@protobase/server 0.14.6 → 0.15.0

package/dist/better-auth/create-auth.d.ts

@@ -6,6 +6,7 @@ import { RoleDefinitions, RolesInput } from "./organizations/role-definitions.js
 import { OrganizationRole } from "./organizations/store.js";
 import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/options.js";
 import { PlatformSignIn } from "./platform-sign-in.js";
+import { signUpPaths } from "./sign-up/sign-up-plugin.js";
 import "../index.js";
 import { BetterAuthOptions } from "better-auth";
 //#region src/better-auth/create-auth.d.ts
@@ -44,7 +45,16 @@ export type CreateAuthOptions = {
    * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
    */
   defaultRole?: string;
-  /** Sign-in attempts allowed per minute and client, default 5. */
+  /**
+   * Open sign-up: anyone makes their own account from the sign-in page, with `role`, after proving their address with
+   * an emailed code. Off by default, so accounts come only from the host, an admin, an invitation or a sign-in provider.
+   * Needs a mailer: without one it is not offered. `role` is one of `roles` and never `admin`; give it the least
+   * a stranger may hold. Not with `organizations`, whose people come from invitations.
+   */
+  signUp?: {
+    role: string;
+  };
+  /** Sign-in attempts allowed per minute and client, default 5; also the sign-up requests allowed. */
   signInPerMinute?: number;
   /**
    * Sends the password-reset email and the emailed sign-in and two-factor codes; without a mailer none of them is
@@ -87,9 +97,9 @@ type UserCreateHooks = NonNullable<NonNullable<NonNullable<BetterAuthOptions['da
 export type UserCreatedHook = NonNullable<UserCreateHooks['after']>;
 /**
  * Better Auth for a single-tenant admin: sign-in with a password, an emailed code or a passkey, two-factor
- * authentication, and the sign-in policy admins set; no public sign-up (every account is created on the host with
- * `createUser`, or by an admin through the admin plugin), roles from the admin plugin's `role` column, 15 minute JWTs
- * at `/api/auth/token` with the keys at `/api/auth/jwks`.
+ * authentication, and the sign-in policy admins set; no public sign-up unless `signUp` turns it on (every account is
+ * created on the host with `createUser`, or by an admin through the admin plugin), roles from the admin plugin's `role`
+ * column, 15 minute JWTs at `/api/auth/token` with the keys at `/api/auth/jwks`.
  */
 /** The configured roles with `admin` first; `admin` is added when missing. */
 export declare const normalizeRoles: (roles?: RolesInput) => string[];
@@ -733,7 +743,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
+              userAgent? /** Open sign-up is on and offered: the app asks for it, and can mail the codes. */ : string | null | undefined;
             };
           };
         }>>[];
@@ -2192,7 +2202,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               userId: string;
               expiresAt: Date;
               token: string;
-              ipAddress? /** The RP ID of new passkeys. */ : string | null | undefined;
+              ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
             };
             user: Record<string, any> & {
@@ -2707,7 +2717,10 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           email: string;
           emailVerified: boolean;
           name: string;
-          image?: string | null | undefined;
+          image? /**
+           * Turns on organizations: people work in one at a time, records of `.tenant` resources are scoped to it, and roles
+           * are held globally (on the user) or per membership. Off by default: the app works as one organization.
+           */ : string | null | undefined;
         } & Record<string, any>;
       }>;
       signInEmailOTP: import("better-auth").StrictEndpoint<"/sign-in/email-otp", {
@@ -3015,6 +3028,34 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       INVALID_OTP: import("better-auth").RawError<"INVALID_OTP">;
       TOO_MANY_ATTEMPTS: import("better-auth").RawError<"TOO_MANY_ATTEMPTS">;
     };
+  } | {
+    id: "protobase-sign-up";
+    endpoints: {
+      sendSignUpCode: import("better-auth").StrictEndpoint<string, {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          email: import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodEmail>;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        sent: boolean;
+      }>;
