@protobase/server 0.0.0-stage → 0.1.0

package/dist/batch/schema.js

@@ -0,0 +1,51 @@
+import { z } from "zod";
+const ref = z.object({
+	$ref: z.string().min(1),
+	field: z.string().optional()
+}).strict();
+const part = z.union([
+	z.string(),
+	z.number(),
+	ref
+]);
+/** A key: its URL text (`a,b` when composite), a scalar, a list of parts, or a reference to a record created earlier. */
+const key = z.union([
+	z.string(),
+	z.number(),
+	z.array(part),
+	ref
+]);
+const data = z.record(z.string(), z.unknown());
+const resource = z.string().min(1);
+const operations = z.array(z.discriminatedUnion("op", [
+	z.object({
+		op: z.literal("create"),
+		resource,
+		data,
+		ref: z.string().min(1).optional()
+	}),
+	z.object({
+		op: z.literal("update"),
+		resource,
+		key,
+		etag: z.string().optional(),
+		data
+	}),
+	z.object({
+		op: z.literal("delete"),
+		resource,
+		key,
+		etag: z.string().optional()
+	}),
+	z.object({
+		op: z.literal("reorder"),
+		resource,
+		field: z.string().min(1),
+		keys: z.array(key).min(1),
+		etags: z.record(z.string(), z.string()).optional()
+	})
+])).min(1).max(500);
+/** `{ ops: [...] }`; `{ operations: [...] }` is accepted too, for clients written against that name. */
+const batchBody = z.union([z.object({ ops: operations }), z.object({ operations })]).transform((body) => ({ ops: "ops" in body ? body.ops : body.operations }));
+//#endregion
+export { batchBody };

package/dist/better-auth/authenticator.d.ts

@@ -0,0 +1,22 @@
+import { AdminAuth } from "./create-auth.js";
+import { Authenticator, TenantValue } from "../types.js";
+import { JwksCacheOptions } from "./jwks-cache.js";
+//#region src/better-auth/authenticator.d.ts
+export type BetterAuthAuthenticatorOptions = {
+  /** The Better Auth instance of this process: keys are read from it directly, no HTTP round trip. */
+  auth?: AdminAuth;
+  /** Or its JWKS endpoint, for an API that runs apart from the auth server. Needs `issuer`. */
+  jwksUrl?: string | URL;
+  /** Defaults to the auth instance's `baseURL`; it is both issuer and audience of its tokens. */
+  issuer?: string;
+  /** The one tenant everyone works in (organizations are not used yet); never read from the token. */
+  tenant?: TenantValue | (() => Promise<TenantValue | undefined>);
+  /** How long the key set is cached; see `cachedKeys`. */
+  cache?: JwksCacheOptions;
+};
+/**
+ * Verifies the bearer JWT that Better Auth's jwt plugin issues. `sub` is the user id, the `role` claim
+ * (a comma separated string from the admin plugin) becomes `roles`.
+ */
+export declare const betterAuthAuthenticator: (options: BetterAuthAuthenticatorOptions) => Authenticator;
+//#endregion

package/dist/better-auth/authenticator.js

@@ -0,0 +1,21 @@
+import { jwtAuthenticator } from "../auth/jwt.js";
+import { cachedKeys } from "./jwks-cache.js";
+//#region src/better-auth/authenticator.ts
+/**
+* Verifies the bearer JWT that Better Auth's jwt plugin issues. `sub` is the user id, the `role` claim
+* (a comma separated string from the admin plugin) becomes `roles`.
+*/
+const betterAuthAuthenticator = (options) => {
+	const issuer = options.issuer ?? options.auth?.options.baseURL;
+	if (!issuer) throw new Error("betterAuthAuthenticator needs `issuer` (or an `auth` instance with a baseURL)");
+	if (!options.auth && !options.jwksUrl) throw new Error("betterAuthAuthenticator needs `auth` or `jwksUrl`");
+	return jwtAuthenticator({
+		...options.auth ? { keys: cachedKeys(() => options.auth.api.getJwks(), options.cache) } : { jwksUrl: options.jwksUrl },
+		issuer,
+		audience: issuer,
+		rolesClaim: "role",
+		...options.tenant !== void 0 && { tenant: options.tenant }
+	});
+};
+//#endregion
+export { betterAuthAuthenticator };