@protobase/server 0.21.3 → 0.21.4

package/dist/app-name.js

@@ -1,9 +1,11 @@
 //#region src/app-name.ts
 const appNameVariable = "PROTOBASE_APP_NAME";
+/** The app's name when neither the app nor the platform names it. */
+const defaultAppName = "Protobase";
 /**
 * The app's name the platform passes in `PROTOBASE_APP_NAME`, such as `Property Finder`; `undefined` when it is not
 * set. Protobase names the app with it in sign-in prompts and in the mail it sends, unless the app names itself.
 */
 const readAppName = (env) => env["PROTOBASE_APP_NAME"]?.trim() || void 0;
 //#endregion
-export { appNameVariable, readAppName };
+export { appNameVariable, defaultAppName, readAppName };

package/dist/better-auth/create-auth.d.ts

@@ -800,7 +800,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
+              userAgent? /** Open sign-up is on and offered: the app asks for it, and can mail the codes. */ : string | null | undefined;
             };
           };
         }>>[];
@@ -3749,15 +3749,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           name?: string;
           slug?: string;
           logo?: string | null;
-          metadata?
-          /**
-           * The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
-           * sign-in provider already resolved.
-           */
-          /**
-           * The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
-           * sign-in provider already resolved.
-           */ : Record<string, any>;
+          metadata?: Record<string, any>;
           [key: string]: any;
         };
       }>;
@@ -4240,7 +4232,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     hooks: {
       after: {
         matcher: (context: {
-          path?: string;
+          path? /** Sign-in attempts allowed per minute and client, default 5; also the sign-up requests allowed. */ : string;
         }) => boolean;
         handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
       }[];
@@ -4374,6 +4366,8 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   /** Open sign-up is on and offered: the app asks for it, and can mail the codes. */
   signUp: boolean;
   socialProviders: string[];
+  /** The app's name it signs in and mails as: `appName`, else `PROTOBASE_APP_NAME`, else `Protobase`. */
+  appName: string;
   operator: string | undefined;
   platformSignIn: {
     provider: string;

package/dist/better-auth/create-auth.js

@@ -1,5 +1,5 @@
 import { multiHostBaseURL, readOrigins, resolveOrigins } from "./origins.js";
-import { readAppName } from "../app-name.js";
+import { defaultAppName, readAppName } from "../app-name.js";
 import { platformMailer } from "../mail/platform-mailer.js";
 import { readOperatorSettings, resolveOperator } from "./operator-provider.js";
 import { roleDefinitions } from "./organizations/role-definitions.js";
@@ -29,7 +29,6 @@ const platformSignInSettings = () => readPlatformSignIn(globalThis.process?.env
 const platformOrigins = () => readOrigins(globalThis.process?.env ?? {});
 const platformPasskeyDomain = () => readPasskeyDomain(globalThis.process?.env ?? {});
 const platformAppName = () => readAppName(globalThis.process?.env ?? {});
-const defaultAppName = "Protobase";
 const tokenLifetime = "15m";
 const authBasePath = "/api/auth";
 /**
@@ -277,6 +276,8 @@ const createAuth = (options) => {
 		/** Open sign-up is on and offered: the app asks for it, and can mail the codes. */
 		signUp: Boolean(signUpRole && mailer),
 		socialProviders,
+		/** The app's name it signs in and mails as: `appName`, else `PROTOBASE_APP_NAME`, else `Protobase`. */
+		appName: appName ?? "Protobase",
 		operator: operator?.name,
 		platformSignIn: platformSignIn && {
 			provider: platformSignIn.provider,

package/dist/blocked-delete.js

@@ -0,0 +1,38 @@
+import { HttpProblem } from "./problem.js";
+import { requestAccess } from "./request-access.js";
+//#region src/blocked-delete.ts
+/**
+* The resource whose rows kept `deleted`'s record from being deleted, from the table a foreign key violation names, and
+* its relation field pointing at `deleted` when there is exactly one, on a single column, so its list can be filtered by
+* it. `undefined` when no resource or several read that table, or none of its fields points at `deleted`, as when a
+* cascade was blocked further down.
+*/
+const blockingRelation = (error, deleted, entries) => {
+	const tables = entries.filter(({ model }) => model.table.name === error.table && (model.table.schema === void 0 || model.table.schema === error.schema));
+	if (tables.length !== 1) return void 0;
+	const entry = tables[0];
+	const pointing = Object.entries(entry.model.fields).filter(([, field]) => field.type === "relation" && field.relation?.resource === deleted.name);
+	if (pointing.length === 0) return void 0;
+	const only = pointing.length === 1 ? pointing[0] : void 0;
+	return only && only[1].relation.columns.length === 1 ? {
+		entry,
+		field: only[0]
+	} : { entry };
+};
+/**
+* The 409 for a delete other records still point at. It names their resource (`blockedBy`) only to a caller who may
+* list it, and the field pointing at the record only when they may filter by it, as with any field they cannot see.
+*/
+const blockedDelete = async (deps, access, error) => {
+	const match = blockingRelation(error, access.entry, deps.registry.entries);
+	const blocking = match && await requestAccess(deps, match.entry, access.session);
+	const listed = blocking && blocking.resolved.operations.list;
+	const field = listed && match.field && blocking.model.fields[match.field]?.filterable ? match.field : void 0;
+	const blockedBy = listed ? {
+		resource: match.entry.name,
+		...field && { field }
+	} : void 0;
+	return new HttpProblem(409, "conflict", "Conflict", "Other records still point at this record", blockedBy && { blockedBy });
+};
+//#endregion
+export { blockedDelete, blockingRelation };

