@protobase/server 0.21.5 → 0.21.7

package/dist/anonymous.js

@@ -1,6 +1,6 @@
 import { MissingCredentials } from "./problem.js";
 import { anonymousRole } from "@protobase/schema";
-//#region src/anonymous.ts
+/** A caller without a token, acting as the `anonymous` role, with no tenant. */
 const anonymousSession = () => ({
 	user: {
 		id: "",
@@ -23,5 +23,10 @@ const withAnonymous = (authenticate, roles) => {
 		}
 	};
 };
+/**
+* Whether visitors browse the admin app without signing in: the anonymous role reads a resource. One that only creates,
+* through public forms, leaves the app behind sign-in.
+*/
+const visitorsBrowse = (roles) => (roles?.limits ?? []).some(({ role, capability }) => role === anonymousRole && capability.endsWith(".read"));
 //#endregion
-export { withAnonymous };
+export { anonymousSession, visitorsBrowse, withAnonymous };

package/dist/better-auth/status-route.js

@@ -14,7 +14,7 @@ import { Hono } from "hono";
 * operator provider's name, when staff can sign in as people; `passkeyDomains`, when people have passkeys for more than
 * one of the app's hosts, the RP IDs a passkey sign-in can ask for, the passkey domain first; with organizations, who may create them and the roles
 * with their labels, `membership` for those a member can hold, and the roles each one's holders may also give; and
-* `anonymous` when the project has an anonymous role, so the admin app opens for visitors before anyone signs in; and
+* `anonymous` when the project's anonymous role reads a resource, so the admin app opens for visitors before anyone signs in; and
 * `plugins`, those the app loads before sign-in (see `PluginOption`).
 */
 const statusRoute = (auth, { anonymous = false, plugins = [] } = {}) => {

package/dist/changes/capture-schema.d.ts

@@ -1,6 +1,6 @@
 import { EventsOptions } from "./events-options.js";
-import { ResourceModel } from "@protobase/schema";
 import { Db } from "@protobase/query";
+import { ResourceModel } from "@protobase/schema";
 //#region src/changes/capture-schema.d.ts
 /** The command that writes what the config needs as a migration file of the project. */
 export declare const migrationCommand = "protobase migration";

package/dist/changes/match-events.js

@@ -1,6 +1,6 @@
 import { EventCodeError } from "./event-code-error.js";
-import { evaluateFilter } from "@protobase/schema";
 import { checkEventFilter } from "@protobase/schema/internal";
+import { evaluateFilter } from "@protobase/schema";
 //#region src/changes/match-events.ts
 const filterOf = (model, source) => {
 	const { filter, problem } = checkEventFilter(model, source);

package/dist/changes/outbox.d.ts

@@ -1,7 +1,7 @@
 import { Row } from "../types.js";
 import { CapturedRow } from "./coalesce.js";
-import { ResourceModel } from "@protobase/schema";
 import { Db } from "@protobase/query";
+import { ResourceModel } from "@protobase/schema";
 //#region src/changes/outbox.d.ts
 /**
  * A captured row's columns from the JSON text the database stores: the columns of 64-bit integer and decimal fields as

package/dist/check-roles.js

@@ -12,7 +12,7 @@ const checkRoleLimits = (registry, limits) => {
 		if (!model) throw new Error(`Role "${role}" limits "${capability}" but "${name}" is not a resource`);
 		const unknown = fields?.find((field) => !Object.hasOwn(model.fields, field));
 		if (unknown) throw new Error(`Role "${role}" lists the field "${unknown}" for "${capability}" but ${name} has no such field`);
-		if (role === anonymousRole && model.tenant) throw new Error(`The anonymous role reads ${name}, which is tenant-scoped, but an anonymous caller works in no organization`);
+		if (role === anonymousRole && model.tenant) throw new Error(`The anonymous role grants "${capability}" on ${name}, which is tenant-scoped, but an anonymous caller works in no organization`);
 		if (!filter) continue;
 		const trusted = {
 			...model,

package/dist/check-shell.js

@@ -1,5 +1,5 @@
-import { bottomBarErrors } from "@protobase/schema";
 import { navRecentErrors } from "@protobase/schema/internal";
+import { bottomBarErrors } from "@protobase/schema";
 //#region src/check-shell.ts
 /** Fails at startup when a sidebar group or a user menu entry does not fit the resources, instead of on the first page load. */
 const checkShell = (registry, views, userMenu, pages = []) => {

