@protobase/server 0.12.7 → 0.12.8

package/dist/admin-options.d.ts

@@ -5,7 +5,7 @@ import { SourceOption } from "./sources/source-settings.js";
 import { CorsOrigins } from "./api-cors.js";
 import { AssistantOptions } from "./assistant/assistant-settings.js";
 import { RuntimeOptions } from "./runtime/runtime-settings.js";
-import { ResolveOptions } from "@protobase/schema";
+import { ResolveOptions, RoleLimit } from "@protobase/schema";
 //#region src/admin-options.d.ts
 export type AdminOptions = {
   /** Default `/api/v1`. */
@@ -19,8 +19,14 @@ export type AdminOptions = {
   };
   /** Runs inside the write transaction after each create, update and delete. */
   writeHooks?: PipelineHook[];
-  /** The project's roles (from `defineRoles`): an operation without an access rule needs the matching capability. */
-  roles?: ResolveOptions['roles'];
+  /**
+   * The project's roles (from `defineRoles`): an operation without an access rule needs the matching capability. Their
+   * limits are checked against the resources at startup; an `anonymous` role opens the resources API to requests
+   * without a token.
+   */
+  roles?: ResolveOptions['roles'] & {
+    limits?: readonly RoleLimit[];
+  };
   /** What an operation without a rule does; overrides the capability check. Without `roles` the default is allow. */
   defaultAccess?: ResolveOptions['defaultAccess'];
   /** Whether list items carry their `permissions` (update, delete): true by default, or `{ except: [...] }` for resources that opt out. */

package/dist/anonymous.js

@@ -0,0 +1,27 @@
+import { MissingCredentials } from "./problem.js";
+import { anonymousRole } from "@protobase/schema";
+//#region src/anonymous.ts
+const anonymousSession = () => ({
+	user: {
+		id: "",
+		roles: [anonymousRole]
+	},
+	anonymous: true
+});
+/**
+* With an `anonymous` role in `roles`, a request that carries no credential at all (`MissingCredentials`) is served as
+* a caller holding that role alone; an invalid or expired one is still a 401. Without the role, `authenticate` itself.
+*/
+const withAnonymous = (authenticate, roles) => {
+	if (!Object.hasOwn(roles?.definitions ?? {}, anonymousRole)) return authenticate;
+	return async (request) => {
+		try {
+			return await authenticate(request);
+		} catch (error) {
+			if (error instanceof MissingCredentials) return anonymousSession();
+			throw error;
+		}
+	};
+};
+//#endregion
+export { withAnonymous };

package/dist/auth/jwt.d.ts

@@ -20,6 +20,6 @@ export type JwtOptions = {
   /** A fixed tenant (or resolver) used instead of any claim, for single-tenant deployments. */
   tenant?: TenantValue | (() => Promise<TenantValue | undefined>);
 };
-/** Verifies `Authorization: Bearer <jwt>` against a JWKS; `sub` is the user id. */
+/** Verifies `Authorization: Bearer <jwt>` against a JWKS; `sub` is the user id. Without the header, `MissingCredentials`. */
 export declare const jwtAuthenticator: (options: JwtOptions) => Authenticator;
 //#endregion

