@protobase/server 0.21.12 → 0.22.1

package/dist/better-auth/auth-mail/invitation-email.js

@@ -3,35 +3,31 @@ import { AuthEmailLayout, EmailButton, EmailNote } from "./auth-email-layout.js"
 import { Text } from "react-email";
 import { jsx, jsxs } from "react/jsx-runtime";
 //#region src/better-auth/auth-mail/invitation-email.tsx
-const InvitationEmail = ({ app, inviter, organization, url, expiresAt }) => /* @__PURE__ */ jsxs(AuthEmailLayout, {
-	app,
-	preview: `${inviter} invites you to join ${organization}`,
-	heading: `Join ${organization}`,
-	children: [
-		/* @__PURE__ */ jsxs(Text, { children: [
-			inviter,
-			" invites you to join ",
-			organization,
-			" on ",
-			app.name,
-			". To accept, open this link:"
-		] }),
-		/* @__PURE__ */ jsx(EmailButton, {
-			href: url,
-			children: "Accept the invitation"
-		}),
-		/* @__PURE__ */ jsxs(Text, { children: [
-			"The link works until ",
-			expiresAt.toUTCString(),
-			"."
-		] }),
-		/* @__PURE__ */ jsx(EmailNote, { children: "If you do not want to join, ignore this email: nothing happens without you." })
-	]
-});
-/** The invitation email: who invites whom to which organization, the link, and until when it works. */
+const InvitationEmail = ({ app, inviter, organization, url, expiresAt }) => {
+	const target = organization ?? app.name;
+	return /* @__PURE__ */ jsxs(AuthEmailLayout, {
+		app,
+		preview: `${inviter} invites you to join ${target}`,
+		heading: `Join ${target}`,
+		children: [
+			/* @__PURE__ */ jsxs(Text, { children: [organization ? `${inviter} invites you to join ${organization} on ${app.name}.` : `${inviter} invites you to join ${app.name}.`, " To accept, open this link:"] }),
+			/* @__PURE__ */ jsx(EmailButton, {
+				href: url,
+				children: "Accept the invitation"
+			}),
+			/* @__PURE__ */ jsxs(Text, { children: [
+				"The link works until ",
+				expiresAt.toUTCString(),
+				"."
+			] }),
+			/* @__PURE__ */ jsx(EmailNote, { children: "If you do not want to join, ignore this email: nothing happens without you." })
+		]
+	});
+};
+/** The invitation email: who invites whom to which organization, or to the app, the link, and until when it works. */
 const invitationEmail = defineEmail({
 	name: "invitation",
-	subject: ({ organization, app }) => `Join ${organization} on ${app.name}`,
+	subject: ({ organization, app }) => organization ? `Join ${organization} on ${app.name}` : `Join ${app.name}`,
 	component: InvitationEmail
 });
 //#endregion