package/dist/create-admin.d.ts

@@ -6,11 +6,12 @@ import { Admin, Authenticator, PageSource, ViewSource } from "./types.js";
 import { WebhooksOptions } from "./webhooks/table/options.js";
 import { SubscriptionDefinition } from "./webhooks/subscription.js";
 import { FilesOptions } from "./files/options.js";
+import { Difficulty } from "./forms/challenge.js";
 import { ResourceSource } from "./resource-source.js";
 import { FunctionSource } from "./functions/define-function.js";
 import { AdminOptions } from "./admin-options.js";
-import { BottomBarSource, UserMenuSource } from "@protobase/schema";
 import { Db } from "@protobase/query";
+import { BottomBarSource, UserMenuSource } from "@protobase/schema";
 //#region src/create-admin.d.ts
 export type CreateAdminInput = {
   resources: ResourceSource[];
@@ -52,7 +53,9 @@ export type CreateAdminInput = {
    */
   fieldTypes?: Record<string, string[]>;
   options?: AdminOptions;
+  /** @internal The proof-of-work range of public forms' bot checks, which tests make tiny. */
+  formsDifficulty?: Difficulty;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, bundlePlugins, fieldTypes, options }: CreateAdminInput) => Admin;
+export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, bundlePlugins, fieldTypes, options, formsDifficulty }: CreateAdminInput) => Admin;
 //#endregion

package/dist/create-admin.js

@@ -20,7 +20,7 @@ import { toApiFunction } from "./functions/define-function.js";
 import { createWebhooks } from "./webhooks/webhooks.js";
 import { webhookTable } from "./webhooks/table/webhook-table.js";
 import { subscriptionWriteCheck } from "./webhooks/table/validate-hook.js";
-import { withAnonymous } from "./anonymous.js";
+import { visitorsBrowse, withAnonymous } from "./anonymous.js";
 import { checkBottomBars, checkShell } from "./check-shell.js";
 import { checkOwnerFields } from "./check-owners.js";
 import { checkRoleLimits } from "./check-roles.js";
@@ -28,6 +28,8 @@ import { checkViews } from "./check-views.js";
 import { errorReportingSettings } from "./error-reporting/error-reporting-settings.js";
 import { createFilesRuntime } from "./files/runtime.js";
 import { fileRoutes } from "./files/routes.js";
+import { formRoutes } from "./forms/routes.js";
+import { createFormsRuntime } from "./forms/runtime.js";
 import { functionRoutes } from "./functions/routes.js";
 import { mapSettings } from "./maps/map-settings.js";
 import { pluginOptions, pluginsBeforeSignIn } from "./plugins/plugin-settings.js";
@@ -44,14 +46,13 @@ import { createScanGuard } from "./scan-guard.js";
 import { failedJobs, failedJobsView } from "./jobs/failed-jobs.js";
 import { Hono } from "hono";
 import { checkPages } from "@protobase/layout";
-import { anonymousRole } from "@protobase/schema";
 //#region src/create-admin.ts
 const declaredRoles = (auth, roles) => {
 	const names = [...auth?.roles ?? [], ...Object.keys(roles?.definitions ?? {})];
 	return names.length > 0 ? [...new Set(names)] : void 0;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, bundlePlugins = [], fieldTypes = {}, options = {} }) => {
+const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty }) => {
 	const basePath = options.basePath ?? "/api/v1";
 	const appModels = appResources.map((resource) => resource.toModel());
 	const withJobs = jobs.length > 0 || appModels.some(isCaptured);
@@ -83,6 +84,13 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		models: Object.fromEntries(registry.entries.map((entry) => [entry.name, entry.model])),
 		actions: (resource) => new Set(viewModels.filter((view) => view.resource === resource).flatMap((view) => view.actions.map((action) => action.name)))
 	});
+	const forms = createFormsRuntime({
+		registry,
+		views: viewModels,
+		limits: options.roles?.limits ?? [],
+		env: globalThis.process?.env ?? {},
+		...formsDifficulty && { difficulty: formsDifficulty }
+	});
 	const systemPath = basePath.slice(0, basePath.lastIndexOf("/"));
 	const assistant = assistantSettings(options.assistant, globalThis.process?.env ?? {});
 	const runtime = runtimeUrl(options.runtime, globalThis.process?.env ?? {});
@@ -173,7 +181,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	}
 	if (auth) {
 		app.route(authBasePath, statusRoute(auth, {
-			anonymous: Object.hasOwn(options.roles?.definitions ?? {}, anonymousRole),
+			anonymous: visitorsBrowse(options.roles),
 			plugins: pluginsBeforeSignIn(plugins)
 		}));
 		if (auth.organizations) app.route(authBasePath, organizationRoutes({
@@ -209,6 +217,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	}));
 	app.route("/", batchRoute(deps, authenticate, meta));
 	app.route("/", fileRoutes(deps, authenticate));
+	if (forms) app.route(`${systemPath}/forms`, formRoutes(deps, forms));
 	app.route(basePath, api);
 	app.route(`${deps.systemPath}/meta`, metaApp);
 	app.route(deps.systemPath || "/", system);

