@protobase/server 0.29.0 → 0.29.1

package/dist/auth/jwt.js

@@ -32,8 +32,8 @@ const jwtVerifier = (options) => {
 		})).payload;
 	};
 };
-/** Verifies `Authorization: Bearer <jwt>` against a JWKS; `sub` is the user id. Without the header, `MissingCredentials`. */
-const jwtAuthenticator = (options) => {
+/** Like `jwtAuthenticator`, and also returns the verified claims, for an authenticator that checks more of them. */
+const jwtSessions = (options) => {
 	const { rolesClaim = "roles", tenantClaim = "tenant" } = options;
 	const verify = jwtVerifier(options);
 	return async (request) => {
@@ -48,13 +48,21 @@ const jwtAuthenticator = (options) => {
 		const claimed = typeof tenant === "string" || typeof tenant === "number" ? tenant : void 0;
 		const tenantValue = options.tenant === void 0 ? claimed : typeof options.tenant === "function" ? await options.tenant() : options.tenant;
 		return {
-			user: {
-				id: sub,
-				roles: [.../* @__PURE__ */ new Set([...rolesOf(roles), ...extraRoles])]
-			},
-			...tenantValue !== void 0 && { tenant: tenantValue }
+			payload,
+			session: {
+				user: {
+					id: sub,
+					roles: [.../* @__PURE__ */ new Set([...rolesOf(roles), ...extraRoles])]
+				},
+				...tenantValue !== void 0 && { tenant: tenantValue }
+			}
 		};
 	};
 };
+/** Verifies `Authorization: Bearer <jwt>` against a JWKS; `sub` is the user id. Without the header, `MissingCredentials`. */
+const jwtAuthenticator = (options) => {
+	const sessions = jwtSessions(options);
+	return async (request) => (await sessions(request)).session;
+};
 //#endregion
-export { jwtAuthenticator, jwtVerifier };
+export { jwtAuthenticator, jwtSessions, jwtVerifier };

package/dist/better-auth/authenticator.d.ts

@@ -28,7 +28,10 @@ export declare const betterAuthTokens: (options: Pick<BetterAuthAuthenticatorOpt
  * Verifies the bearer JWT that Better Auth's jwt plugin issues. `sub` is the user id, the `role` claim (a comma
  * separated string from the admin plugin) becomes `roles`. With organizations, the `org` claim is the tenant and the
  * organization, and the membership's `app_roles` are added to the global roles; `user`, which stands for no global
- * role, is left out. With `apps`, the tokens of those apps are admitted too, with the roles each gives its users here.
+ * role, is left out. With `auth`, every request also reads the store to check that the token still stands
+ * (`checkTokenStanding`), so a ban, a lowered role, a deleted user or a sign-out ends it at once; with `jwksUrl` alone
+ * a token works until it expires. With `apps`, the tokens of those apps are admitted too, with the roles each gives
+ * its users here.
  */
 export declare const betterAuthAuthenticator: (options: BetterAuthAuthenticatorOptions) => Authenticator;
 //#endregion

package/dist/better-auth/authenticator.js

@@ -1,7 +1,8 @@
-import { jwtAuthenticator } from "../auth/jwt.js";
+import { jwtSessions } from "../auth/jwt.js";
 import { noGlobalRole } from "./organizations/role-definitions.js";
 import { cachedKeys } from "./jwks-cache.js";
 import { withTrustedApps } from "./app-tokens.js";
+import { checkTokenStanding, tokenClaims } from "./token-standing.js";
 //#region src/better-auth/authenticator.ts
 /** How the tokens of this Better Auth instance verify: its key set, and its issuer as both issuer and audience. */
 const betterAuthTokens = (options) => {
@@ -18,13 +19,16 @@ const betterAuthTokens = (options) => {
 * Verifies the bearer JWT that Better Auth's jwt plugin issues. `sub` is the user id, the `role` claim (a comma
 * separated string from the admin plugin) becomes `roles`. With organizations, the `org` claim is the tenant and the
 * organization, and the membership's `app_roles` are added to the global roles; `user`, which stands for no global
-* role, is left out. With `apps`, the tokens of those apps are admitted too, with the roles each gives its users here.
+* role, is left out. With `auth`, every request also reads the store to check that the token still stands
+* (`checkTokenStanding`), so a ban, a lowered role, a deleted user or a sign-out ends it at once; with `jwksUrl` alone
+* a token works until it expires. With `apps`, the tokens of those apps are admitted too, with the roles each gives
+* its users here.
 */
 const betterAuthAuthenticator = (options) => {
 	const tokens = betterAuthTokens(options);
 	const { issuer } = tokens;
 	const organizations = options.organizations ?? Boolean(options.auth?.organizations);
-	const verify = jwtAuthenticator({
+	const sessions = jwtSessions({
 		...tokens,
 		rolesClaim: "role",
 		...organizations && {
@@ -33,6 +37,12 @@ const betterAuthAuthenticator = (options) => {
 		},
 		...options.tenant !== void 0 && { tenant: options.tenant }
 	});
+	const { auth } = options;
+	const verify = async (request) => {
+		const { payload, session } = await sessions(request);
+		if (auth) await checkTokenStanding(await auth.$context, tokenClaims(payload, session.user.roles, organizations ? session.tenant : void 0), organizations);
+		return session;
+	};
 	return withTrustedApps(!organizations ? verify : async (request) => {
 		const session = await verify(request);
 		const user = {