package/dist/better-auth/create-auth.d.ts

@@ -2331,10 +2331,8 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               userId: string;
               expiresAt: Date;
               token: string;
-              ipAddress?
-              /** The app's name it signs in and mails as: `appName`, else `PROTOBASE_APP_NAME`, else `Protobase`. */
-              /** The app's name it signs in and mails as: `appName`, else `PROTOBASE_APP_NAME`, else `Protobase`. */ : string | null | undefined;
-              userAgent?: string | null | undefined;
+              ipAddress?: string | null | undefined;
+              userAgent? /** Every origin the app is served on, `baseURL`'s first. */ : string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -4718,6 +4716,14 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-last-admin";
+    hooks: {
+      before: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | import("better-auth/plugins").DefaultOrganizationPlugin<{
     organizationHooks: {
       beforeCreateOrganization?: (data: {
@@ -5149,6 +5155,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         }>>[];
         query: import("zod").ZodObject<{
           query: import("zod").ZodDefault<import("zod").ZodString>;
+          offset: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
         }, import("zod/v4/core").$strip>;
       }, {
         organizations: {
@@ -5156,25 +5163,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           name: string;
           slug: string;
         }[];
-      }>;
-      getInvitation: import("better-auth").StrictEndpoint<"/invitation", {
-        method: "GET";
-        query: import("zod").ZodObject<{
-          token: import("zod").ZodString;
-        }, import("zod/v4/core").$strip>;
-      }, {
-        organization: {
-          id: string;
-          name: string;
-        };
-        inviter: {
-          name: string;
-        };
-        email: string;
-        role: string;
-        appRoles: string[];
-        expiresAt: string;
-        hasAccount: boolean;
+        total: number;
       }>;
       acceptInvitation: import("better-auth").StrictEndpoint<"/invitation/accept", {
         method: "POST";
@@ -5214,6 +5203,48 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           organizationId: string;
         };
       }>;
+    };
+    hooks: {
+      after: {
+        matcher: (context: {
+          path?: string;
+        }) => boolean;
+        handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
+  })[], {
+    id: "protobase-users";
+    endpoints: {
+      getInvitation: import("better-auth").StrictEndpoint<"/invitation", {
+        method: "GET";
+        query: import("zod").ZodObject<{
+          token: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        appRoles: string[];
+        inviter: {
+          name: string;
+        };
+        email: string;
+        expiresAt: string;
+        hasAccount: boolean;
+        app: {
+          name: string;
+        };
+      } | {
+        role: string;
+        appRoles: string[];
+        inviter: {
+          name: string;
+        };
+        email: string;
+        expiresAt: string;
+        hasAccount: boolean;
+        organization: {
+          id: string;
+          name: string;
+        };
+      }>;
       signUpFromInvitation: import("better-auth").StrictEndpoint<"/invitation/sign-up", {
         method: "POST";
         body: import("zod").ZodObject<{
@@ -5222,6 +5253,11 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           password: import("zod").ZodOptional<import("zod").ZodString>;
         }, import("zod/v4/core").$strip>;
       }, {
+        user: {
+          id: string;
+          email: string;
+        };
+      } | {
         member: {
           appRoles: string[];
           id: string;
@@ -5231,6 +5267,408 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           organizationId: string;
         };
       }>;
+      inviteUser: import("better-auth").StrictEndpoint<"/users/invite", {
+        method: "POST";
+        use: import("better-auth").Middleware<{
+          use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+            session: {
+              session: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                userId: string;
+                expiresAt: Date;
+                token: string;
+                ipAddress?: string | null | undefined;
+                userAgent?: string | null | undefined;
+              };
+              user: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+              };
+            };
+          }>>[];
+        }, (inputContext: import("better-auth").MiddlewareInputContext<{
+          use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+            session: {
+              session: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                userId: string;
+                expiresAt: Date;
+                token: string;
+                ipAddress?: string | null | undefined;
+                userAgent?: string | null | undefined;
+              };
+              user: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+              };
+            };
+          }>>[];
+        }>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          } & {
+            session: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            } & Record<string, any>;
+            user: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            } & Record<string, any>;
+          };
+        }>>[];
+        body: import("zod").ZodObject<{
+          email: import("zod").ZodEmail;
+          roles: import("zod").ZodArray<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        id: string;
+        email: string;
+        roles: string[];
+        expiresAt: string;
+      }>;
+      listUserInvitations: import("better-auth").StrictEndpoint<"/users/invitations", {
+        method: "GET";
+        use: import("better-auth").Middleware<{
+          use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+            session: {
+              session: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                userId: string;
+                expiresAt: Date;
+                token: string;
+                ipAddress?: string | null | undefined;
+                userAgent?: string | null | undefined;
+              };
+              user: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+              };
+            };
+          }>>[];
+        }, (inputContext: import("better-auth").MiddlewareInputContext<{
+          use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+            session: {
+              session: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                userId: string;
+                expiresAt: Date;
+                token: string;
+                ipAddress?: string | null | undefined;
+                userAgent?: string | null | undefined;
+              };
+              user: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+              };
+            };
+          }>>[];
+        }>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          } & {
+            session: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            } & Record<string, any>;
+            user: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            } & Record<string, any>;
+          };
+        }>>[];
+      }, {
+        invitations: {
+          id: string;
+          email: string;
+          roles: string[];
+          expiresAt: string;
+        }[];
+      }>;
+      cancelUserInvitation: import("better-auth").StrictEndpoint<"/users/invitations/cancel", {
+        method: "POST";
+        use: import("better-auth").Middleware<{
+          use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+            session: {
+              session: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                userId: string;
+                expiresAt: Date;
+                token: string;
+                ipAddress?: string | null | undefined;
+                userAgent?: string | null | undefined;
+              };
+              user: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+              };
+            };
+          }>>[];
+        }, (inputContext: import("better-auth").MiddlewareInputContext<{
+          use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+            session: {
+              session: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                userId: string;
+                expiresAt: Date;
+                token: string;
+                ipAddress?: string | null | undefined;
+                userAgent?: string | null | undefined;
+              };
+              user: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+              };
+            };
+          }>>[];
+        }>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          } & {
+            session: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            } & Record<string, any>;
+            user: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            } & Record<string, any>;
+          };
+        }>>[];
+        body: import("zod").ZodObject<{
+          id: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        id: string;
+      }>;
+      userRoles: import("better-auth").StrictEndpoint<"/users/roles", {
+        method: "GET";
+        use: import("better-auth").Middleware<{
+          use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+            session: {
+              session: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                userId: string;
+                expiresAt: Date;
+                token: string;
+                ipAddress?: string | null | undefined;
+                userAgent?: string | null | undefined;
+              };
+              user: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+              };
+            };
+          }>>[];
+        }, (inputContext: import("better-auth").MiddlewareInputContext<{
+          use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+            session: {
+              session: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                userId: string;
+                expiresAt: Date;
+                token: string;
+                ipAddress?: string | null | undefined;
+                userAgent?: string | null | undefined;
+              };
+              user: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+              };
+            };
+          }>>[];
+        }>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          } & {
+            session: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            } & Record<string, any>;
+            user: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            } & Record<string, any>;
+          };
+        }>>[];
+      }, {
+        name: string;
+        label: string;
+        membership: boolean;
+        grants: string[];
+      }[]>;
     };
     hooks: {
       after: {
@@ -5240,7 +5678,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
-  })[]];
+  }];
   disabledPaths: string[];
   databaseHooks: {
     session?: {