package/dist/deps.d.ts

@@ -4,5 +4,5 @@ import "./plugins/plugin-settings.js";
 import "./registry.js";
 import "./scan-guard.js";
 import { PageModel } from "@protobase/layout";
-import { ResolveOptions, ViewModel } from "@protobase/schema";
-import { Db } from "@protobase/query";
+import { Db } from "@protobase/query";
+import { ResolveOptions, ViewModel } from "@protobase/schema";

package/dist/files/cleanup-runner.d.ts

@@ -1,5 +1,5 @@
-import { ResourceModel } from "@protobase/schema";
 import { Db } from "@protobase/query";
+import { ResourceModel } from "@protobase/schema";
 //#region src/files/cleanup-runner.d.ts
 export type CleanupReport = {
   deleted: string[];

package/dist/files/runtime.d.ts

@@ -1,5 +1,5 @@
 import "./images.js";
 import "./options.js";
 import "./cleanup-runner.js";
-import { ResourceModel } from "@protobase/schema";
-import { Db } from "@protobase/query";
+import { Db } from "@protobase/query";
+import { ResourceModel } from "@protobase/schema";

package/dist/forms/challenge.d.ts

@@ -0,0 +1,8 @@
+import "altcha-lib";
+//#region src/forms/challenge.d.ts
+/** The range of rounds a challenge is made for. */
+export type Difficulty = {
+  min: number;
+  max: number;
+};
+//#endregion

package/dist/forms/challenge.js

@@ -0,0 +1,71 @@
+import { CappedMap, createChallenge, randomInt, verifySolution } from "altcha-lib";
+import { deriveKey } from "altcha-lib/algorithms/web/sha";
+//#region src/forms/challenge.ts
+/**
+* How many SHA-256 rounds a visitor's browser runs to send a form: the challenge is made for one count in this range,
+* and the solver counts up to it. About a second in Chromium on a current laptop: 0.4 s at the low end and 1.1 s at
+* the high end, measured on an Apple M1 Pro.
+*/
+const formDifficulty = {
+	min: 5e4,
+	max: 1e5
+};
+const expiresInSeconds = 300;
+const spentCapacity = 1e4;
+const encoder = new TextEncoder();
+const toHex = (bytes) => [...new Uint8Array(bytes)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+const purposeKey = async (secret, info) => {
+	const material = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, ["deriveBits"]);
+	return toHex(await crypto.subtle.deriveBits({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: /* @__PURE__ */ new Uint8Array(0),
+		info: encoder.encode(info)
+	}, material, 256));
+};
+const isProof = (value) => {
+	if (typeof value !== "object" || value === null) return false;
+	const { challenge, solution } = value;
+	return typeof challenge === "object" && challenge !== null && typeof challenge.parameters === "object" && typeof solution === "object" && solution !== null;
+};
+/**
+* The bot check of public forms: a signed proof-of-work challenge (ALTCHA) per submission, made for one form and valid
+* for five minutes, which verifies once. The secret signs the challenges, so they verify on every instance that shares it.
+*/
+const createFormChallenges = (secret, { difficulty = formDifficulty, now = Date.now } = {}) => {
+	const keys = Promise.all([purposeKey(secret, "protobase forms challenge"), purposeKey(secret, "protobase forms key")]);
+	const spent = new CappedMap({ maxSize: spentCapacity });
+	const issue = async (form) => {
+		const [hmacSignatureSecret, hmacKeySignatureSecret] = await keys;
+		return createChallenge({
+			algorithm: "SHA-256",
+			cost: 1,
+			deriveKey,
+			counter: randomInt(difficulty.max, difficulty.min),
+			data: { form },
+			expiresAt: Math.floor(now() / 1e3) + expiresInSeconds,
+			hmacSignatureSecret,
+			hmacKeySignatureSecret
+		});
+	};
+	const verify = async (form, proof) => {
+		if (!isProof(proof) || proof.challenge.parameters.data?.form !== form) return "invalid";
+		const [hmacSignatureSecret, hmacKeySignatureSecret] = await keys;
+		const result = await verifySolution({
+			challenge: proof.challenge,
+			solution: proof.solution,
+			deriveKey,
+			hmacSignatureSecret,
+			hmacKeySignatureSecret
+		});
+		if (result.expired) return "expired";
+		if (!result.verified) return "invalid";
+		return spent.setIfAbsent(proof.challenge.signature, true) ? "ok" : "replayed";
+	};
+	return {
+		issue,
+		verify
+	};
+};
+//#endregion
+export { createFormChallenges, formDifficulty };