+      createSignUpAccount: import("better-auth").StrictEndpoint<string, {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          email: import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodEmail>;
+          code: import("zod").ZodString;
+          name: import("zod").ZodString;
+          password: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        user: {
+          id: string;
+          email: string;
+          name: string;
+          role: string;
+        };
+      }>;
+    };
   } | {
     id: "generic-oauth";
     version: string;
@@ -3100,7 +3141,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 email: string;
                 emailVerified: boolean;
                 name: string;
-                image?: string | null | undefined;
+                image?
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */ : string | null | undefined;
               };
             };
           }>>[];
@@ -3124,7 +3173,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 email: string;
                 emailVerified: boolean;
                 name: string;
-                image?: string | null | undefined;
+                image?
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */ : string | null | undefined;
               };
             };
           }>>[];
@@ -3147,7 +3204,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           } & {
             session: {
@@ -3202,7 +3267,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 email: string;
                 emailVerified: boolean;
                 name: string;
-                image?: string | null | undefined;
+                image?
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */ : string | null | undefined;
               };
             };
           }>>[];
@@ -3226,7 +3299,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 email: string;
                 emailVerified: boolean;
                 name: string;
-                image?: string | null | undefined;
+                image?
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */ : string | null | undefined;
               };
             };
           }>>[];
@@ -3249,7 +3330,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           } & {
             session: {
@@ -3304,7 +3393,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -3409,7 +3506,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -3437,7 +3542,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -3466,7 +3579,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 email: string;
                 emailVerified: boolean;
                 name: string;
-                image?: string | null | undefined;
+                image?
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */ : string | null | undefined;
               };
             };
           }>>[];
@@ -3490,7 +3611,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 email: string;
                 emailVerified: boolean;
                 name: string;
-                image?: string | null | undefined;
+                image?
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */ : string | null | undefined;
               };
             };
           }>>[];
@@ -3513,7 +3642,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           } & {
             session: {
@@ -3610,7 +3747,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -3642,7 +3787,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -3970,7 +4123,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -4009,7 +4170,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -4044,7 +4213,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -4084,7 +4261,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -4141,7 +4326,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -4233,6 +4426,14 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     window: number;
     max: number;
     customRules: {
+      [signUpPaths.sendCode]: {
+        window: number;
+        max: number;
+      };
+      [signUpPaths.create]: {
+        window: number;
+        max: number;
+      };
       '/sign-in/email': {
         window: number;
         max: number;
@@ -4293,6 +4494,8 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   defaultRole: string | undefined;
   mail: boolean;
   passwordReset: boolean;
+  /** Open sign-up is on and offered: the app asks for it, and can mail the codes. */
+  signUp: boolean;
   socialProviders: string[];
   operator: string | undefined;
   platformSignIn: {

