations: migrations,
     meta: (lobb) => meta(lobb, extensionConfig),
     workflows: getWorkflows(extensionConfig),

package/extensions/auth/openapi.ts

@@ -35,7 +35,7 @@ export const openapi = {
     },
   },
   paths: {
-    "/api/extensions/auth/login": {
+    "/api/actions/auth_login": {
       post: {
         tags: [
           "auth",
@@ -223,8 +223,8 @@ export const openapi = {
         },
       },
     },
-    "/api/extensions/auth/logout": {
-      delete: {
+    "/api/actions/auth_logout": {
+      post: {
         tags: [
           "auth",
         ],

package/extensions/auth/studio/auth.ts

@@ -26,7 +26,7 @@ export class Auth {
   public async login(payload: LoginPayload) {
     const response = await this.utils.lobb.request({
       method: "POST",
-      route: "/api/collections/auth_sessions",
+      route: "/api/actions/auth_login",
       payload: {
         data: payload,
       },
@@ -55,8 +55,8 @@ export class Auth {
 
   public async logout() {
     await this.utils.lobb.request({
-      method: "DELETE",
-      route: "/api/extensions/auth/logout",
+      method: "POST",
+      route: "/api/actions/auth_logout",
     });
     localStorage.removeItem("lobb_session");
     const currentPath = window.location.pathname;

package/extensions/auth/studio/index.ts

@@ -22,24 +22,24 @@ export default function extension(utils: ExtensionUtils): Extension {
       {
         // Generic auth primitive: callers ask "can the current user access X?"
         // and pass any combination of { collection, action, role }. The handler
-        // returns a boolean directly; callers read that and decide what to render.
-        // Note: returning a boolean means downstream handlers can't read the
-        // original request — if you ever need multiple extensions to influence
-        // this decision, switch back to a `{ ...input, allowed }` object shape.
+        // takes over with a boolean (`ctx.takeOver(bool)`); callers read that
+        // and decide what to render. A take-over is required because the
+        // dispatch ignores plain returns — a bare `return false` would be
+        // dropped and the caller would default to allow.
         eventName: "auth.canAccess",
-        handler: async (input) => {
+        handler: async (input, ctx) => {
           // Admin shortcut — admins bypass everything, regardless of how
           // their permissions snapshot was populated.
           const user = utils.ctx.extensions.auth?.user;
-          if (user?.role === "admin") return true;
+          if (user?.role === "admin") return ctx.takeOver(true);
 
           // Walk the permissions snapshot. Works for both logged-in non-admin
           // users (snapshot from their role) and share-token recipients
           // (snapshot from the share's embedded permissions). If nothing
           // is populated — anonymous viewer — default to deny.
           const permissions = utils.ctx.extensions.auth?.permissions;
-          if (permissions === undefined || permissions === null) return false;
-          if (permissions === true) return true;
+          if (permissions === undefined || permissions === null) return ctx.takeOver(false);
+          if (permissions === true) return ctx.takeOver(true);
 
           const action: CollectionPermissionActionsKeys = input.action ?? "read";
 
@@ -49,11 +49,11 @@ export default function extension(utils: ExtensionUtils): Extension {
 
           for (const collectionName of requiredCollections) {
             if (!isActionAllowed(collectionName, action, permissions)) {
-              return false;
+              return ctx.takeOver(false);
             }
           }
 
-          return true;
+          return ctx.takeOver(true);
         },
       },
     ],

package/extensions/auth/workflows/actionController.ts

@@ -0,0 +1,35 @@
+import type { Workflow } from "@lobb-js/core";
+import type { Context } from "hono";
+import { getBearerToken } from "../utils.ts";
+
+// `auth_logout` needs the session token, which arrives as a bearer header. Read
+// it off the Hono context here and pass it to the action (keeping the action
+// pure + internally callable with an explicit token), then return 204.
+//
+// `auth_login` needs no HTTP adaptation — its JSON body { email, password } maps
+// straight to the default action flow.
+
+export function getAuthActionControllerWorkflows(): Workflow[] {
+  return [
+    {
+      name: "authLogoutActionController",
+      eventName: "core.actions.controller.override",
+      handler: async (input, ctx) => {
+        if (input.name === "auth_logout") {
+          const context = input.context as Context;
+          const token = getBearerToken(context);
+          if (!token) {
+            throw new ctx.LobbError({
+              code: "BAD_REQUEST",
+              message:
+                "You should pass session's token through the bearer header",
+            });
+          }
+
+          await ctx.lobb.runAction("auth_logout", { token });
+          return ctx.takeOver(context.body(null, 204));
+        }
+      },
+    },
+  ];
+}