package/dist/forms/check-forms.js

@@ -0,0 +1,59 @@
+import { requiredOnCreate } from "../validate-body.js";
+//#region src/forms/check-forms.ts
+const plainTypes = [
+	"text",
+	"integer",
+	"bigint",
+	"decimal",
+	"boolean",
+	"date",
+	"enum",
+	"currency",
+	"country"
+];
+const fieldErrors = (registry, { form, view }, granted) => {
+	const entry = registry.find(view.resource);
+	if (!entry) return [];
+	const { model } = entry;
+	if (!granted) return [`the anonymous role must grant creating its fields: { '${view.resource}.create': [${form.fields.map((name) => `'${name}'`).join(", ")}] }`];
+	const fields = form.fields.flatMap((name) => {
+		const field = model.fields[name];
+		if (!field) return [`field "${name}" does not exist on ${view.resource}`];
+		if (field.readOnly) return [`field "${name}" is read-only, so nobody fills it in`];
+		if (field.sensitive) return [`field "${name}" is sensitive, and a public form does not take sensitive fields`];
+		if (field.type === "relation") return [`field "${name}" is a relation, whose records a visitor cannot read to pick one`];
+		if (field.type === "file") return [`field "${name}" is a file field, and a visitor cannot upload`];
+		if (!plainTypes.includes(field.type)) return [`field "${name}" is ${field.type}, which a form has no input for`];
+		if (name === model.tenant) return [`field "${name}" is the tenant, which the server sets`];
+		if (!granted.includes(name)) return [`the anonymous role does not create "${name}": add it to { '${view.resource}.create': [...] }`];
+		return [];
+	});
+	const sources = entry.source.state.fields ?? {};
+	const missing = Object.values(model.fields).filter((field) => !field.readOnly && field.name !== model.tenant && !form.fields.includes(field.name)).filter((field) => sources[field.name] && requiredOnCreate(field, sources[field.name].schema)).map((field) => `it leaves out "${field.name}", which every create must give, so no submission could be saved`);
+	return [...fields, ...missing];
+};
+/**
+* What stops startup about the public forms: a name two forms share, a resource that does not exist, and fields a
+* visitor cannot fill in, the anonymous role does not create, or that leave out a field the create needs. Identical forms
+* on several views of one resource, such as one view built on another, count as one. Returns the forms by name.
+*/
+const checkForms = (registry, declared, anonymousCreates) => {
+	const forms = /* @__PURE__ */ new Map();
+	const problems = [];
+	for (const item of declared) {
+		const { form, view } = item;
+		const where = `View "${view.resource}": form "${form.name}"`;
+		const taken = forms.get(form.name);
+		if (taken) {
+			if (!(taken.view.resource === view.resource && JSON.stringify(taken.form) === JSON.stringify(form))) problems.push(`${where}: the name is taken by a form of ${taken.view.resource}; form names are unique across the app`);
+			continue;
+		}
+		forms.set(form.name, item);
+		if (!registry.find(view.resource)) problems.push(`${where}: there is no resource "${view.resource}"`);
+		problems.push(...fieldErrors(registry, item, anonymousCreates(view.resource)).map((problem) => `${where}: ${problem}`));
+	}
+	if (problems.length > 0) throw new Error(`The public forms cannot be served:\n${problems.map((problem) => `  - ${problem}`).join("\n")}`);
+	return forms;
+};
+//#endregion
+export { checkForms };

