@protobase/server 0.21.6 → 0.21.8

package/dist/webhooks/webhooks.js

@@ -1,5 +1,6 @@
 import { dispatchJobName, isCaptured } from "../changes/capture-sql.js";
 import { defineJob } from "../jobs/define-job.js";
+import { FatalJobError } from "../jobs/run-job.js";
 import { coalesce } from "../changes/coalesce.js";
 import { EventCodeError } from "../changes/event-code-error.js";
 import { eventMatcher } from "../changes/match-events.js";
@@ -7,7 +8,6 @@ import { deleteOutbox, readOutbox } from "../changes/outbox.js";
 import { resourceChange } from "../changes/resource-change.js";
 import { callerRecords } from "../functions/records.js";
 import { writeHistory } from "../history/write-history.js";
-import { FatalJobError } from "../jobs/run-job.js";
 import { maxTries, nextRetryDelay } from "./retry-schedule.js";
 import { subscriberEvents } from "./subscriber-view.js";
 import { attemptDelivery } from "./attempt.js";

package/dist/write-pipeline.js

@@ -1,10 +1,10 @@
 import { HttpProblem, badRequest } from "./problem.js";
-import { isDatabaseError } from "./error-handler.js";
-import { deleteRecord, fetchRecord, insertRecord, restoreRecord } from "./records.js";
 import { tenantScope } from "./tenant.js";
 import { requestAccess, requireOperation, targetFilter, writableFields } from "./request-access.js";
+import { deleteRecord, fetchRecord, insertRecord, restoreRecord } from "./records.js";
 import { writeTransaction } from "./transactions.js";
 import { blockedDelete } from "./blocked-delete.js";
+import { isDatabaseError } from "./error-handler.js";
 import { attachFiles } from "./files/attach.js";
 import { actorSettings, wakeDispatch } from "./changes/actor.js";
 import { validateBody } from "./validate-body.js";
@@ -91,9 +91,12 @@ const writeIn = async (trx, deps, access, request) => {
 	if (request.operation === "update") return update(trx, deps, access, request);
 	return removeOrRestore(trx, deps, access, request);
 };
-/** The path every single write takes: resolve access once, then `writeIn` in its own transaction with a statement timeout. The caller has already authenticated `session`. */
-const runWrite = async (deps, entry, session, request) => {
-	const access = await requestAccess(deps, entry, session);
+/**
+* The path every single write takes: resolve access once, then `writeIn` in its own transaction with a statement timeout.
+* The caller has already authenticated `session`; `form` is the public form a visitor creates through.
+*/
+const runWrite = async (deps, entry, session, request, form) => {
+	const access = await requestAccess(deps, entry, session, form);
 	requireOperation(access, request.operation === "undelete" ? "update" : request.operation);
 	const result = await writeTransaction(deps.db, deps.statementTimeoutMs, (trx) => writeIn(trx, deps, access, request), actorSettings(deps, session));
 	wakeDispatch(deps);

package/dist/write-shared.js

@@ -1,10 +1,10 @@
 import { forbidden, notFound, preconditionFailed, preconditionRequired } from "./problem.js";
+import { tenantScope } from "./tenant.js";
+import { andFilters, recordDecision } from "./request-access.js";
 import { presentFiles } from "./files/present.js";
 import { ifMatchSatisfied } from "./etag.js";
 import { pickFields } from "./rows.js";
 import { fetchRecord } from "./records.js";
-import { tenantScope } from "./tenant.js";
-import { andFilters, recordDecision } from "./request-access.js";
 import { scheduleRemovedFiles } from "./files/attach.js";
 //#region src/write-shared.ts
 const missing = (entry) => notFound(`No ${entry.name} with this key`);
@@ -45,6 +45,7 @@ const notifier = (deps, access) => async (trx, kind, before, after) => {
 		resource: access.full,
 		user: session.user,
 		...session.tenant !== void 0 && { tenant: session.tenant },
+		...session.anonymous && { anonymous: true },
 		...before && { before },
 		...after && { after }
 	};

package/dist/write-update.js

@@ -1,6 +1,6 @@
-import { fetchRecord, updateRecord } from "./records.js";
 import { tenantScope } from "./tenant.js";
 import { targetFilter } from "./request-access.js";
+import { fetchRecord, updateRecord } from "./records.js";
 import { attachFiles } from "./files/attach.js";
 import { validateBody } from "./validate-body.js";
 import { assertWritten, checkPrecondition, decide, denied, firstKeyField, missing, notifier } from "./write-shared.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.21.6",
+  "version": "0.21.8",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,13 +30,14 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.21.6",
-    "@protobase/query": "0.21.6",
-    "@protobase/schema": "0.21.6",
+    "@protobase/layout": "0.21.8",
+    "@protobase/query": "0.21.8",
+    "@protobase/schema": "0.21.8",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",
     "@simplewebauthn/server": "^13.3.1",
+    "altcha-lib": "^2.6.0",
     "better-auth": "^1.7.7",
     "cron-parser": "^5.10.1",
     "file-type": "^22.1.1",