@protobase/server 0.25.9 → 0.25.10

package/dist/better-auth/create-auth.d.ts

@@ -8,6 +8,8 @@ import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/opt
 import { PlatformSignIn } from "./platform-sign-in.js";
 import { SsoOptions } from "./saml-sign-in.js";
 import { signUpPaths } from "./sign-up/sign-up-plugin.js";
+import { PasswordHash } from "./password-hashes.js";
+import { UserTableOptions } from "./user-table.js";
 import "../index.js";
 import { BetterAuthOptions } from "better-auth";
 //#region src/better-auth/create-auth.d.ts
@@ -80,9 +82,22 @@ export type CreateAuthOptions = {
   onUserCreated?: UserCreatedHook;
   /**
    * The id of a new user, by any route. Default Better Auth's random 32-character text. `.owner()` fields hold it: a
-   * `text` column for the default, or an integer column when this takes the next value of the app's own users sequence.
+   * `text` column for the default, an integer column when this takes the next value of the app's own users sequence,
+   * or a `uuid` column with `'uuid'`, which makes a random UUID in code and makes every id column of the store a `uuid`.
    */
-  generateUserId?: () => string | Promise<string>;
+  generateUserId?: (() => string | Promise<string>) | 'uuid';
+  /**
+   * The user table, when it is one another system made, such as Supabase's `auth.users`: its name, the columns named
+   * otherwise than Protobase names them, and a JSON column for each user's metadata, for example `{ table: 'users',
+   * columns: { role: 'app_role' }, metadata: 'raw_user_meta_data' }`. The other tables keep their names. Default the
+   * table `protobase auth migration` makes.
+   */
+  users?: UserTableOptions;
+  /**
+   * Password hashes another system wrote that sign-in accepts besides Better Auth's own, such as `['bcrypt']` for
+   * Supabase Auth's. The first sign-in with one stores the password again as Better Auth hashes it. Default none.
+   */
+  passwordHashes?: PasswordHash[];
   /**
    * The identity provider the operator's staff sign in with to sign in as people of this app, for support. Defaults
    * to the one the platform passes in `PROTOBASE_OPERATOR_ISSUER`, `PROTOBASE_OPERATOR_CLIENT_ID` and
@@ -123,22 +138,35 @@ export type UserCreatedHook = NonNullable<UserCreateHooks['after']>;
 export declare const normalizeRoles: (roles?: RolesInput) => string[];
 export declare const createAuth: (options: CreateAuthOptions) => import("better-auth").Auth<{
   user: {
+    modelName: string;
     fields: {
+      name: string;
+      email: string;
       emailVerified: string;
+      image: string;
       createdAt: string;
       updatedAt: string;
     };
   } | {
     additionalFields: {
-      readonly lastOrganizationId: {
+      metadata?: {
+        readonly type: "json";
+        readonly required: false;
+        readonly fieldName: string;
+      } | undefined;
+      lastOrganizationId?: {
         readonly type: "string";
         readonly required: false;
         readonly input: false;
         readonly fieldName: "last_organization_id";
-      };
+      } | undefined;
     };
+    modelName: string;
     fields: {
+      name: string;
+      email: string;
       emailVerified: string;
+      image: string;
       createdAt: string;
       updatedAt: string;
     };
@@ -178,7 +206,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       updatedAt: string;
     };
   };
-  plugins: [{
+  plugins: ({
     id: "admin";
     version: string;
     init(): {
@@ -1094,7 +1122,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         }>;
       };
     }>;
-  }, {
+  } | {
     id: "jwt";
     version: string;
     options: NoInfer<{
@@ -1362,7 +1390,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         };
       };
     };
-  }, {
+  } | {
     hooks: {
       after: {
         matcher: (context: Parameters<(context: import("better-auth").HookEndpointContext) => boolean>[0]) => boolean;
@@ -2030,7 +2058,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       ACCOUNT_TEMPORARILY_LOCKED: import("better-auth").RawError<"ACCOUNT_TEMPORARILY_LOCKED">;
       INVALID_TWO_FACTOR_COOKIE: import("better-auth").RawError<"INVALID_TWO_FACTOR_COOKIE">;
     };
-  }, {
+  } | {
     endpoints: {
       generatePasskeyAuthenticationOptions: import("better-auth").StrictEndpoint<"/passkey/generate-authenticate-options", {
         method: "GET";
@@ -2332,7 +2360,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent? /** Every origin the app is served on, `baseURL`'s first. */ : string | null | undefined;
+              userAgent?: string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -2511,7 +2539,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       RESOLVED_USER_INVALID: import("better-auth").RawError<"RESOLVED_USER_INVALID">;
     };
     options: import("@better-auth/passkey").PasskeyOptions | undefined;
-  }, ...({
+  } | {
     id: "email-otp";
     version: string;
     init(ctx: import("better-auth").AuthContext): {
@@ -5198,8 +5226,8 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           appRoles: string[];
           id: string;
           createdAt: Date;
-          userId: string;
           role: string;
+          userId: string;
           organizationId: string;
         };
       }>;
@@ -5212,7 +5240,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
-  })[], {
+  } | {
     id: "protobase-users";
     endpoints: {
       getInvitation: import("better-auth").StrictEndpoint<"/invitation", {
@@ -5262,8 +5290,8 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           appRoles: string[];
           id: string;
           createdAt: Date;
-          userId: string;
           role: string;
+          userId: string;
           organizationId: string;
         };
       }>;
@@ -5678,7 +5706,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
-  }];
+  } | {
+    id: "protobase-rehash-passwords";
+    hooks: {
+      after: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
+  })[];
   disabledPaths: string[];
   databaseHooks: {
     session?: {
@@ -5757,6 +5793,9 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     };
   };
   advanced: {
+    database?: {
+      generateId: "uuid";
+    } | undefined;
     useSecureCookies: boolean;
     defaultCookieAttributes: {
       sameSite: "lax";
@@ -5785,6 +5824,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       url: string;
       token: string;
     }) => Promise<void>) | undefined;
+    password?: {
+      verify: ({ hash, password }: {
+        hash: string;
+        password: string;
+      }) => Promise<boolean>;
+    } | undefined;
     enabled: true;
     disableSignUp: true;
     minPasswordLength: number;