package/dist/better-auth/create-auth.js

@@ -15,6 +15,7 @@ import { rolesPlugin } from "./roles/roles-plugin.js";
 import { platformSignInFor, platformSignInProvider, readPlatformSignIn, resolvePlatformSignIn } from "./platform-sign-in.js";
 import { signInPolicyPlugin } from "./policy-plugin.js";
 import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
+import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
 import { twoFactorAfterPasswordOrCode } from "./two-factor-challenge.js";
 import { APIError } from "better-auth/api";
@@ -30,9 +31,9 @@ const tokenLifetime = "15m";
 const authBasePath = "/api/auth";
 /**
 * Better Auth for a single-tenant admin: sign-in with a password, an emailed code or a passkey, two-factor
-* authentication, and the sign-in policy admins set; no public sign-up (every account is created on the host with
-* `createUser`, or by an admin through the admin plugin), roles from the admin plugin's `role` column, 15 minute JWTs
-* at `/api/auth/token` with the keys at `/api/auth/jwks`.
+* authentication, and the sign-in policy admins set; no public sign-up unless `signUp` turns it on (every account is
+* created on the host with `createUser`, or by an admin through the admin plugin), roles from the admin plugin's `role`
+* column, 15 minute JWTs at `/api/auth/token` with the keys at `/api/auth/jwks`.
 */
 /** The configured roles with `admin` first; `admin` is added when missing. */
 const normalizeRoles = (roles) => roleDefinitions(roles).names;
@@ -43,7 +44,7 @@ const organizationPaths = ["/organization/set-active", "/organization/accept-inv
 * The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
 * sign-in provider already resolved.
 */
-const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, mailer, operator, platformSignIn, organizations, context = noContext }) => {
+const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, mailer, signUpRole, operator, platformSignIn, organizations, context = noContext }) => {
 	const secure = options.baseURL.startsWith("https://");
 	const signIn = platformSignInFor(platformSignIn, Object.keys(options.socialProviders ?? {}));
 	const hosts = passkeyHosts([options.baseURL, ...origins]);
@@ -114,6 +115,11 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				formerDomain: hosts[0]
 			}),
 			...mailer ? [emailOTP(emailCodeOptions(mailer))] : [],
+			...mailer && signUpRole ? [signUpPlugin({
+				role: signUpRole,
+				mailer,
+				appName: options.appName ?? "Protobase"
+			})] : [],
 			...signIn ? [genericOAuth({ config: [platformSignInProvider(signIn)] })] : [],
 			signInPolicyPlugin({
 				mail: Boolean(mailer),
@@ -175,6 +181,14 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				"/invitation/sign-up": {
 					window: 60,
 					max: options.signInPerMinute ?? 5
+				},
+				[signUpPaths.sendCode]: {
+					window: 60,
+					max: options.signInPerMinute ?? 5
+				},
+				[signUpPaths.create]: {
+					window: 60,
+					max: options.signInPerMinute ?? 5
 				}
 			}
 		},
@@ -188,10 +202,17 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 		}
 	};
 };
+const checkSignUpRole = (role, roles) => {
+	if (role === "admin") throw new Error("signUp.role cannot be admin: give the least a stranger may hold");
+	if (!roles.includes(role)) throw new Error(`signUp.role "${role}" is not one of the roles: ${roles.join(", ")}`);
+	return role;
+};
 const createAuth = (options) => {
+	if (options.signUp && options.organizations) throw new Error("signUp is not available with organizations: their people join by invitation");
 	const definitions = roleDefinitions(options.roles, { organizations: options.organizations !== void 0 });
 	const roles = definitions.names;
 	if (options.defaultRole !== void 0 && !roles.includes(options.defaultRole)) throw new Error(`defaultRole "${options.defaultRole}" is not one of the roles: ${roles.join(", ")}`);
+	const signUpRole = options.signUp && checkSignUpRole(options.signUp.role, roles);
 	const others = roles.filter((role) => role !== "admin");
 	const defaultRole = options.defaultRole ?? (options.organizations ? "user" : others.length === 1 ? others[0] : void 0);
 	const mailer = options.mailer === void 0 ? platformMailer() : options.mailer || void 0;
@@ -212,6 +233,7 @@ const createAuth = (options) => {
 		definitions,
 		defaultRole,
 		mailer,
+		signUpRole,
 		operator,
 		platformSignIn,
 		...organizations && {
@@ -233,6 +255,8 @@ const createAuth = (options) => {
 		defaultRole,
 		mail: Boolean(mailer),
 		passwordReset: Boolean(mailer),
+		/** Open sign-up is on and offered: the app asks for it, and can mail the codes. */
+		signUp: Boolean(signUpRole && mailer),
 		socialProviders,
 		operator: operator?.name,
 		platformSignIn: platformSignIn && {

package/dist/better-auth/new-account-password.js

@@ -0,0 +1,25 @@
+import { APIError } from "better-auth/api";
+//#region src/better-auth/new-account-password.ts
+const minPasswordLength = 12;
+const maxPasswordLength = 128;
+/**
+* Checks the password someone chose for a new account they make themselves, from an invitation or by signing up,
+* against the effective sign-in policy: none while passwords are forbidden, one unless emailed codes are allowed, and
+* of the length Better Auth's own sign-in takes.
+*/
+const checkNewAccountPassword = (policy, password) => {
+	if (password !== void 0 && policy.password === "forbidden") throw new APIError("BAD_REQUEST", {
+		code: "SIGN_IN_METHOD_FORBIDDEN",
+		message: "This app does not sign in with passwords; leave the password out."
+	});
+	if (password === void 0 && policy.emailCode !== "allowed") throw new APIError("BAD_REQUEST", {
+		code: "PASSWORD_REQUIRED",
+		message: "Choose a password to sign in with."
+	});
+	if (password !== void 0 && (password.length < minPasswordLength || password.length > maxPasswordLength)) throw new APIError("BAD_REQUEST", {
+		code: "PASSWORD_LENGTH",
+		message: `Choose a password of ${minPasswordLength} to ${maxPasswordLength} characters.`
+	});
+};
+//#endregion
+export { checkNewAccountPassword };

