@protobase/server 0.3.5 → 0.4.1

package/dist/better-auth/two-factor-challenge.js

@@ -0,0 +1,23 @@
+import { twoFactor } from "better-auth/plugins";
+//#region src/better-auth/two-factor-challenge.ts
+/**
+* Better Auth's two-factor plugin, whose second step also follows a sign-in with an emailed code: the plugin asks for
+* it after a password only, and an inbox alone is one factor as well. A passkey is two factors already, so a passkey
+* sign-in is not asked. The plugin's own hook does the work; only the paths it matches grow.
+*/
+const twoFactorAfterPasswordOrCode = (options) => {
+	const plugin = twoFactor(options);
+	const after = plugin.hooks.after.map((hook) => ({
+		...hook,
+		matcher: (context) => hook.matcher(context) || context.path === "/sign-in/email-otp"
+	}));
+	return {
+		...plugin,
+		hooks: {
+			...plugin.hooks,
+			after
+		}
+	};
+};
+//#endregion
+export { twoFactorAfterPasswordOrCode };

package/dist/better-auth/users.d.ts

@@ -1,4 +1,5 @@
 import { AdminAuth } from "./create-auth.js";
+import { parseRoles } from "./parse-roles.js";
 //#region src/better-auth/users.d.ts
 /** The roles this auth instance allows, `admin` first. */
 export declare const roleChoices: (auth: AdminAuth) => string[];
@@ -19,18 +20,14 @@ export type StoredUser = {
 export declare const hasUsers: (auth: AdminAuth) => Promise<boolean>;
 /**
  * Creates a user directly in the admin store. Host side only (no HTTP route creates accounts while the store is empty):
- * the first user is always an `admin`, later ones get `role` (default `user`).
+ * the first user is always an `admin`, later ones get `role` (default `user`). The address counts as verified, so the
+ * user can also sign in with an emailed code.
  */
 export declare const createUser: (auth: AdminAuth, input: NewUser) => Promise<{
   id: string;
   email: string;
   role: string;
 }>;
-/**
- * The admin plugin stores roles as a comma separated string. A value written as a JS array through a Postgres driver
- * comes back as an array literal (`{admin,sales}`); that is read too, and rewritten as a plain string on the next change.
- */
-export declare const parseRoles: (role: string | string[] | null | undefined) => string[];
 export declare const listUsers: (auth: AdminAuth) => Promise<StoredUser[]>;
 /** Deletes the user with their sessions and accounts; refuses to delete the last active admin. */
 export declare const deleteUser: (auth: AdminAuth, email: string) => Promise<void>;
@@ -47,4 +44,5 @@ export declare const setUserBanned: (auth: AdminAuth, input: {
   email: string;
   banned: boolean;
 }) => Promise<void>;
-//#endregion
+//#endregion
+export { parseRoles };

package/dist/better-auth/users.js

@@ -1,3 +1,4 @@
+import { parseRoles } from "./parse-roles.js";
 //#region src/better-auth/users.ts
 /** The roles this auth instance allows, `admin` first. */
 const roleChoices = (auth) => [...auth.roles];
@@ -11,7 +12,8 @@ const checkRoles = (auth, role) => {
 const hasUsers = async (auth) => (await auth.$context).adapter.count({ model: "user" }).then((count) => count > 0);
 /**
 * Creates a user directly in the admin store. Host side only (no HTTP route creates accounts while the store is empty):
-* the first user is always an `admin`, later ones get `role` (default `user`).
+* the first user is always an `admin`, later ones get `role` (default `user`). The address counts as verified, so the
+* user can also sign in with an emailed code.
 */
 const createUser = async (auth, input) => {
 	const first = !await hasUsers(auth);
@@ -30,15 +32,6 @@ const createUser = async (auth, input) => {
 		role: String(user.role)
 	};
 };
-/**
-* The admin plugin stores roles as a comma separated string. A value written as a JS array through a Postgres driver
-* comes back as an array literal (`{admin,sales}`); that is read too, and rewritten as a plain string on the next change.
-*/
-const parseRoles = (role) => {
-	if (Array.isArray(role)) return role;
-	const text = (role ?? "user").trim();
-	return (text.startsWith("{") && text.endsWith("}") ? text.slice(1, -1) : text).split(",").map((name) => name.trim().replace(/^"|"$/g, "")).filter(Boolean);
-};
 const allUsers = async (auth) => {
 	const { adapter } = await auth.$context;
 	return adapter.findMany({