package/dist/forms/rate-limit.js

@@ -0,0 +1,38 @@
+import { getIP } from "better-auth/api";
+//#region src/forms/rate-limit.ts
+const windowMs = 6e4;
+/**
+* The client a request counts against, as Better Auth's sign-in limit reads it: an `X-Forwarded-For` of one valid
+* address (IPv6 by its /64), or `unknown`, one bucket for every request without one (several addresses included, since
+* the leftmost is whatever the client sent). In development and tests a request without one is `127.0.0.1`.
+*/
+const clientAddress = (headers) => getIP(headers, {}) ?? "unknown";
+/**
+* At most `perMinute` takes per key in a fixed window of a minute, kept in this process. Keys whose window has passed are
+* dropped as new ones come, so memory follows the clients of the last minute.
+*/
+const createRateLimit = ({ now = Date.now } = {}) => {
+	const windows = /* @__PURE__ */ new Map();
+	const prune = (at) => {
+		for (const [key, window] of windows) if (at - window.start >= windowMs) windows.delete(key);
+	};
+	/** Counts a take for `key`: `0` when allowed, else the seconds until its window lets it through again. */
+	const take = (key, perMinute) => {
+		const at = now();
+		const current = windows.get(key);
+		if (!current || at - current.start >= windowMs) {
+			prune(at);
+			windows.set(key, {
+				start: at,
+				count: 1
+			});
+			return 0;
+		}
+		if (current.count >= perMinute) return Math.ceil((current.start + windowMs - at) / 1e3);
+		current.count += 1;
+		return 0;
+	};
+	return { take };
+};
+//#endregion
+export { clientAddress, createRateLimit };

package/dist/forms/routes.js

@@ -0,0 +1,83 @@
+import { HttpProblem, badRequest, notFound } from "../problem.js";
+import { runWrite } from "../write-pipeline.js";
+import { anonymousSession } from "../anonymous.js";
+import { pruneView } from "../view-access.js";
+import { clientAddress } from "./rate-limit.js";
+import { Hono } from "hono";
+import { restrictModel } from "@protobase/schema";
+//#region src/forms/routes.ts
+const refusedProof = {
+	invalid: "The check that you are not a bot failed; send the form again",
+	expired: "The check that you are not a bot expired; send the form again",
+	replayed: "This check was already used; send the form again"
+};
+const formPage = (deps, { form, view }) => {
+	const entry = deps.registry.find(view.resource);
+	const model = restrictModel(entry.model, {
+		readableFields: form.fields,
+		writableFields: {
+			create: form.fields,
+			update: []
+		}
+	});
+	const pruned = pruneView(view, model, { [model.name]: model });
+	const shown = {
+		resource: view.resource,
+		...view.names && { names: view.names },
+		fields: pruned.fields,
+		filters: [],
+		layout: [],
+		actions: []
+	};
+	return {
+		name: form.name,
+		...form.title !== void 0 && { title: form.title },
+		fields: form.fields,
+		thanks: form.thanks,
+		resource: model,
+		view: shown
+	};
+};
+/**
+* Beside the API, without sign-in: `GET <systemPath>/forms/<name>` describes a public form, `GET .../<name>:challenge`
+* hands out a bot check, and `POST .../<name>` with `{ values, proof }` creates the record as the anonymous role, limited
+* to the form's fields, after the rate limit and the check. It answers `204`: the visitor never reads the record back.
+*/
+const formRoutes = (deps, runtime) => {
+	const app = new Hono();
+	const find = (target) => {
+		const colon = target.indexOf(":");
+		const declared = runtime.forms.get(colon < 0 ? target : target.slice(0, colon));
+		if (!declared) throw notFound(`There is no form "${colon < 0 ? target : target.slice(0, colon)}"`);
+		return {
+			declared,
+			action: colon < 0 ? "" : target.slice(colon + 1)
+		};
+	};
+	app.get("/:target", async (c) => {
+		const { declared, action } = find(c.req.param("target"));
+		if (action === "challenge") return c.json(await runtime.challenges.issue(declared.form.name), 200, { "Cache-Control": "no-store" });
+		if (action !== "") throw notFound(`There is no method ":${action}"`);
+		return c.json(formPage(deps, declared));
+	});
+	app.post("/:target", async (c) => {
+		const { declared, action } = find(c.req.param("target"));
+		if (action !== "") throw notFound(`There is no method ":${action}"`);
+		const { form, view } = declared;
+		const wait = runtime.limit.take(`${form.name}|${clientAddress(c.req.raw.headers)}`, form.perMinute);
+		if (wait > 0) throw new HttpProblem(429, "too-many-submissions", "Too Many Requests", "This form was sent too often; wait a minute and send it again", {}, { "Retry-After": String(wait) });
+		const body = await c.req.json();
+		if (typeof body !== "object" || body === null || Array.isArray(body)) throw badRequest("invalid-submission", "Send the form as { values, proof }");
+		const { values, proof } = body;
+		const verdict = await runtime.challenges.verify(form.name, proof);
+		if (verdict !== "ok") throw badRequest("bot-check-failed", refusedProof[verdict]);
+		await runWrite(deps, deps.registry.find(view.resource), anonymousSession(), {
+			operation: "create",
+			body: values
+		}, form);
+		return c.body(null, 204);
+	});
+	return app;
+};
+//#endregion
+export { formRoutes };