package/dist/auth/jwt.js

@@ -1,4 +1,4 @@
-import { unauthorized } from "../problem.js";
+import { MissingCredentials, unauthorized } from "../problem.js";
 import { createRemoteJWKSet, errors, jwtVerify } from "jose";
 //#region src/auth/jwt.ts
 const asymmetric = [
@@ -17,13 +17,15 @@ const rolesOf = (claim) => {
 	if (typeof claim === "string") return claim.split(/[\s,]+/).filter(Boolean);
 	return Array.isArray(claim) ? claim.filter((role) => typeof role === "string") : [];
 };
-/** Verifies `Authorization: Bearer <jwt>` against a JWKS; `sub` is the user id. */
+/** Verifies `Authorization: Bearer <jwt>` against a JWKS; `sub` is the user id. Without the header, `MissingCredentials`. */
 const jwtAuthenticator = (options) => {
 	const { rolesClaim = "roles", tenantClaim = "tenant" } = options;
 	const keys = options.keys ?? (options.jwksUrl ? createRemoteJWKSet(new URL(options.jwksUrl)) : void 0);
 	if (!keys) throw new Error("jwtAuthenticator needs jwksUrl or keys");
 	return async (request) => {
-		const [scheme, token] = (request.headers.get("authorization") ?? "").split(" ");
+		const header = request.headers.get("authorization");
+		if (header === null) throw new MissingCredentials("Send a bearer token in the Authorization header");
+		const [scheme, token] = header.split(" ");
 		if (scheme?.toLowerCase() !== "bearer" || !token) throw unauthorized("Send a bearer token in the Authorization header");
 		const verified = await jwtVerify(token, keys, {
 			algorithms: options.algorithms ?? asymmetric,

package/dist/check-roles.js

@@ -0,0 +1,29 @@
+import { anonymousRole, checkFilter } from "@protobase/schema";
+//#region src/check-roles.ts
+/**
+* Stops startup on a role's limit that does not fit its resource: fields or a filter for a name that is not a resource,
+* a field it does not have, a filter it cannot check, or an anonymous capability on a tenant-scoped resource, since an
+* anonymous caller works in no organization.
+*/
+const checkRoleLimits = (registry, limits) => {
+	for (const { role, capability, fields, filter } of limits) {
+		const name = capability.slice(0, capability.indexOf("."));
+		const model = registry.find(name)?.model;
+		if (!model) throw new Error(`Role "${role}" limits "${capability}" but "${name}" is not a resource`);
+		const unknown = fields?.find((field) => !Object.hasOwn(model.fields, field));
+		if (unknown) throw new Error(`Role "${role}" lists the field "${unknown}" for "${capability}" but ${name} has no such field`);
+		if (role === anonymousRole && model.tenant) throw new Error(`The anonymous role reads ${name}, which is tenant-scoped, but an anonymous caller works in no organization`);
+		if (!filter) continue;
+		const trusted = {
+			...model,
+			fields: Object.fromEntries(Object.entries(model.fields).map(([field, value]) => [field, {
+				...value,
+				filterable: true
+			}]))
+		};
+		const checked = checkFilter(trusted, filter);
+		if (!checked.ok) throw new Error(`Role "${role}" limits "${capability}" to a filter that does not fit ${name}: ${checked.errors[0].message}`);
+	}
+};
+//#endregion
+export { checkRoleLimits };

package/dist/create-admin.js

@@ -14,7 +14,9 @@ import { toApiFunction } from "./functions/define-function.js";
 import { createWebhooks } from "./webhooks/webhooks.js";
 import { webhookTable } from "./webhooks/table/webhook-table.js";
 import { subscriptionWriteCheck } from "./webhooks/table/validate-hook.js";
+import { withAnonymous } from "./anonymous.js";
 import { checkBottomBars, checkShell } from "./check-shell.js";
+import { checkRoleLimits } from "./check-roles.js";
 import { checkViews } from "./check-views.js";
 import { errorReportingSettings } from "./error-reporting/error-reporting-settings.js";
 import { createFilesRuntime } from "./files/runtime.js";
@@ -54,6 +56,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	const bottomBarModels = bottomBars.map((bar) => bar.toBottomBarModel());
 	checkBottomBars(registry, bottomBarModels, pageModels.map((entry) => entry.name), declaredRoles(auth, options.roles));
 	checkViews(registry, viewModels, pageModels.map((entry) => entry.name), fieldTypes);
+	checkRoleLimits(registry, options.roles?.limits ?? []);
 	checkPages(pageModels, {
 		models: Object.fromEntries(registry.entries.map((entry) => [entry.name, entry.model])),
 		actions: (resource) => new Set(viewModels.filter((view) => view.resource === resource).flatMap((view) => view.actions.map((action) => action.name)))
@@ -103,7 +106,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	};
 	const meta = createMeta(deps);
 	const onError = createErrorHandler(options.onUnhandledError);
-	const guarded = (routes) => {
+	const guarded = (routes, caller = authenticate) => {
 		const app = new Hono();
 		app.onError(onError);
 		app.use("*", async (c, next) => {
@@ -111,7 +114,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 			c.res.headers.set("X-Meta-Version", await meta.version(c.get("session")?.user.roles ?? []));
 		});
 		app.use("*", async (c, next) => {
-			c.set("session", await authenticate(c.req.raw));
+			c.set("session", await caller(c.req.raw));
 			await next();
 		});
 		routes(app);
@@ -120,7 +123,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	const api = guarded((app) => {
 		app.route("/", collectionRoutes(deps));
 		app.route("/", recordRoutes(deps));
-	});
+	}, withAnonymous(authenticate, options.roles));
 	const system = guarded((app) => {
 		app.route("/", docsRoutes(deps));
 		app.route("/", metaRoutes(meta));