package/dist/create-admin.js

@@ -6,6 +6,7 @@ import { builtInAssistant } from "./assistant/built-in-assistant.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { webauthnPath } from "./better-auth/origins.js";
 import { apiCors, readCorsOrigins } from "./api-cors.js";
+import { readAppName } from "./app-name.js";
 import { authBasePath } from "./better-auth/create-auth.js";
 import { organizationRoutes } from "./better-auth/organizations/admin-routes.js";
 import { statusRoute } from "./better-auth/status-route.js";
@@ -131,7 +132,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 			...auth && { actorNames: betterAuthActorNames(auth) }
 		} }
 	};
-	const meta = createMeta(deps);
+	const meta = createMeta(deps, auth?.appName ?? readAppName(globalThis.process?.env ?? {}) ?? "Protobase");
 	const onError = createErrorHandler(options.onUnhandledError);
 	const guarded = (routes, caller = authenticate) => {
 		const app = new Hono();

package/dist/error-handler.js

@@ -41,4 +41,4 @@ const createErrorHandler = (onUnhandledError) => (error, c) => {
 	return problemResponse(new HttpProblem(500, "internal-error", titles[500], "The server failed to handle the request"), c.req.path);
 };
 //#endregion
-export { createErrorHandler, problemOf };
+export { createErrorHandler, isDatabaseError, problemOf };

package/dist/meta.js

@@ -28,7 +28,7 @@ const modelsHash = (deps) => sha256Hex(stableJson(deps.registry.entries.map((ent
 * they could use once signed in, which keep their place in the bottom bar and the user menu.
 * The ETag hashes all of it, so it differs per user and per roles.
 */
-const createMeta = (deps) => {
+const createMeta = (deps, appName) => {
 	const base = modelsHash(deps);
 	const forCaller = async (session) => {
 		const accesses = await Promise.all(deps.registry.entries.map((entry) => requestAccess(deps, entry, session)));
@@ -55,6 +55,7 @@ const createMeta = (deps) => {
 		const plugins = pluginsFor(deps.plugins, session.user.roles);
 		const sources = sourcesFor(deps.sources, session.user.roles);
 		const body = {
+			appName,
 			resources: visible.map((access) => access.readable),
 			views,
 			pages,

package/dist/write-pipeline.js

@@ -1,8 +1,10 @@
 import { HttpProblem, badRequest } from "./problem.js";
+import { isDatabaseError } from "./error-handler.js";
 import { deleteRecord, fetchRecord, insertRecord, restoreRecord } from "./records.js";
 import { tenantScope } from "./tenant.js";
 import { requestAccess, requireOperation, targetFilter, writableFields } from "./request-access.js";
 import { writeTransaction } from "./transactions.js";
+import { blockedDelete } from "./blocked-delete.js";
 import { attachFiles } from "./files/attach.js";
 import { actorSettings, wakeDispatch } from "./changes/actor.js";
 import { validateBody } from "./validate-body.js";
@@ -71,7 +73,10 @@ const removeOrRestore = async (trx, deps, access, request) => {
 		await notify(trx, "undelete", current.record, restored.record);
 		return shown(access, restored);
 	}
-	const removed = await deleteRecord(trx, entry, request.key, scope?.tenantValue, shape);
+	const removed = await deleteRecord(trx, entry, request.key, scope?.tenantValue, shape).catch(async (error) => {
+		if (isDatabaseError(error) && error.code === "23503") throw await blockedDelete(deps, access, error);
+		throw error;
+	});
 	await notify(trx, "delete", current.record, void 0);
 	return shown(access, removed);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.21.3",
+  "version": "0.21.4",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,9 +30,9 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.21.3",
-    "@protobase/query": "0.21.3",
-    "@protobase/schema": "0.21.3",
+    "@protobase/layout": "0.21.4",
+    "@protobase/query": "0.21.4",
+    "@protobase/schema": "0.21.4",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",