package/dist/forms/runtime.js

@@ -0,0 +1,31 @@
+import { createRateLimit } from "./rate-limit.js";
+import { createFormChallenges } from "./challenge.js";
+import { checkForms } from "./check-forms.js";
+import { anonymousRole } from "@protobase/schema";
+//#region src/forms/runtime.ts
+/** The fields the anonymous role may create on `resource`, or `undefined` when it may not create there. */
+const anonymousCreates = (limits) => (resource) => {
+	const held = limits.filter((limit) => limit.role === anonymousRole && limit.capability === `${resource}.create`);
+	return held.length === 0 ? void 0 : held.flatMap((limit) => limit.fields ?? []);
+};
+/**
+* The public forms of the views, checked, with the challenges that guard them and their rate limit; `undefined` without
+* any. Fails at startup on a form that cannot be served and when nothing signs the challenges.
+*/
+const createFormsRuntime = ({ registry, views, limits, env, difficulty }) => {
+	const declared = [...views].sort((a, b) => Number(a.roles !== void 0) - Number(b.roles !== void 0)).flatMap((view) => (view.forms ?? []).map((form) => ({
+		form,
+		view
+	})));
+	if (declared.length === 0) return void 0;
+	const forms = checkForms(registry, declared, anonymousCreates(limits));
+	const secret = env.PROTOBASE_FORMS_SECRET ?? env.BETTER_AUTH_SECRET;
+	if (!secret) throw new Error("Public forms need a secret to sign their bot checks: set PROTOBASE_FORMS_SECRET or BETTER_AUTH_SECRET");
+	return {
+		forms,
+		challenges: createFormChallenges(secret, { ...difficulty && { difficulty } }),
+		limit: createRateLimit()
+	};
+};
+//#endregion
+export { createFormsRuntime };

package/dist/history/read-history.js

@@ -14,6 +14,7 @@ const params = z.object({
 	page_token: z.string().regex(/^\d+$/, "Use the next_page_token of the previous page").optional()
 });
 const defaultPageSize = 20;
+const visitorName = "Visitor";
 const picked = (row, names) => row ? Object.fromEntries(Object.entries(row).filter(([name]) => names.has(name))) : void 0;
 const shown = (row, readable, names) => {
 	const values = new Set(Object.values(readable.fields).filter((field) => !field.sensitive && !field.file).map((field) => field.name));
@@ -21,7 +22,7 @@ const shown = (row, readable, names) => {
 	if (row.operation === "update" && changed.length === 0) return [];
 	const before = picked(row.before, values);
 	const after = picked(row.after, values);
-	const name = row.actor_id === null ? void 0 : names[row.actor_id];
+	const name = row.actor_id === null ? void 0 : row.actor_id === "" ? visitorName : names[row.actor_id];
 	return [{
 		id: row.id,
 		at: row.at,
@@ -61,7 +62,7 @@ const readHistory = async (deps, entry, session, key, query) => {
 	});
 	if (!rows) throw notFound(`No ${entry.name} with this key`);
 	const page = rows.slice(0, size);
-	const ids = [...new Set(page.flatMap((row) => row.actor_id === null ? [] : [row.actor_id]))];
+	const ids = [...new Set(page.flatMap((row) => row.actor_id === null || row.actor_id === "" ? [] : [row.actor_id]))];
 	const names = ids.length > 0 && actorNames ? await actorNames(ids) : {};
 	return {
 		items: page.flatMap((row) => shown(row, access.readable, names)),