package/dist/better-auth/create-auth.js

@@ -21,8 +21,10 @@ import { signInPolicyPlugin } from "./policy-plugin.js";
 import { emailInDomains, resolveSamlProviders, samlDisabledPaths, samlGuardPlugin, samlPlugin } from "./saml-sign-in.js";
 import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
 import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
+import { rehashPasswordsPlugin, verifyAcceptedHash } from "./password-hashes.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
 import { twoFactorAfterPasswordOrCode } from "./two-factor-challenge.js";
+import { metadataField, userFieldsNamed, userModel, userTable, withUserColumns } from "./user-table.js";
 import { usersPlugin } from "./users/users-plugin.js";
 import { APIError } from "better-auth/api";
 import { betterAuth } from "better-auth";
@@ -44,6 +46,7 @@ const tokenLifetime = "15m";
 /** The configured roles with `admin` first; `admin` is added when missing. */
 const normalizeRoles = (roles) => roleDefinitions(roles).names;
 const adminImpersonationPaths = ["/admin/impersonate-user", "/admin/stop-impersonating"];
+const newUserId = (generate) => generate === "uuid" ? crypto.randomUUID() : generate();
 const noContext = () => Promise.reject(/* @__PURE__ */ new Error("The auth context is read only once createAuth has made the instance"));
 const organizationPaths = ["/organization/set-active", "/organization/accept-invitation"];
 /**
@@ -60,6 +63,12 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 		baseURL: options.baseURL
 	};
 	const samlIds = saml.map((provider) => provider.id);
+	const users = userTable(options.users);
+	const passwordHashes = options.passwordHashes ?? [];
+	const userFields = {
+		...organizations && userFieldsNamed(lastOrganizationField, users),
+		...metadataField(users)
+	};
 	return {
 		appName,
 		database: options.database,
@@ -75,13 +84,14 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			enabled: true,
 			disableSignUp: true,
 			minPasswordLength: 12,
+			...passwordHashes.length > 0 && { password: { verify: verifyAcceptedHash(passwordHashes) } },
 			...mail && passwordResetOptions(mail)
 		},
 		...options.socialProviders && { socialProviders: options.socialProviders },
-		user: organizations ? {
-			...coreNames.user,
-			additionalFields: lastOrganizationField
-		} : coreNames.user,
+		user: Object.keys(userFields).length > 0 ? {
+			...userModel(users),
+			additionalFields: userFields
+		} : userModel(users),
 		session: coreNames.session,
 		verification: coreNames.verification,
 		account: {
@@ -162,8 +172,9 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				invitationUrl: organizations?.invitationUrl ?? defaultInvitationUrl(options.baseURL),
 				invitationSeconds: organizations?.invitationExpiresIn ?? 604800,
 				...organizations && { organizations }
-			})
-		],
+			}),
+			...passwordHashes.length > 0 ? [rehashPasswordsPlugin(passwordHashes)] : []
+		].map((plugin) => withUserColumns(plugin, users)),
 		disabledPaths: [
 			...unusedEmailCodePaths,
 			...adminImpersonationPaths,
@@ -183,7 +194,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 					});
 					const withId = options.generateUserId ? {
 						...user,
-						id: await options.generateUserId()
+						id: await newUserId(options.generateUserId)
 					} : user;
 					return { data: context?.path === "/admin/create-user" || samlProvider ? {
 						...withId,
@@ -231,7 +242,8 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				sameSite: "lax",
 				secure
 			},
-			backgroundTasks: { handler: () => {} }
+			backgroundTasks: { handler: () => {} },
+			...options.generateUserId === "uuid" && { database: { generateId: "uuid" } }
 		}
 	};
 };