package/dist/better-auth/create-auth.js

@@ -3,6 +3,8 @@ import { defaultAppName, readAppName } from "../app-name.js";
 import { authBasePath } from "./auth-base-path.js";
 import { platformMailer } from "../mail/platform-mailer.js";
 import { readOperatorSettings, resolveOperator } from "./operator-provider.js";
+import { defaultInvitationUrl } from "./invitations/invitation-link-hook.js";
+import { lastAdminGuardPlugin } from "./last-admin-guard.js";
 import { roleDefinitions } from "./organizations/role-definitions.js";
 import { lastOrganizationField, organizationClaims, sessionOrganizationHooks } from "./organizations/session-organization.js";
 import { organizationPlugin } from "./organizations/organization-plugin.js";
@@ -21,6 +23,7 @@ import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./
 import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
 import { twoFactorAfterPasswordOrCode } from "./two-factor-challenge.js";
+import { usersPlugin } from "./users/users-plugin.js";
 import { APIError } from "better-auth/api";
 import { betterAuth } from "better-auth";
 import { admin, emailOTP, genericOAuth, jwt } from "better-auth/plugins";
@@ -143,6 +146,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				...mail && { mail }
 			}),
 			rolesPlugin({ definitions }),
+			lastAdminGuardPlugin(),
 			...organizations ? [organizationPlugin({
 				resolved: organizations,
 				secret: options.secret,
@@ -151,7 +155,14 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			}), protobaseOrganizationPlugin({
 				resolved: organizations,
 				mail: Boolean(mailer)
-			})] : []
+			})] : [],
+			usersPlugin({
+				definitions,
+				...mail && { mail },
+				invitationUrl: organizations?.invitationUrl ?? defaultInvitationUrl(options.baseURL),
+				invitationSeconds: organizations?.invitationExpiresIn ?? 604800,
+				...organizations && { organizations }
+			})
 		],
 		disabledPaths: [
 			...unusedEmailCodePaths,

package/dist/better-auth/invitations/account-from-invitation.js

@@ -0,0 +1,50 @@
+import { effectiveSignInPolicy } from "../sign-in-policy.js";
+import { readSignInPolicy } from "../policy-store.js";
+import { checkNewAccountPassword } from "../new-account-password.js";
+import { setSessionCookie } from "better-auth/cookies";
+//#region src/better-auth/invitations/account-from-invitation.ts
+/**
+* Creates the account of an invited address: verified, since the invitation link proves the person reads it, with
+* `role` and, when given, a password checked against the sign-in policy. A password is needed unless the policy offers
+* emailed codes.
+*/
+const createInvitedAccount = async (ctx, input) => {
+	const { internalAdapter } = ctx.context;
+	checkNewAccountPassword(effectiveSignInPolicy((await readSignInPolicy(ctx.context.adapter)).policy, { mail: input.mail }), input.password);
+	const user = await internalAdapter.createUser({
+		email: input.email.toLowerCase(),
+		name: input.name,
+		emailVerified: true,
+		role: input.role
+	}, { method: "invitation" });
+	if (input.password !== void 0) await internalAdapter.linkAccount({
+		userId: user.id,
+		providerId: "credential",
+		accountId: user.id,
+		password: await ctx.context.password.hash(input.password)
+	});
+	return user;
+};
+/** Signs the new account in, in `activeOrganizationId` when given; the policy's required methods are then set up as after any sign-in. */
+const signInInvitedAccount = async (ctx, user, activeOrganizationId) => {
+	const { internalAdapter } = ctx.context;
+	const session = await internalAdapter.createSession(user.id, false);
+	if (activeOrganizationId === void 0) {
+		await setSessionCookie(ctx, {
+			session,
+			user
+		});
+		return session;
+	}
+	await internalAdapter.updateSession(session.token, { activeOrganizationId });
+	await setSessionCookie(ctx, {
+		session: {
+			...session,
+			activeOrganizationId
+		},
+		user
+	});
+	return session;
+};
+//#endregion
+export { createInvitedAccount, signInInvitedAccount };