package/extensions/auth/workflows/actions.ts

@@ -0,0 +1,89 @@
+import type { ActionsConfig } from "@lobb-js/core";
+import { LobbError } from "@lobb-js/core";
+import type { ExtensionConfig, User } from "../config/extensionConfigSchema.ts";
+import { generateRandomId } from "../utils.ts";
+import { verify } from "argon2";
+
+// Login and logout used to hijack the auth_sessions CRUD endpoints (create =
+// login, deleteMany = logout), which made it impossible to manage session rows
+// normally. They're now first-class actions; the auth_sessions collection is a
+// plain CRUD collection again.
+
+export function getAuthActions(_extensionConfig: ExtensionConfig): ActionsConfig {
+  return {
+    // POST /api/actions/auth_login  { data: { email, password } }
+    auth_login: {
+      handler: async (input: any, ctx) => {
+        const email = input.data?.email ?? input.email;
+        const password = input.data?.password ?? input.password;
+
+        const users = await ctx.lobb.collectionStore.findAll({
+          collectionName: "auth_users",
+          params: { filter: { email } },
+        });
+
+        if (!users.data.length) {
+          throw new LobbError({
+            code: "NOT_FOUND",
+            message: `The user with this email (${email}) doesnt exist.`,
+          });
+        }
+
+        const user = users.data[0] as User;
+
+        const passwordIsCorrect = await verify(user.password, password);
+        if (!passwordIsCorrect) {
+          throw new LobbError({
+            code: "UNAUTHORIZED",
+            message: "The password provided is incorrect. Please verify and try again.",
+          });
+        }
+
+        const sessionPayload = {
+          token: generateRandomId(),
+          expires_at: new Date(Date.now() + 3600 * 1000),
+          user_id: user.id,
+        };
+
+        const sessionResult = await ctx.lobb.collectionStore.createOne({
+          collectionName: "auth_sessions",
+          data: sessionPayload,
+        });
+
+        return {
+          data: {
+            access_token: {
+              token: sessionPayload.token,
+              expires_at: sessionResult.data.expires_at,
+            },
+            user: {
+              id: user.id,
+              email: user.email,
+              role: user.role,
+            },
+          },
+        };
+      },
+    },
+
+    // POST /api/actions/auth_logout  (bearer header → resolved to { token })
+    auth_logout: {
+      handler: async (input: any, ctx) => {
+        const token = input.token;
+        if (!token) {
+          throw new LobbError({
+            code: "BAD_REQUEST",
+            message: "You should pass session's token through the bearer header",
+          });
+        }
+
+        await ctx.lobb.collectionStore.deleteMany({
+          collectionName: "auth_sessions",
+          filter: { token },
+        });
+
+        return { success: true };
+      },
+    },
+  };
+}

package/extensions/auth/workflows/baseWorkflow.ts

@@ -1,18 +1,19 @@
 import type { Workflow } from "@lobb-js/core";
 import type { Context } from "hono";
-import type { ExtensionConfig, User } from "../config/extensionConfigSchema.ts";
-import { generateRandomId, getBearerToken } from "../utils.ts";
-import { verify } from "argon2";
+import type { ExtensionConfig } from "../config/extensionConfigSchema.ts";
+import { getBearerToken } from "../utils.ts";
 