package/dist/index.d.ts

@@ -36,7 +36,7 @@ import { CreateAdminInput, createAdmin } from "./create-admin.js";
 import { ProjectConfig, defineConfig, mergeConfig } from "./project-config.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { JwtOptions, jwtAuthenticator } from "./auth/jwt.js";
-import { HttpProblem, badRequest, forbidden, notFound, unauthorized } from "./problem.js";
+import { HttpProblem, MissingCredentials, badRequest, forbidden, notFound, unauthorized } from "./problem.js";
 import { TrustedApp, withTrustedApps } from "./better-auth/app-tokens.js";
 import { BetterAuthAuthenticatorOptions, betterAuthAuthenticator } from "./better-auth/authenticator.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
@@ -74,4 +74,4 @@ import { FatalJobError } from "./jobs/run-job.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileObject, type FileProvider, type FileStore, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MemberInput, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkSourceNames, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, streamChatCompletion, subscription, unauthorized, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileObject, type FileProvider, type FileStore, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MemberInput, MissingCredentials, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkSourceNames, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, streamChatCompletion, subscription, unauthorized, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/index.js

@@ -1,7 +1,7 @@
 import { assistantRoles, assistantSettings, assistantVariables, seesAssistant } from "./assistant/assistant-settings.js";
 import { conversationKey, createConversations } from "./assistant/conversations.js";
 import { fileConversationStore } from "./assistant/file-conversation-store.js";
-import { HttpProblem, badRequest, forbidden, notFound, unauthorized } from "./problem.js";
+import { HttpProblem, MissingCredentials, badRequest, forbidden, notFound, unauthorized } from "./problem.js";
 import { assistantProtocolRoutes } from "./assistant/protocol-routes.js";
 import { runReadOnlyQuery, runReadWriteQuery } from "./assistant/run-query.js";
 import { defineTool } from "./assistant/tools.js";
@@ -56,4 +56,4 @@ import { createFileCleanup } from "./files/file-cleanup.js";
 import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/processors.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { FatalJobError, HttpProblem, ModelError, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkSourceNames, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, streamChatCompletion, subscription, unauthorized, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkSourceNames, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, streamChatCompletion, subscription, unauthorized, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/problem.d.ts