package/dist/better-auth/organizations/invitation-endpoints.js

@@ -1,6 +1,7 @@
 import { noGlobalRole } from "./role-definitions.js";
 import { findOrganization } from "./store.js";
 import { invitationLink, invitationToken } from "./invitation-token.js";
+import { checkNewAccountPassword } from "../new-account-password.js";
 import { effectiveSignInPolicy } from "../sign-in-policy.js";
 import { readSignInPolicy } from "../policy-store.js";
 import { acceptInvitation, invitationOfToken } from "./accept-invitation.js";
@@ -8,8 +9,6 @@ import { APIError, createAuthEndpoint, createAuthMiddleware, sessionMiddleware }
 import { setSessionCookie } from "better-auth/cookies";
 import * as z$1 from "zod";
 //#region src/better-auth/organizations/invitation-endpoints.ts
-const minPasswordLength = 12;
-const maxPasswordLength = 128;
 const tokenBody = z$1.object({ token: z$1.string().min(1) });
 const startIn = (context, sessionToken, organizationId) => context.internalAdapter.updateSession(sessionToken, { activeOrganizationId: organizationId });
 /**
@@ -71,20 +70,8 @@ const invitationEndpoints = ({ resolved, mail }) => ({
 			code: "ACCOUNT_EXISTS",
 			message: "This address has an account already: sign in to accept the invitation."
 		});
-		const policy = effectiveSignInPolicy((await readSignInPolicy(ctx.context.adapter)).policy, { mail });
 		const { password } = ctx.body;
-		if (password !== void 0 && policy.password === "forbidden") throw new APIError("BAD_REQUEST", {
-			code: "SIGN_IN_METHOD_FORBIDDEN",
-			message: "This app does not sign in with passwords; leave the password out."
-		});
-		if (password === void 0 && policy.emailCode !== "allowed") throw new APIError("BAD_REQUEST", {
-			code: "PASSWORD_REQUIRED",
-			message: "Choose a password to sign in with."
-		});
-		if (password !== void 0 && (password.length < minPasswordLength || password.length > maxPasswordLength)) throw new APIError("BAD_REQUEST", {
-			code: "PASSWORD_LENGTH",
-			message: `Choose a password of ${minPasswordLength} to ${maxPasswordLength} characters.`
-		});
+		checkNewAccountPassword(effectiveSignInPolicy((await readSignInPolicy(ctx.context.adapter)).policy, { mail }), password);
 		const user = await internalAdapter.createUser({
 			email: invitation.email.toLowerCase(),
 			name: ctx.body.name,

package/dist/better-auth/sign-up/sign-up-code.js

@@ -0,0 +1,52 @@
+import { APIError } from "better-auth/api";
+const signUpCodeLifetime = "5 minutes";
+const allowedAttempts = 3;
+const identifierOf = (email) => `sign-up-otp-${email}`;
+const hashOf = async (code) => {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(code));
+	return btoa(String.fromCharCode(...new Uint8Array(digest)));
+};
+const sixDigits = () => {
+	const limit = Math.floor(2 ** 32 / 1e6) * 1e6;
+	for (;;) {
+		const [value] = crypto.getRandomValues(/* @__PURE__ */ new Uint32Array(1));
+		if (value < limit) return String(value % 1e6).padStart(6, "0");
+	}
+};
+const invalidCode = () => new APIError("BAD_REQUEST", {
+	code: "SIGN_UP_CODE_INVALID",
+	message: "The code is not right, or has expired. Ask for a new one."
+});
+/** A new code for `email`, replacing any earlier one; the store keeps only its hash. */
+const issueSignUpCode = async (context, email) => {
+	const code = sixDigits();
+	const identifier = identifierOf(email);
+	await context.internalAdapter.deleteVerificationByIdentifier(identifier);
+	await context.internalAdapter.createVerificationValue({
+		identifier,
+		value: `${await hashOf(code)}:0`,
+		expiresAt: new Date(Date.now() + 3e5)
+	});
+	return code;
+};
+/**
+* Takes the code for `email` when `code` is it, so it works once; a wrong one counts a try. Taking the stored value is
+* atomic, so of two requests with the right code only one gets through. Throws `SIGN_UP_CODE_INVALID` otherwise.
+*/
+const consumeSignUpCode = async (context, email, code) => {
+	const identifier = identifierOf(email);
+	const consumed = await context.internalAdapter.consumeVerificationValue(identifier);
+	if (!consumed || new Date(consumed.expiresAt) < /* @__PURE__ */ new Date()) throw invalidCode();
+	const separator = consumed.value.lastIndexOf(":");
+	const hash = consumed.value.slice(0, separator);
+	const attempts = Number(consumed.value.slice(separator + 1)) + 1;
+	if (hash === await hashOf(code)) return;
+	if (attempts < allowedAttempts) await context.internalAdapter.createVerificationValue({
+		identifier,
+		value: `${hash}:${attempts}`,
+		expiresAt: new Date(consumed.expiresAt)
+	});
+	throw invalidCode();
+};
+//#endregion
+export { consumeSignUpCode, issueSignUpCode, signUpCodeLifetime };