 export function getBaseWorkflows(_extensionConfig: ExtensionConfig): Workflow[] {
   return [
   {
     name: "auth_preventAdminUserDeletion",
-    eventName: "core.service.preDeleteOne",
+    eventName: "core.store.preDeleteOne",
     handler: async (input, ctx) => {
-      if (input.collectionName !== "auth_users") return;
-
-      if (Number(input.id) === 1) {
+      if (
+        input.collectionName === "auth_users" &&
+        input.triggeredBy === "API" &&
+        Number(input.id) === 1
+      ) {
         throw new ctx.LobbError({
           code: "FORBIDDEN",
           message: "The admin user cannot be deleted.",
@@ -22,11 +23,13 @@ export function getBaseWorkflows(_extensionConfig: ExtensionConfig): Workflow[]
   },
   {
     name: "auth_preventAdminUserUpdate",
-    eventName: "core.service.preUpdateOne",
+    eventName: "core.store.preUpdateOne",
     handler: async (input, ctx) => {
-      if (input.collectionName !== "auth_users") return;
-
-      if (Number(input.id) === 1) {
+      if (
+        input.collectionName === "auth_users" &&
+        input.triggeredBy === "API" &&
+        Number(input.id) === 1
+      ) {
         throw new ctx.LobbError({
           code: "FORBIDDEN",
           message: "The admin user cannot be updated.",
@@ -48,167 +51,54 @@ export const baseWorkflows: Workflow[] = [
     eventName: "core.webserver.middlwares.pre",
     handler: async (input, ctx) => {
       const token = getBearerToken(input.context);
-      if (!token) return input;
-
-      const context = input.context as Context;
-
-      // 1) Try the token as a normal user session.
-      const sessionsResult = await ctx.workflows.collectionService({
-        method: "findAll",
-        props: {
-          collectionName: "auth_sessions",
-          params: { filter: { token } },
-        },
-      });
-      const session = sessionsResult.data[0];
+      if (token) {
+        const context = input.context as Context;
 
-      if (session) {
-        const usersResult = await ctx.workflows.collectionService({
+        // 1) Try the token as a normal user session.
+        const sessionsResult = await ctx.workflows.collectionStore({
           method: "findAll",
           props: {
-            collectionName: "auth_users",
-            params: { filter: { id: session.user_id } },
+            collectionName: "auth_sessions",
+            params: { filter: { token } },
           },
         });
-        const user = usersResult.data[0];
-
-        context.set("auth_session", session);
-        context.set("auth_user", user);
-        return input;
-      }
-
-      // 2) Otherwise try the token as a share. Shares carry their own
-      //    permissions snapshot and have a fixed expiry — no user identity.
-      const sharesResult = await ctx.workflows.collectionService({
-        method: "findAll",
-        props: {
-          collectionName: "auth_shares",
-          params: { filter: { token } },
-        },
-      });
-      const share = sharesResult.data[0];
-
-      if (share && new Date(share.expires_at) > new Date()) {
-        let permissions: any = {};
-        try {
-          permissions = JSON.parse(share.permissions ?? "{}");
-        } catch {
-          // malformed permissions — treat as no access
-          permissions = {};
-        }
-        context.set("auth_share", { ...share, permissions });
-      }
-
-      return input;
-    },
-  },
-  // auth_logins workflows
-  {
-    name: "auth_userLoginsHandler",
-    eventName: "core.controllers.preCreateOne",
-    handler: async (input, ctx) => {
-      if (input.collectionName === "auth_sessions") {
-        const payloadEmail = input.body.data.email;
-        const payloadPassword = input.body.data.password;
-
-        const users = await ctx.workflows.collectionService({
-          method: "findAll",
-          props: {
-            collectionName: "auth_users",
-            params: {
-              filter: {
-                email: payloadEmail,
-              },
+        const session = sessionsResult.data[0];
+
+        if (session) {
+          const usersResult = await ctx.workflows.collectionStore({
+            method: "findAll",
+            props: {
+              collectionName: "auth_users",
+              params: { filter: { id: session.user_id } },
             },
-          },
-        });
-
-        if (!users.data.length) {
-          throw new ctx.LobbError({
-            code: "NOT_FOUND",
-            message: `The user with this email (${payloadEmail}) doesnt exist.`,
-          });
-        }
-
-        const user = users.data[0] as User;
-        const hashedPassword = user.password;
-
-        const passwordIsCorrect = await verify(
-          hashedPassword,
-          payloadPassword,
-        );
-        if (!passwordIsCorrect) {
-          throw new ctx.LobbError({
-            code: "UNAUTHORIZED",
-            message:
-              "The password provided is incorrect. Please verify and try again.",
           });
-        }
-
-        const sessionPayload = {
-          token: generateRandomId(),
-          expires_at: new Date(Date.now() + 3600 * 1000),
-          user_id: user.id,
-        };
-
-        const sessionResult = await ctx.workflows.collectionService({
-          method: "createOne",
-          props: {
-            collectionName: "auth_sessions",
-            data: sessionPayload,
-          },
-        });
-
-        throw new Response(
-          JSON.stringify({
-            data: {
-              access_token: {
-                token: sessionPayload.token,
-                expires_at: sessionResult.data.expires_at,
-              },
-              user: {
-                id: user.id,
-                email: user.email,
-                role: user.role,
-              },
+          const user = usersResult.data[0];
+
+          context.set("auth_session", session);
+          context.set("auth_user", user);
+        } else {
+          // 2) Otherwise try the token as a share. Shares carry their own
+          //    permissions snapshot and have a fixed expiry — no user identity.
+          const sharesResult = await ctx.workflows.collectionStore({
+            method: "findAll",
+            props: {
+              collectionName: "auth_shares",
+              params: { filter: { token } },
             },
-          }),
-        );
-      }
-    },
-  },
-  {
-    name: "auth_userLogoutHandler",
-    eventName: "core.controllers.preDeleteMany",
-    handler: async (input, ctx) => {
-      if (input.collectionName === "auth_sessions") {
-        const context = input.context as Context;
-        const token = getBearerToken(context);
-
-        if (!token) {
-          throw new ctx.LobbError({
-            code: "BAD_REQUEST",
-            message:
-              "You should pass session's token through the bearer header",
           });
+          const share = sharesResult.data[0];
+
+          if (share && new Date(share.expires_at) > new Date()) {
+            let permissions: any = {};
+            try {
+              permissions = JSON.parse(share.permissions ?? "{}");
+            } catch {
+              // malformed permissions — treat as no access
+              permissions = {};
+            }
+            context.set("auth_share", { ...share, permissions });
+          }
         }
-
-        await ctx.workflows.collectionService({
-          method: "deleteMany",
-          props: {
-            collectionName: "auth_sessions",
-            filter: {
-              token: token,
-            },
-          },
-        });
-
-        throw new Response(
-          null,
-          {
-            status: 204,
-          },
-        );
       }
     },
   },