package/dist/better-auth/create-auth.d.ts

@@ -1165,24 +1165,28 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         }) => Promise<{
           role: any;
           email: string;
+          sid: string;
         } | {
           org?: undefined;
           org_role?: undefined;
           app_roles?: undefined;
           role: any;
           email: string;
+          sid: string;
         } | {
           org: string;
           org_role: OrganizationRole;
           app_roles: string[];
           role: any;
           email: string;
+          sid: string;
         } | {
           org: string;
           org_role?: undefined;
           app_roles?: undefined;
           role: any;
           email: string;
+          sid: string;
         }>;
       };
       disableSettingJwtHeader: true;

package/dist/better-auth/create-auth.js

@@ -94,6 +94,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				};
 				return {
 					email: user.email,
+					sid: session.id,
 					...narrowClaims(claims, [activeRole, user.lastRole], Boolean(organizations))
 				};
 			}

package/dist/better-auth/token-standing.js

@@ -0,0 +1,55 @@
+import { unauthorized } from "../problem.js";
+import { noGlobalRole } from "./organizations/role-definitions.js";
+import { parseRoles } from "./parse-roles.js";
+import { effectiveRoles, globalRoles } from "./organizations/app-roles.js";
+import { findMember, findOrganization } from "./organizations/store.js";
+//#region src/better-auth/token-standing.ts
+const tokenClaims = (payload, roles, tenant) => ({
+	userId: payload.sub,
+	...typeof payload.sid === "string" && { sessionId: payload.sid },
+	roles: roles.filter((role) => role !== noGlobalRole),
+	...typeof tenant === "string" && { organizationId: tenant }
+});
+const revoked = () => unauthorized("The bearer token was revoked: get a new one");
+const bannedNow = (user, now) => Boolean(user.banned) && (!user.banExpires || user.banExpires > now);
+const heldWhere = async ({ adapter }, user, organizations, organizationId) => {
+	if (!organizations) return parseRoles(user.role);
+	const global = globalRoles(user.role);
+	if (!organizationId) return global;
+	const member = await findMember(adapter, {
+		organizationId,
+		userId: user.id
+	});
+	if (member) return effectiveRoles(global, member.appRoles);
+	return global.length > 0 && await findOrganization(adapter, organizationId) !== null ? global : void 0;
+};
+/**
+* Whether a token still stands, read from the store on every request: its user exists and is not banned, its session
+* is not signed out or expired, and each role it carries is one the user still holds there. A token that fails is a
+* 401, so the client asks its session for a new one, which carries the roles as they are now or is refused.
+*/
+const checkTokenStanding = async (context, claims, organizations, now = /* @__PURE__ */ new Date()) => {
+	const { adapter } = context;
+	if (claims.sessionId !== void 0) {
+		const session = await adapter.findOne({
+			model: "session",
+			where: [{
+				field: "id",
+				value: claims.sessionId
+			}]
+		});
+		if (!session || session.userId !== claims.userId || session.expiresAt <= now) throw revoked();
+	}
+	const user = await adapter.findOne({
+		model: "user",
+		where: [{
+			field: "id",
+			value: claims.userId
+		}]
+	});
+	if (!user || bannedNow(user, now)) throw revoked();
+	const held = await heldWhere(context, user, organizations, claims.organizationId);
+	if (!held || claims.roles.some((role) => !held.includes(role))) throw revoked();
+};
+//#endregion
+export { checkTokenStanding, tokenClaims };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.29.0",
+  "version": "0.29.1",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,9 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.29.0",
-    "@protobase/query": "0.29.0",
-    "@protobase/schema": "0.29.0",
+    "@protobase/layout": "0.29.1",
+    "@protobase/query": "0.29.1",
+    "@protobase/schema": "0.29.1",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",