package/dist/better-auth/sign-up/sign-up-mail.js

@@ -0,0 +1,29 @@
+import { signUpCodeLifetime } from "./sign-up-code.js";
+//#region src/better-auth/sign-up/sign-up-mail.ts
+/** The email with the code that makes an account for the address. */
+const signUpCodeEmail = ({ to, code, appName }) => ({
+	to,
+	subject: "Your code to create an account",
+	text: [
+		`Use this code to create your account for ${appName}:`,
+		"",
+		code,
+		"",
+		`It works for ${signUpCodeLifetime}, once.`,
+		"If you did not try to create an account, ignore this email: nobody can create one for your address without the code.",
+		""
+	].join("\n")
+});
+/** The email to an address that asked for a sign-up code while it has an account already: no code, a pointer to sign in instead. */
+const accountExistsEmail = ({ to, appName }) => ({
+	to,
+	subject: "You already have an account",
+	text: [
+		`Someone asked to create an account for ${appName} with this address, which has one already, so no new account was made.`,
+		"",
+		"Sign in with it instead. If this was not you, ignore this email.",
+		""
+	].join("\n")
+});
+//#endregion
+export { accountExistsEmail, signUpCodeEmail };

package/dist/better-auth/sign-up/sign-up-plugin.d.ts

@@ -0,0 +1,8 @@
+import "zod";
+//#region src/better-auth/sign-up/sign-up-plugin.d.ts
+/** The paths of the sign-up endpoints, as `ctx.path` and the rate limits name them. */
+export declare const signUpPaths: {
+  sendCode: string;
+  create: string;
+};
+//#endregion