package/extensions/auth/workflows/currentUserPermissionsWorkflow.ts

@@ -15,18 +15,19 @@ export function getCurrentUserPermissionsWorkflow(
     name: "auth_attachCurrentUserPermissions",
     eventName: "core.controllers.findOne",
     handler: async (input) => {
-      if (input.collectionName !== "auth_users") return input;
       const context = input.context as Context | undefined;
-      if (context?.req.param("id") !== "me") return input;
-
-      const role = input.response?.data?.role;
-      // Strip functions (e.g. dynamic filter predicates) — they can't be
-      // serialised to the client.
-      const permissions = JSON.parse(JSON.stringify(
-        extensionConfig.roles?.[role]?.permissions ?? {},
-      ));
-      input.response = { ...input.response, permissions };
-      return input;
+      if (
+        input.collectionName === "auth_users" &&
+        context?.req.param("id") === "me"
+      ) {
+        const role = input.response?.data?.role;
+        // Strip functions (e.g. dynamic filter predicates) — they can't be
+        // serialised to the client.
+        const permissions = JSON.parse(JSON.stringify(
+          extensionConfig.roles?.[role]?.permissions ?? {},
+        ));
+        input.response = { ...input.response, permissions };
+      }
     },
   };
 }

package/extensions/auth/workflows/index.ts

@@ -5,6 +5,7 @@ import { meAliasWorkflows } from "./meAliasWorkflows.ts";
 import { getCurrentUserPermissionsWorkflow } from "./currentUserPermissionsWorkflow.ts";
 import { getBaseWorkflows } from "./baseWorkflow.ts";
 import { getSharesWorkflows } from "./sharesWorkflows.ts";
+import { getAuthActionControllerWorkflows } from "./actionController.ts";
 import { init } from "../database/init.ts";
 export function getWorkflows(extensionConfig: ExtensionConfig): Workflow[] {
   return [
@@ -17,6 +18,7 @@ export function getWorkflows(extensionConfig: ExtensionConfig): Workflow[] {
     },
     ...getBaseWorkflows(extensionConfig),
     ...getSharesWorkflows(extensionConfig),
+    ...getAuthActionControllerWorkflows(),
 