@@ -12,6 +12,14 @@ export declare class HttpProblem extends Error {
 }
 export declare const badRequest: (slug: string, detail: string, extras?: ProblemExtras) => HttpProblem;
 export declare const unauthorized: (detail: string) => HttpProblem;
+/**
+ * The 401 of a request that carries no credential at all, as opposed to an invalid one: with an `anonymous` role, the
+ * resources API serves such a request as an anonymous caller instead. An authenticator of the app's own throws it to
+ * let that happen.
+ */
+export declare class MissingCredentials extends HttpProblem {
+  constructor(detail: string);
+}
 export declare const forbidden: (slug: string, detail: string) => HttpProblem;
 export declare const notFound: (detail: string) => HttpProblem;
 //#endregion

package/dist/problem.js

@@ -35,9 +35,19 @@ const problemResponse = (problem, instance) => new Response(JSON.stringify({
 });
 const badRequest = (slug, detail, extras) => new HttpProblem(400, slug, "Bad Request", detail, extras);
 const unauthorized = (detail) => new HttpProblem(401, "unauthenticated", "Unauthorized", detail, {}, { "www-authenticate": "Bearer" });
+/**
+* The 401 of a request that carries no credential at all, as opposed to an invalid one: with an `anonymous` role, the
+* resources API serves such a request as an anonymous caller instead. An authenticator of the app's own throws it to
+* let that happen.
+*/
+var MissingCredentials = class extends HttpProblem {
+	constructor(detail) {
+		super(401, "unauthenticated", "Unauthorized", detail, {}, { "www-authenticate": "Bearer" });
+	}
+};
 const forbidden = (slug, detail) => new HttpProblem(403, slug, "Forbidden", detail);
 const notFound = (detail) => new HttpProblem(404, "not-found", "Not Found", detail);
 const preconditionFailed = (detail) => new HttpProblem(412, "precondition-failed", "Precondition Failed", detail);
 const preconditionRequired = (detail) => new HttpProblem(428, "precondition-required", "Precondition Required", detail);
 //#endregion
-export { HttpProblem, badRequest, forbidden, notFound, preconditionFailed, preconditionRequired, problemResponse, problemType, unauthorized };
+export { HttpProblem, MissingCredentials, badRequest, forbidden, notFound, preconditionFailed, preconditionRequired, problemResponse, problemType, unauthorized };

package/dist/request-access.js

@@ -1,4 +1,4 @@
-import { forbidden, notFound } from "./problem.js";
+import { forbidden, notFound, unauthorized } from "./problem.js";
 import { checkedFilter } from "./filter-input.js";
 import { tenantScope } from "./tenant.js";
 import { checkFilter, resolveAccess, restrictModel } from "@protobase/schema";
@@ -28,10 +28,14 @@ const requestAccess = async (deps, entry, session) => {
 	};
 };
 const hasNoAccess = (resolved) => !Object.values(resolved.operations).some(Boolean);
-/** 403 when the operation is denied; a resource the user can do nothing with does not exist for them. */
+/**
+* 403 when the operation is denied, 401 for a request without a token; a resource the user can do nothing with does not
+* exist for them.
+*/
 const requireOperation = (access, operation) => {
 	if (access.resolved.operations[operation]) return;
 	if (hasNoAccess(access.resolved)) throw notFound(`There is no resource "${access.entry.name}"`);
+	if (access.session.anonymous) throw unauthorized(`Send a bearer token to ${operation} ${access.entry.name}`);
 	throw forbidden("access-denied", `You may not ${operation} ${access.entry.name}`);
 };
 /**

package/dist/types.d.ts

@@ -13,10 +13,12 @@ export type User = {
 export type SessionOrganization = {
   id: TenantValue;
 };
+/** `anonymous` marks a request without a token, served as the project's `anonymous` role. */
 export type Session = {
   user: User;
   tenant?: TenantValue;
   organization?: SessionOrganization;
+  anonymous?: true;
 };
 /** Resolves the caller of a request, or throws a 401 problem (see `unauthorized`). */
 export type Authenticator = (request: Request) => Promise<Session> | Session;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.12.7",
+  "version": "0.12.8",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,9 +30,9 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.12.7",
-    "@protobase/query": "0.12.7",
-    "@protobase/schema": "0.12.7",
+    "@protobase/layout": "0.12.8",
+    "@protobase/query": "0.12.8",
+    "@protobase/schema": "0.12.8",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",
     "@simplewebauthn/server": "^13.3.1",