package/dist/better-auth/sign-up/sign-up-plugin.js

@@ -0,0 +1,98 @@
+import { checkNewAccountPassword } from "../new-account-password.js";
+import { effectiveSignInPolicy } from "../sign-in-policy.js";
+import { readSignInPolicy } from "../policy-store.js";
+import { consumeSignUpCode, issueSignUpCode } from "./sign-up-code.js";
+import { accountExistsEmail, signUpCodeEmail } from "./sign-up-mail.js";
+import { APIError, createAuthEndpoint } from "better-auth/api";
+import { setSessionCookie } from "better-auth/cookies";
+import * as z$1 from "zod";
+//#region src/better-auth/sign-up/sign-up-plugin.ts
+const address = z$1.string().trim().toLowerCase().pipe(z$1.email());
+/** The paths of the sign-up endpoints, as `ctx.path` and the rate limits name them. */
+const signUpPaths = {
+	sendCode: "/sign-up/send-code",
+	create: "/sign-up/create"
+};
+const noAdminYet = () => new APIError("FORBIDDEN", {
+	code: "NO_ADMIN_YET",
+	message: "This app has no admin yet; accounts are created on the host until it has one."
+});
+/**
+* Open sign-up: anyone makes their own account, with `role`. The address comes first, and a code mailed to it, so an
+* account exists only for an address its owner reads, verified from the start, and nobody can claim an address before
+* its owner does. Asking for a code answers the same whether the address has an account or not; one that has gets a
+* mail saying so instead of a code. While the store has no user, nobody signs up: the first admin is made on the host.
+*/
+const signUpPlugin = ({ role, mailer, appName }) => ({
+	id: "protobase-sign-up",
+	endpoints: {
+		/** `POST /sign-up/send-code` with `{ email }`: mails a code for making an account with the address. */
+		sendSignUpCode: createAuthEndpoint(signUpPaths.sendCode, {
+			method: "POST",
+			body: z$1.object({ email: address })
+		}, async (ctx) => {
+			const { email } = ctx.body;
+			const { internalAdapter, adapter } = ctx.context;
+			if (await adapter.count({ model: "user" }) === 0) throw noAdminYet();
+			const message = await internalAdapter.findUserByEmail(email) ? accountExistsEmail({
+				to: email,
+				appName
+			}) : signUpCodeEmail({
+				to: email,
+				code: await issueSignUpCode(ctx.context, email),
+				appName
+			});
+			await ctx.context.runInBackgroundOrAwait(mailer.send(message));
+			return ctx.json({ sent: true });
+		}),
+		/**
+		* `POST /sign-up/create` with `{ email, code, name, password? }`: makes the account with the mailed code, verified
+		* and with the sign-up role, and signs the person in. A password is needed unless the sign-in policy offers emailed
+		* codes; the policy's required methods are then set up as after any sign-in.
+		*/
+		createSignUpAccount: createAuthEndpoint(signUpPaths.create, {
+			method: "POST",
+			body: z$1.object({
+				email: address,
+				code: z$1.string().trim().min(1),
+				name: z$1.string().trim().min(1).max(200),
+				password: z$1.string().optional()
+			})
+		}, async (ctx) => {
+			const { email, code, name, password } = ctx.body;
+			const { internalAdapter, adapter } = ctx.context;
+			if (await adapter.count({ model: "user" }) === 0) throw noAdminYet();
+			checkNewAccountPassword(effectiveSignInPolicy((await readSignInPolicy(adapter)).policy, { mail: true }), password);
+			await consumeSignUpCode(ctx.context, email, code);
+			if (await internalAdapter.findUserByEmail(email)) throw new APIError("BAD_REQUEST", {
+				code: "ACCOUNT_EXISTS",
+				message: "This address has an account already: sign in instead."
+			});
+			const user = await internalAdapter.createUser({
+				email,
+				name,
+				emailVerified: true,
+				role
+			}, { method: "sign-up" });
+			if (password !== void 0) await internalAdapter.linkAccount({
+				userId: user.id,
+				providerId: "credential",
+				accountId: user.id,
+				password: await ctx.context.password.hash(password)
+			});
+			const session = await internalAdapter.createSession(user.id, false);
+			await setSessionCookie(ctx, {
+				session,
+				user
+			});
+			return ctx.json({ user: {
+				id: user.id,
+				email: user.email,
+				name: user.name,
+				role
+			} });
+		})
+	}
+});
+//#endregion
+export { signUpPaths, signUpPlugin };

package/dist/better-auth/status-route.js

@@ -9,7 +9,7 @@ import { Hono } from "hono";
 * `GET {authBase}/status`: `needsAdmin` while the admin store has no user, so a login page can say how to create one;
 * `signInMethods`, the ways to sign in the sign-in policy leaves on (`password`, `emailCode`, `passkey`), so it offers
 * only those; `passwordReset` when reset mail can be sent and passwords are on, so it offers "Forgot password?" only
-* then; the ids of the `socialProviders` people can sign in with, so it offers "Continue with GitHub" when `github` is
+* then; `signUp` when the app has open sign-up, so it offers "Create an account"; the ids of the `socialProviders` people can sign in with, so it offers "Continue with GitHub" when `github` is
 * one; `platformSignIn`, the id and name of the platform's provider when it is one of them; `staffSignIn`, the
 * operator provider's name, when staff can sign in as people; `passkeyDomains`, when people have passkeys for more than
 * one of the app's hosts, the RP IDs a passkey sign-in can ask for, the passkey domain first; with organizations, who may create them and the roles
@@ -35,6 +35,7 @@ const statusRoute = (auth, { anonymous = false } = {}) => {
 			needsAdmin: !await hasUsers(auth),
 			signInMethods,
 			passwordReset: auth.passwordReset && policy.password === "allowed",
+			...auth.signUp && { signUp: true },
 			socialProviders,
 			...platformSignIn && { platformSignIn },
 			...staffSignIn && { staffSignIn },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.14.6",
+  "version": "0.15.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,9 +30,9 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.14.6",
-    "@protobase/query": "0.14.6",
-    "@protobase/schema": "0.14.6",
+    "@protobase/layout": "0.15.0",
+    "@protobase/query": "0.15.0",
+    "@protobase/schema": "0.15.0",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",