package/dist/better-auth/password-hashes.d.ts

@@ -0,0 +1,4 @@
+//#region src/better-auth/password-hashes.d.ts
+/** The hash formats sign-in accepts besides Better Auth's own. */
+export type PasswordHash = 'bcrypt';
+//#endregion

package/dist/better-auth/password-hashes.js

@@ -0,0 +1,31 @@
+import { APIError, createAuthMiddleware } from "better-auth/api";
+import { verifyPassword } from "better-auth/crypto";
+import bcrypt from "bcryptjs";
+//#region src/better-auth/password-hashes.ts
+const formats = { bcrypt: {
+	matches: (hash) => /^\$2[aby]\$/.test(hash),
+	verify: (password, hash) => bcrypt.compare(password, hash)
+} };
+const formatOf = (accepted, hash) => accepted.map((name) => formats[name]).find((format) => format.matches(hash));
+/** Better Auth's `password.verify`: the accepted formats first, then its own scrypt. */
+const verifyAcceptedHash = (accepted) => ({ hash, password }) => formatOf(accepted, hash)?.verify(password, hash) ?? verifyPassword({
+	hash,
+	password
+});
+/** After a sign-in with a password in one of the accepted formats, stores it again as Better Auth hashes it. */
+const rehashPasswordsPlugin = (accepted) => ({
+	id: "protobase-rehash-passwords",
+	hooks: { after: [{
+		matcher: (ctx) => ctx.path === "/sign-in/email",
+		handler: createAuthMiddleware(async (ctx) => {
+			if (ctx.context.returned instanceof APIError) return;
+			const { email, password } = ctx.body;
+			const found = await ctx.context.internalAdapter.findUserByEmail(email.toLowerCase(), { includeAccounts: true });
+			const account = found?.accounts.find((candidate) => candidate.providerId === "credential" && candidate.accountId === found.user.id);
+			if (!found || !account?.password || !formatOf(accepted, account.password)) return;
+			await ctx.context.internalAdapter.updatePassword(found.user.id, await ctx.context.password.hash(password));
+		})
+	}] }
+});
+//#endregion
+export { rehashPasswordsPlugin, verifyAcceptedHash };

package/dist/better-auth/snake-case-names.js

@@ -1,11 +1,6 @@
 //#region src/better-auth/snake-case-names.ts
-/** Better Auth's own tables, as its `user`, `session`, `account` and `verification` options name them. */
+/** Better Auth's own tables, as its `session`, `account` and `verification` options name them; the user table's are in `user-table.ts`. */
 const coreNames = {
-	user: { fields: {
-		emailVerified: "email_verified",
-		createdAt: "created_at",
-		updatedAt: "updated_at"
-	} },
 	session: { fields: {
 		expiresAt: "expires_at",
 		createdAt: "created_at",

package/dist/better-auth/user-table.d.ts

@@ -0,0 +1,31 @@
+import "better-auth";
+//#region src/better-auth/user-table.d.ts
+/** Each column of the user table, by the name Protobase gives it, with Better Auth's field it holds. */
+declare const userFields: {
+  readonly name: "name";
+  readonly email: "email";
+  readonly email_verified: "emailVerified";
+  readonly image: "image";
+  readonly created_at: "createdAt";
+  readonly updated_at: "updatedAt";
+  readonly role: "role";
+  readonly banned: "banned";
+  readonly ban_reason: "banReason";
+  readonly ban_expires: "banExpires";
+  readonly two_factor_enabled: "twoFactorEnabled";
+  readonly last_role: "lastRole";
+  readonly last_organization_id: "lastOrganizationId";
+};
+export type UserColumn = keyof typeof userFields;
+export type UserTableOptions = {
+  /** The table's name, default `user`, for example `users` for Supabase's `auth.users`. */
+  table?: string;
+  /**
+   * The columns named otherwise than Protobase names them: `{ role: 'app_role' }`, where `role` holds something else
+   * already, such as the Postgres role in Supabase's `auth.users`.
+   */
+  columns?: Partial<Record<UserColumn, string>>;
+  /** A JSON column that holds each user's metadata, such as `raw_user_meta_data`; none by default. */
+  metadata?: string;
+};
+//#endregion