     // TODO: think about putting the below workflows above at the beggining
     // this will give us the ability to specify which roles have the ability to login, register etc

package/extensions/auth/workflows/meAliasWorkflows.ts

@@ -22,14 +22,15 @@ function resolveMeAlias(input: any, ctx: EventContext): number {
 
 export const meAliasWorkflows: Workflow[] = [
   {
-    name: "auth_userFindOneMeAlias",
-    eventName: "core.store.preFindOne",
+    // Share bearers don't have an auth_users row to fetch — take over the /me
+    // findOne at the controller boundary with the share's permissions snapshot.
+    // Studio uses the same /me endpoint to learn what the current bearer can do
+    // regardless of bearer type. Done at the controller level (not the store)
+    // so the HTTP response never originates from the data layer; the store-level
+    // resolveMeAlias below only runs for real users (where it resolves the id).
+    name: "auth_userFindOneMeShare",
+    eventName: "core.controllers.preFindOne",
     handler: async (input, ctx) => {
-      // Share bearers don't have an auth_users row to fetch — short-circuit
-      // the findOne with the share's permissions snapshot. Studio uses the
-      // same /me endpoint to learn what the current bearer can do regardless
-      // of bearer type. Falls through to resolveMeAlias otherwise (which
-      // handles the session case and throws for unauthenticated requests).
       if (input.collectionName === "auth_users" && input.id === "me") {
         const context = input.context as Context;
         const user = context.get("auth_user") as User | undefined;
@@ -38,7 +39,7 @@ export const meAliasWorkflows: Workflow[] = [
             | { permissions: any }
             | undefined;
           if (share) {
-            throw new Response(
+            return ctx.takeOver(new Response(
               JSON.stringify({
                 data: null,
                 permissions: share.permissions,
@@ -47,12 +48,17 @@ export const meAliasWorkflows: Workflow[] = [
                 status: 200,
                 headers: { "Content-Type": "application/json" },
               },
-            );
+            ));
           }
         }
       }
+    },
+  },
+  {
+    name: "auth_userFindOneMeAlias",
+    eventName: "core.store.preFindOne",
+    handler: async (input, ctx) => {
       input.id = resolveMeAlias(input, ctx);
-      return input;
     },
   },
   {
@@ -60,7 +66,6 @@ export const meAliasWorkflows: Workflow[] = [
     eventName: "core.store.preUpdateOne",
     handler: async (input, ctx) => {
       input.id = resolveMeAlias(input, ctx);
-      return input;
     },
   },
   {
@@ -68,7 +73,6 @@ export const meAliasWorkflows: Workflow[] = [
     eventName: "core.store.preDeleteOne",
     handler: async (input, ctx) => {
       input.id = resolveMeAlias(input, ctx);
-      return input;
     },
   },
 ];