package/dist/index.d.ts

@@ -1,3 +1,6 @@
+import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
+import { StaffSignIn } from "./better-auth/staff-log.js";
+import { OperatorProvider, readOperatorSettings } from "./better-auth/operator-provider.js";
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, createAuth, normalizeRoles } from "./better-auth/create-auth.js";
 import { ResourceSource, configExports } from "./resource-source.js";
 import { AssistantOptions, AssistantSettings, ModelSettings, assistantRoles, assistantSettings, assistantVariables, seesAssistant } from "./assistant/assistant-settings.js";
@@ -8,7 +11,8 @@ import { consoleAuditQueue } from "./audit/console-queue.js";
 import { JwtOptions, jwtAuthenticator } from "./auth/jwt.js";
 import { HttpProblem, badRequest, forbidden, notFound, unauthorized } from "./problem.js";
 import { BetterAuthAuthenticatorOptions, betterAuthAuthenticator } from "./better-auth/authenticator.js";
-import { NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, parseRoles, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
+import { parseRoles } from "./better-auth/parse-roles.js";
+import { NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { IssueTokenOptions, issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
 import { ChatMessage, ChatTextPart, Completion, CompletionOptions, ModelError, ReasoningDetail, ReasoningEffort, ToolCall, ToolSpec, streamChatCompletion } from "./assistant/chat-completions.js";
 import { ConversationRecord, ConversationStore } from "./assistant/conversation-store.js";
@@ -21,4 +25,4 @@ import { AssistantTool, ToolContext, defineTool } from "./assistant/tools.js";
 import { TurnOptions, runTurn } from "./assistant/turn.js";
 import { QueryOptions, QueryResult, runReadOnlyQuery, runReadWriteQuery } from "./assistant/run-query.js";
 import { readOnlyQueryTool, readWriteQueryTool } from "./assistant/query-tools.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type ChatMessage, type ChatTextPart, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CreateAdminInput, type CreateAuthOptions, HttpProblem, type IssueTokenOptions, type JwtOptions, ModelError, type ModelSettings, type NewUser, type PipelineHook, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type ResourceSource, type RuntimeOptions, type ScanGuardMode, type Session, type StoredUser, type TenantValue, type ToolCall, type ToolContext, type ToolSpec, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WriteEvent, type WriteOperation, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, badRequest, betterAuthAuthenticator, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createUser, defineTool, deleteUser, fileConversationStore, forbidden, hasUsers, issueToken, jwtAuthenticator, listUsers, maxTokenTtlSeconds, normalizeRoles, notFound, parseRoles, readOnlyQueryTool, readWriteQueryTool, requestApproval, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setUserBanned, setUserRole, streamChatCompletion, unauthorized, withCacheBreakpoints };
+export { type Admin, type AdminAuth, type AdminOptions, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type ChatMessage, type ChatTextPart, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CreateAdminInput, type CreateAuthOptions, HttpProblem, type IssueTokenOptions, type JwtOptions, ModelError, type ModelSettings, type NewUser, type OperatorProvider, type PipelineHook, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type ResourceSource, type RuntimeOptions, type ScanGuardMode, type Session, type SignInPolicy, type SignInRule, type StaffAccessRule, type StaffSignIn, type StoredUser, type TenantValue, type ToolCall, type ToolContext, type ToolSpec, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WriteEvent, type WriteOperation, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, badRequest, betterAuthAuthenticator, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createUser, defaultSignInPolicy, defineTool, deleteUser, fileConversationStore, forbidden, hasUsers, issueToken, jwtAuthenticator, listUsers, maxTokenTtlSeconds, normalizeRoles, notFound, parseRoles, readOnlyQueryTool, readOperatorSettings, readWriteQueryTool, requestApproval, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setUserBanned, setUserRole, signInPolicyMethods, streamChatCompletion, unauthorized, withCacheBreakpoints };

package/dist/index.js

@@ -11,12 +11,15 @@ import { withCacheBreakpoints } from "./assistant/cache-breakpoints.js";
 import { ModelError, streamChatCompletion } from "./assistant/chat-completions.js";
 import { runTurn } from "./assistant/turn.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
+import { readOperatorSettings } from "./better-auth/operator-provider.js";
+import { defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
+import { parseRoles } from "./better-auth/parse-roles.js";
 import { createAuth, normalizeRoles } from "./better-auth/create-auth.js";
-import { createUser, deleteUser, hasUsers, listUsers, parseRoles, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
+import { createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { runtimeUrl, runtimeVariable, seesRuntime } from "./runtime/runtime-settings.js";
 import { createAdmin } from "./create-admin.js";
 import { configExports } from "./resource-source.js";
 import { jwtAuthenticator } from "./auth/jwt.js";
 import { betterAuthAuthenticator } from "./better-auth/authenticator.js";
 import { issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
-export { HttpProblem, ModelError, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, badRequest, betterAuthAuthenticator, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createUser, defineTool, deleteUser, fileConversationStore, forbidden, hasUsers, issueToken, jwtAuthenticator, listUsers, maxTokenTtlSeconds, normalizeRoles, notFound, parseRoles, readOnlyQueryTool, readWriteQueryTool, requestApproval, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setUserBanned, setUserRole, streamChatCompletion, unauthorized, withCacheBreakpoints };
+export { HttpProblem, ModelError, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, badRequest, betterAuthAuthenticator, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createUser, defaultSignInPolicy, defineTool, deleteUser, fileConversationStore, forbidden, hasUsers, issueToken, jwtAuthenticator, listUsers, maxTokenTtlSeconds, normalizeRoles, notFound, parseRoles, readOnlyQueryTool, readOperatorSettings, readWriteQueryTool, requestApproval, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setUserBanned, setUserRole, signInPolicyMethods, streamChatCompletion, unauthorized, withCacheBreakpoints };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.3.5",
+  "version": "0.4.1",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -29,10 +29,12 @@
     "access": "public"
   },
   "dependencies": {
-    "@protobase/layout": "0.3.5",
-    "@protobase/query": "0.3.5",
-    "@protobase/schema": "0.3.5",
+    "@better-auth/passkey": "^1.7.7",
+    "@protobase/layout": "0.4.1",
+    "@protobase/query": "0.4.1",
+    "@protobase/schema": "0.4.1",
     "@scalar/hono-api-reference": "^0.12.10",
+    "@simplewebauthn/server": "^13.3.1",
     "better-auth": "^1.7.7",
     "hono": "^4.13.13",
     "jose": "^6.2.12",