package/dist/list-photos.js

@@ -5,9 +5,9 @@ import { checkedSort } from "./filter-input.js";
 import { readScope, requestAccess } from "./request-access.js";
 import { readTransaction } from "./transactions.js";
 import { cardPhotosErrors } from "./view-card-photos.js";
-import { checkFilter, createWhere } from "@protobase/schema";
 import { cardPhotoLimit } from "@protobase/schema/internal";
 import { relatedRows } from "@protobase/query";
+import { checkFilter, createWhere } from "@protobase/schema";
 //#region src/list-photos.ts
 const where = createWhere();
 const invalid = (parameter, message) => badRequest("invalid-parameter", `Invalid ${parameter}: ${message}`, { errors: [{

package/dist/meta.js

@@ -1,14 +1,14 @@
 import { seesAssistant } from "./assistant/assistant-settings.js";
 import { sha256Hex, stableJson } from "./hash.js";
 import { requestAccess } from "./request-access.js";
+import { pruneView } from "./view-access.js";
 import { activeRole } from "./active-role.js";
 import { pluginsFor } from "./plugins/plugin-settings.js";
 import { seesRuntime } from "./runtime/runtime-settings.js";
 import { sourcesFor } from "./sources/source-settings.js";
-import { pruneView } from "./view-access.js";
 import { prunePage } from "@protobase/layout";
-import { pickView } from "@protobase/schema";
 import { bottomBarFor } from "@protobase/schema/internal";
+import { pickView } from "@protobase/schema";
 //#region src/meta.ts
 const signInView = (view) => {
 	if (!view?.signIn) return [];

package/dist/related-labels.js

@@ -1,8 +1,8 @@
 import { badRequest } from "./problem.js";
 import { exposeRow } from "./rows.js";
 import { readScope, requestAccess } from "./request-access.js";
-import { checkFilter, createWhere } from "@protobase/schema";
 import { listQuery } from "@protobase/query";
+import { checkFilter, createWhere } from "@protobase/schema";
 //#region src/related-labels.ts
 const where = createWhere();
 const invalid = (entry, message) => badRequest("invalid-parameter", `Invalid labels entry "${entry}": ${message}`, { errors: [{

package/dist/request-access.d.ts

@@ -1,5 +1,5 @@
 import "./types.js";
 import "./registry.js";
 import "./deps.js";
-import { ResourceModel } from "@protobase/schema";
-import "@protobase/query";
+import "@protobase/query";
+import { ResourceModel } from "@protobase/schema";

package/dist/request-access.js

@@ -9,14 +9,38 @@ const withoutSensitive = (model) => ({
 	...model,
 	fields: Object.fromEntries(Object.entries(model.fields).filter(([, field]) => !field.sensitive))
 });
-const requestAccess = async (deps, entry, session) => {
-	const resolved = await resolveAccess(entry.source, {
+const withoutAnonymousCreate = (resolved, session) => session.anonymous ? {
+	...resolved,
+	operations: {
+		...resolved.operations,
+		create: false
+	},
+	writableFields: {
+		...resolved.writableFields,
+		create: []
+	}
+} : resolved;
+const throughForm = (resolved, form) => {
+	const create = resolved.writableFields.create.filter((name) => form.fields.includes(name));
+	return {
+		...resolved,
+		readableFields: [.../* @__PURE__ */ new Set([...resolved.readableFields, ...create])],
+		writableFields: {
+			create,
+			update: []
+		}
+	};
+};
+/** `form` is the public form a visitor sends, the only way a caller without a token creates. */
+const requestAccess = async (deps, entry, session, form) => {
+	const all = await resolveAccess(entry.source, {
 		user: {
 			id: session.user.id,
 			roles: session.user.roles
 		},
 		...organizationOf(session)
 	}, deps.accessOptions);
+	const resolved = form ? throughForm(all, form) : withoutAnonymousCreate(all, session);
 	checkOwnerId(entry, session.user, resolved);
 	const readable = restrictModel(entry.model, resolved);
 	return {

package/dist/scan-guard.d.ts

@@ -1,4 +1,4 @@
 import "./types.js";
 import "./registry.js";
-import { ResourceModel } from "@protobase/schema";
-import { Db } from "@protobase/query";
+import { Db } from "@protobase/query";
+import { ResourceModel } from "@protobase/schema";

package/dist/types.d.ts

@@ -1,8 +1,8 @@
 import { JobDefinition } from "./jobs/job-types.js";
 import { Hono } from "hono";
 import { PageModel } from "@protobase/layout";
-import { ResourceModel, ViewModel } from "@protobase/schema";
 import { Db } from "@protobase/query";
+import { ResourceModel, ViewModel } from "@protobase/schema";
 //#region src/types.d.ts
 export type TenantValue = string | number;
 export type User = {