package/extensions/auth/workflows/policiesWorkflows.ts

@@ -33,7 +33,6 @@ export function getPoliciesWorkflows(extensionConfig: ExtensionConfig): Workflow
         });
         if (output?.payload) input.data = output.payload;
       }
-      return input;
     },
   },
   {
@@ -60,7 +59,6 @@ export function getPoliciesWorkflows(extensionConfig: ExtensionConfig): Workflow
         });
         if (output?.filter) input.filter = output.filter;
       }
-      return input;
     },
   },
   {
@@ -88,7 +86,6 @@ export function getPoliciesWorkflows(extensionConfig: ExtensionConfig): Workflow
         });
         if (output?.payload) input.data = output.payload;
       }
-      return input;
     },
   },
   {
@@ -114,7 +111,6 @@ export function getPoliciesWorkflows(extensionConfig: ExtensionConfig): Workflow
           recordId: input.id,
         });
       }
-      return input;
     },
   },
   // Post-fetch field-level filtering using the role/share's `read.fields`
@@ -132,7 +128,6 @@ export function getPoliciesWorkflows(extensionConfig: ExtensionConfig): Workflow
         );
         input.data = handleReadFields(permissions, input.collectionName, input.data);
       }
-      return input;
     },
   },
   {
@@ -148,7 +143,6 @@ export function getPoliciesWorkflows(extensionConfig: ExtensionConfig): Workflow
         );
         input.data = handleReadFields(permissions, input.collectionName, input.data);
       }
-      return input;
     },
   },
   {
@@ -164,7 +158,6 @@ export function getPoliciesWorkflows(extensionConfig: ExtensionConfig): Workflow
         );
         input.data = handleReadFields(permissions, input.collectionName, input.data);
       }
-      return input;
     },
   },
   {
@@ -180,7 +173,6 @@ export function getPoliciesWorkflows(extensionConfig: ExtensionConfig): Workflow
         );
         input.data = handleReadFields(permissions, input.collectionName, input.data);
       }
-      return input;
     },
   },
   ];

package/extensions/auth/workflows/sharesWorkflows.ts

@@ -22,44 +22,42 @@ export function getSharesWorkflows(extensionConfig: ExtensionConfig): Workflow[]
         if (input.collectionName === "auth_shares") {
           input.data.token = generateRandomId();
         }
-        return input;
       },
     },
     // Normalize the two ways a caller can specify share lifetime into the
-    // single `expires_at` column the rest of the system uses. Runs at the
-    // service layer, which fires before the store-level required-field
-    // check — so `expires_at` can stay schema-required while still letting
-    // callers send only `expires_in_seconds`. Keeps an explicit "neither
-    // provided" throw for a friendlier error message than the generic
-    // required-field error.
+    // single `expires_at` column the rest of the system uses. `order: "pre"`
+    // makes it run before the unordered subscribers of preCreateOne — crucially
+    // before the required-field check — so `expires_at` can stay schema-required
+    // while still letting callers send only `expires_in_seconds`. Keeps an
+    // explicit "neither provided" throw for a friendlier error message than the
+    // generic required-field error.
     {
       name: "auth_normalizeShareExpiry",
-      eventName: "core.service.preCreateOne",
+      eventName: "core.store.preCreateOne",
+      order: "pre",
       handler: async (input, ctx) => {
-        if (input.collectionName !== "auth_shares") return input;
+        if (input.collectionName === "auth_shares") {
+          const seconds = input.data.expires_in_seconds;
+          if (typeof seconds === "number") {
+            if (!Number.isFinite(seconds) || seconds <= 0) {
+              throw new ctx.LobbError({
+                code: "BAD_REQUEST",
+                message: "expires_in_seconds must be a positive number.",
+              });
+            }
+            input.data.expires_at = new Date(Date.now() + seconds * 1000)
+              .toISOString();
+            delete input.data.expires_in_seconds;
+          }
 
