@lobb-js/lobb-ext-auth 0.15.1 → 0.16.0

package/extensions/auth/collections/activityFeed.ts

@@ -4,10 +4,10 @@ export const activityFeedCollection: CollectionConfig = {
   indexes: {},
   fields: {
     id: {
-      type: "integer",
+      type: "id",
     },
     user_id: {
-      type: "integer",
+      type: "id",
       references: {
         collection: "auth_users",
         field: "id",
@@ -31,8 +31,7 @@ export const activityFeedCollection: CollectionConfig = {
       required: true,
     },
     item_id: {
-      type: "string",
-      length: 255,
+      type: "id",
       required: true,
     },
     created_at: {

package/extensions/auth/collections/sessions.ts

@@ -4,10 +4,10 @@ export const sessionsCollection: CollectionConfig = {
   indexes: {},
   fields: {
     id: {
-      type: "integer",
+      type: "id",
     },
     user_id: {
-      type: "integer",
+      type: "id",
       references: {
         collection: "auth_users",
         field: "id",

package/extensions/auth/collections/shares.ts

@@ -10,7 +10,7 @@ export const sharesCollection: CollectionConfig = {
   indexes: {},
   fields: {
     id: {
-      type: "integer",
+      type: "id",
     },
     // Auto-generated server-side by the auth_generateShareToken workflow on
     // create — clients should not supply this; the generated token comes
@@ -49,7 +49,7 @@ export const sharesCollection: CollectionConfig = {
       ui: { hidden: true },
     },
     created_by: {
-      type: "integer",
+      type: "id",
       references: {
         collection: "auth_users",
         field: "id",

package/extensions/auth/collections/users.ts

@@ -14,7 +14,7 @@ export const usersCollection: NormalCollectionConfig = {
   },
   fields: {
     id: {
-      type: "integer",
+      type: "id",
     },
     email: {
       type: "string",
@@ -37,7 +37,7 @@ export const usersCollection: NormalCollectionConfig = {
     },
     role: {
       type: "string",
-      length: 255,
+      length: 100,
       required: true,
     },
   },

package/extensions/auth/config/extensionConfigSchema.d.ts

@@ -1,4 +1,4 @@
-import type { CollectionConfig } from "@lobb-js/core";
+import type { CollectionConfig, CollectionField } from "@lobb-js/core";
 import type { CreatePermissionAction } from "./permissionsAction/create.ts";
 import type { ReadPermissionAction } from "./permissionsAction/read.ts";
 import type { UpdatePermissionAction } from "./permissionsAction/update.ts";
@@ -33,7 +33,7 @@ export type ExtensionConfig = {
     roles?: Record<string, RolesConfig | undefined>;
     extend_users?: {
         indexes?: CollectionConfig["indexes"];
-        fields?: Omit<CollectionConfig["fields"], "id">;
+        fields?: Record<string, CollectionField>;
     };
     studio?: {
         publicPaths?: string[];

package/extensions/auth/config/extensionConfigSchema.ts

@@ -1,4 +1,4 @@
-import type { CollectionConfig } from "@lobb-js/core";
+import type { CollectionConfig, CollectionField } from "@lobb-js/core";
 import type { CreatePermissionAction } from "./permissionsAction/create.ts";
 import type { ReadPermissionAction } from "./permissionsAction/read.ts";
 import type { UpdatePermissionAction } from "./permissionsAction/update.ts";
@@ -43,7 +43,7 @@ export type ExtensionConfig = {
   roles?: Record<string, RolesConfig | undefined>;
   extend_users?: {
     indexes?: CollectionConfig["indexes"];
-    fields?: Omit<CollectionConfig["fields"], "id">;
+    fields?: Record<string, CollectionField>;
   };
   studio?: {
     publicPaths?: string[];

package/extensions/auth/workflows/baseWorkflow.ts

@@ -3,7 +3,23 @@ import type { Context } from "hono";
 import type { ExtensionConfig } from "../config/extensionConfigSchema.ts";
 import { getBearerToken } from "../utils.ts";
 
-export function getBaseWorkflows(_extensionConfig: ExtensionConfig): Workflow[] {
+// The admin user is identified by the configured admin email — its id is a uuid
+// now, no longer a predictable "1". Looks the target user up and compares.
+async function isAdminUser(id: any, ctx: any, adminEmail?: string): Promise<boolean> {
+  if (!adminEmail || id == null) return false;
+  try {
+    const user = (await ctx.lobb.collectionStore.findOne({
+      collectionName: "auth_users",
+      id: String(id),
+      params: { fields: "id,email" },
+    })).data;
+    return user?.email === adminEmail;
+  } catch {
+    return false;
+  }
+}
+
+export function getBaseWorkflows(extensionConfig: ExtensionConfig): Workflow[] {
   return [
   {
     name: "auth_preventAdminUserDeletion",
@@ -12,7 +28,7 @@ export function getBaseWorkflows(_extensionConfig: ExtensionConfig): Workflow[]
       if (
         input.collectionName === "auth_users" &&
         input.triggeredBy === "API" &&
-        Number(input.id) === 1
+        await isAdminUser(input.id, ctx, extensionConfig.admin?.email)
       ) {
         throw new ctx.LobbError({
           code: "FORBIDDEN",
@@ -28,7 +44,7 @@ export function getBaseWorkflows(_extensionConfig: ExtensionConfig): Workflow[]
       if (
         input.collectionName === "auth_users" &&
         input.triggeredBy === "API" &&
-        Number(input.id) === 1
+        await isAdminUser(input.id, ctx, extensionConfig.admin?.email)
       ) {
         // Only the security-sensitive core fields are locked on the admin —
         // changing them could lock out or hijack the account. Other fields

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lobb-js/lobb-ext-auth",
-  "version": "0.15.1",
+  "version": "0.16.0",
   "license": "UNLICENSED",
   "type": "module",
   "publishConfig": {
@@ -32,13 +32,13 @@
     "package": "svelte-package --input extensions/auth/studio"
   },
   "dependencies": {
-    "@lobb-js/core": "^0.44.0",
+    "@lobb-js/core": "^0.50.0",
     "argon2": "^0.40.3",
     "hono": "^4.7.0"
   },
   "devDependencies": {
     "@sveltejs/vite-plugin-svelte": "^7.1.2",
-    "@lobb-js/studio": "^0.53.1",
+    "@lobb-js/studio": "^0.60.0",
     "@lucide/svelte": "^0.563.1",
     "@sveltejs/adapter-node": "^5.5.4",
     "@sveltejs/kit": "^2.60.1",