package/dist/validate-body.js

@@ -20,6 +20,11 @@ const isObject = (value) => typeof value === "object" && value !== null && !Arra
 const reserved = ["etag", "permissions"];
 const isEmptyText = (field, value) => field.type === "text" && !field.nullable && value === "";
 /**
+* Whether a create must give the field, as `validateBody` decides when it is missing: the database supplies no value,
+* it may not be null, and its schema has no default of its own (`.default()`).
+*/
+const requiredOnCreate = (field, schema) => !(field.default && "db" in field.default) && !field.nullable && !schema.safeParse(void 0).success;
+/**
 * Checks a create or update body for this caller. A field the caller cannot read is an unknown field, one they can read
 * but not write is read-only (the tenant column and the API's own `etag` and `permissions` keys are always read-only);
 * every provided value goes through its field's zod schema, then `.validate()` rules run on the result. An empty text
@@ -92,4 +97,4 @@ const validateBody = (access, mode, body, current = {}) => {
 	return values;
 };
 //#endregion
-export { validateBody };
+export { requiredOnCreate, validateBody };

package/dist/view-access.js

@@ -235,7 +235,8 @@ const viewShape = (resource, model, models, prompted) => shapes.object({
 	searchesOf: shapes.map((searches) => searchesOfFor(searches, resource, models)),
 	import: shapes.data,
 	export: shapes.data,
-	create: shapes.data
+	create: shapes.data,
+	forms: shapes.map(() => void 0)
 });
 /**
 * The view with every reference to a field the caller cannot read removed: list columns, sort, search and displays,

package/dist/webhooks/route-events.js

@@ -1,7 +1,7 @@
 import { EventCodeError } from "../changes/event-code-error.js";
 import { eventPatternMatches } from "./subscription.js";
-import { evaluateFilter } from "@protobase/schema";
 import { checkEventFilter } from "@protobase/schema/internal";
+import { evaluateFilter } from "@protobase/schema";
 //#region src/webhooks/route-events.ts
 const declaredEvents = (models) => models.flatMap((model) => (model.events ?? []).map((event) => ({
 	model,

package/dist/webhooks/subscription.d.ts

@@ -1,6 +1,6 @@
 import { Row, TenantValue } from "../types.js";
-import { EventActor, EventOperation } from "@protobase/schema";
 import { Db } from "@protobase/query";
+import { EventActor, EventOperation } from "@protobase/schema";
 //#region src/webhooks/subscription.d.ts
 /** What happened, as a receiver gets it in the `data` of an event. Records use field names, as the API shows them. */
 export type EventData = {

package/dist/write-pipeline.js

@@ -91,9 +91,12 @@ const writeIn = async (trx, deps, access, request) => {
 	if (request.operation === "update") return update(trx, deps, access, request);
 	return removeOrRestore(trx, deps, access, request);
 };
-/** The path every single write takes: resolve access once, then `writeIn` in its own transaction with a statement timeout. The caller has already authenticated `session`. */
-const runWrite = async (deps, entry, session, request) => {
-	const access = await requestAccess(deps, entry, session);
+/**
+* The path every single write takes: resolve access once, then `writeIn` in its own transaction with a statement timeout.
+* The caller has already authenticated `session`; `form` is the public form a visitor creates through.
+*/
+const runWrite = async (deps, entry, session, request, form) => {
+	const access = await requestAccess(deps, entry, session, form);
 	requireOperation(access, request.operation === "undelete" ? "update" : request.operation);
 	const result = await writeTransaction(deps.db, deps.statementTimeoutMs, (trx) => writeIn(trx, deps, access, request), actorSettings(deps, session));
 	wakeDispatch(deps);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.21.5",
+  "version": "0.21.7",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,13 +30,14 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.21.5",
-    "@protobase/query": "0.21.5",
-    "@protobase/schema": "0.21.5",
+    "@protobase/layout": "0.21.7",
+    "@protobase/query": "0.21.7",
+    "@protobase/schema": "0.21.7",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",
     "@simplewebauthn/server": "^13.3.1",
+    "altcha-lib": "^2.6.0",
     "better-auth": "^1.7.7",
     "cron-parser": "^5.10.1",
     "file-type": "^22.1.1",