-        const seconds = input.data.expires_in_seconds;
-        if (typeof seconds === "number") {
-          if (!Number.isFinite(seconds) || seconds <= 0) {
+          if (!input.data.expires_at) {
             throw new ctx.LobbError({
               code: "BAD_REQUEST",
-              message: "expires_in_seconds must be a positive number.",
+              message:
+                "Must provide either expires_at or expires_in_seconds when creating a share.",
             });
           }
-          input.data.expires_at = new Date(Date.now() + seconds * 1000)
-            .toISOString();
-          delete input.data.expires_in_seconds;
-        }
-
-        if (!input.data.expires_at) {
-          throw new ctx.LobbError({
-            code: "BAD_REQUEST",
-            message:
-              "Must provide either expires_at or expires_in_seconds when creating a share.",
-          });
         }
-
-        return input;
       },
     },
     // Auto-set created_by from the authenticated request user so callers
@@ -70,52 +68,54 @@ export function getSharesWorkflows(extensionConfig: ExtensionConfig): Workflow[]
       name: "auth_setShareCreatedBy",
       eventName: "core.store.preCreateOne",
       handler: async (input) => {
-        if (input.collectionName !== "auth_shares") return input;
-        if (input.triggeredBy !== "API") return input;
-        const context = input.context as Context;
-        const user = context.get("auth_user") as User | undefined;
-        if (user) input.data.created_by = user.id;
-        return input;
+        if (
+          input.collectionName === "auth_shares" &&
+          input.triggeredBy === "API"
+        ) {
+          const context = input.context as Context;
+          const user = context.get("auth_user") as User | undefined;
+          if (user) input.data.created_by = user.id;
+        }
       },
     },
     // Intersection guard: a share's embedded permissions snapshot must be a
     // subset of the creator's own permissions. Without this, any user who can
     // create rows in auth_shares could mint a token that grants admin-level
     // access. Only runs for API-triggered creates — internal callers (server
-    // code, tests using collectionService directly) are trusted.
+    // code, tests using collectionStore directly) are trusted.
     {
       name: "auth_validateShareSubset",
       eventName: "core.store.preCreateOne",
       handler: async (input, ctx) => {
-        if (input.collectionName !== "auth_shares") return input;
-        if (input.triggeredBy !== "API") return input;
+        if (
+          input.collectionName === "auth_shares" &&
+          input.triggeredBy === "API"
+        ) {
+          const context = input.context as Context;
+          const { permissions: creatorPermissions } = resolveRequestPermissions(
+            context,
+            extensionConfig,
+            ctx,
+          );
 
-        const context = input.context as Context;
-        const { permissions: creatorPermissions } = resolveRequestPermissions(
-          context,
-          extensionConfig,
-          ctx,
-        );
-
-        let sharePermissions: PermissionsConfig;
-        try {
-          sharePermissions = JSON.parse(input.data.permissions);
-        } catch {
-          throw new ctx.LobbError({
-            code: "BAD_REQUEST",
-            message: "Share permissions must be valid JSON.",
-          });
-        }
+          let sharePermissions: PermissionsConfig;
+          try {
+            sharePermissions = JSON.parse(input.data.permissions);
+          } catch {
+            throw new ctx.LobbError({
+              code: "BAD_REQUEST",
+              message: "Share permissions must be valid JSON.",
+            });
+          }
 
-        if (!isShareSubsetOfCreator(sharePermissions, creatorPermissions)) {
-          throw new ctx.LobbError({
-            code: "FORBIDDEN",
-            message:
-              "Cannot create a share with broader permissions than your own.",
-          });
+          if (!isShareSubsetOfCreator(sharePermissions, creatorPermissions)) {
+            throw new ctx.LobbError({
+              code: "FORBIDDEN",
+              message:
+                "Cannot create a share with broader permissions than your own.",
+            });
+          }
         }
-
-        return input;
       },
     },
     // Hourly housekeeping: delete shares whose expires_at is in the past.
@@ -125,7 +125,7 @@ export function getSharesWorkflows(extensionConfig: ExtensionConfig): Workflow[]
       name: "auth_cleanupExpiredShares",
       eventName: "0 3 * * *",
       handler: async (_input, ctx) => {
-        await ctx.lobb.collectionService.deleteMany({
+        await ctx.lobb.collectionStore.deleteMany({
           collectionName: "auth_shares",
           filter: { expires_at: { $lt: new Date().toISOString() } },
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lobb-js/lobb-ext-auth",
-  "version": "0.13.0",
+  "version": "0.14.1",
   "license": "UNLICENSED",
   "type": "module",
   "publishConfig": {
@@ -32,12 +32,12 @@
     "package": "svelte-package --input extensions/auth/studio"
   },
   "dependencies": {
-    "@lobb-js/core": "^0.40.0",
+    "@lobb-js/core": "^0.42.0",
     "argon2": "^0.40.3",
     "hono": "^4.7.0"
   },
   "devDependencies": {
-    "@lobb-js/studio": "^0.47.0",
+    "@lobb-js/studio": "^0.50.0",
     "@lucide/svelte": "^0.563.1",
     "@sveltejs/adapter-node": "^5.5.4",
     "@sveltejs/kit": "^2.60.1",