package/dist/better-auth/user-table.js

@@ -0,0 +1,69 @@
+//#region src/better-auth/user-table.ts
+/** Each column of the user table, by the name Protobase gives it, with Better Auth's field it holds. */
+const userFields = {
+	name: "name",
+	email: "email",
+	email_verified: "emailVerified",
+	image: "image",
+	created_at: "createdAt",
+	updated_at: "updatedAt",
+	role: "role",
+	banned: "banned",
+	ban_reason: "banReason",
+	ban_expires: "banExpires",
+	two_factor_enabled: "twoFactorEnabled",
+	last_role: "lastRole",
+	last_organization_id: "lastOrganizationId"
+};
+/** The user table's names, from `createAuth`'s `users` option; unknown columns are an error. */
+const userTable = ({ table = "user", columns = {}, metadata } = {}) => {
+	const unknown = Object.keys(columns).find((name) => !(name in userFields));
+	if (unknown !== void 0) throw new Error(`users.columns names "${unknown}", which is not a column of the user table: ${Object.keys(userFields).join(", ")}`);
+	const column = (name) => columns[name] ?? name;
+	return {
+		modelName: table,
+		column,
+		fieldNames: Object.fromEntries(Object.entries(userFields).map(([name, field]) => [field, column(name)])),
+		metadata
+	};
+};
+/** Better Auth's `user` option: the table and its core columns. */
+const userModel = ({ modelName, column }) => ({
+	modelName,
+	fields: {
+		name: column("name"),
+		email: column("email"),
+		emailVerified: column("email_verified"),
+		image: column("image"),
+		createdAt: column("created_at"),
+		updatedAt: column("updated_at")
+	}
+});
+/** Each user field the user metadata column adds; none without one. */
+const metadataField = ({ metadata }) => metadata ? { metadata: {
+	type: "json",
+	required: false,
+	fieldName: metadata
+} } : void 0;
+/** The fields, each with its column named as the app names it. */
+const userFieldsNamed = (fields, { fieldNames }) => Object.fromEntries(Object.entries(fields).map(([field, attribute]) => [field, {
+	...attribute,
+	fieldName: fieldNames[field] ?? attribute.fieldName
+}]));
+/** The plugin, with the columns it adds to the user table named as the app names them. */
+const withUserColumns = (plugin, table) => {
+	const user = plugin.schema?.user;
+	if (!user) return plugin;
+	return {
+		...plugin,
+		schema: {
+			...plugin.schema,
+			user: {
+				...user,
+				fields: userFieldsNamed(user.fields, table)
+			}
+		}
+	};
+};
+//#endregion
+export { metadataField, userFieldsNamed, userModel, userTable, withUserColumns };

package/dist/better-auth/users.d.ts

@@ -8,12 +8,14 @@ export type LinkedAccount = {
   providerId: string;
   accountId: string;
 };
+/** `metadata` lands in the user metadata column, which `createAuth`'s `users.metadata` names; it needs one. */
 export type NewUser = {
   email: string;
   password: string;
   name?: string;
   role?: string;
   accounts?: LinkedAccount[];
+  metadata?: Record<string, unknown>;
 };
 export type StoredUser = {
   id: string;

package/dist/better-auth/users.js

@@ -37,7 +37,8 @@ const createUser = async (auth, input) => {
 		email: input.email,
 		password: input.password,
 		name: input.name ?? input.email.split("@")[0],
-		role
+		role,
+		...input.metadata && { data: { metadata: input.metadata } }
 	} });
 	const { internalAdapter } = await auth.$context;
 	for (const account of accounts) await internalAdapter.linkAccount({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.25.9",
+  "version": "0.25.10",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,14 +32,15 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.25.9",
-    "@protobase/query": "0.25.9",
-    "@protobase/schema": "0.25.9",
+    "@protobase/layout": "0.25.10",
+    "@protobase/query": "0.25.10",
+    "@protobase/schema": "0.25.10",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",
     "@simplewebauthn/server": "^13.3.1",
     "altcha-lib": "^2.6.0",
+    "bcryptjs": "^3.0.3",
     "better-auth": "^1.7.7",
     "cron-parser": "^5.10.1",
     "file-type": "^22.1.1",