@protobase/server 0.31.1 → 0.32.0

package/dist/better-auth/without-session-tokens.js

@@ -0,0 +1,36 @@
+import { authBasePath } from "./auth-base-path.js";
+//#region src/better-auth/without-session-tokens.ts
+const apiTokenPath = `${authBasePath}/token`;
+const withoutTokens = (value) => {
+	if (Array.isArray(value)) return value.map(withoutTokens);
+	if (value === null || typeof value !== "object") return value;
+	return Object.fromEntries(Object.entries(value).filter(([key, field]) => !(key === "token" && typeof field === "string")).map(([key, field]) => [key, withoutTokens(field)]));
+};
+const parsed = (text) => {
+	try {
+		return JSON.parse(text);
+	} catch (error) {
+		if (error instanceof SyntaxError) throw new Error("Better Auth answered malformed JSON");
+		throw error;
+	}
+};
+/**
+* Better Auth's answer to the page without the session tokens in its JSON, such as `get-session`'s `session.token` or a
+* sign-in's `token`: the session is the httpOnly cookie's alone, so script on the page never holds a long-lived credential.
+*/
+const withoutSessionTokens = async (request, response) => {
+	if (new URL(request.url).pathname === apiTokenPath) return response;
+	if (response.body === null) return response;
+	if (!response.headers.get("content-type")?.toLowerCase().includes("application/json")) return response;
+	const text = await response.text();
+	const headers = new Headers(response.headers);
+	headers.delete("content-length");
+	const body = text ? JSON.stringify(withoutTokens(parsed(text))) : null;
+	return new Response(body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+};
+//#endregion
+export { withoutSessionTokens };

package/dist/create-admin.js

@@ -22,6 +22,7 @@ import { readAppName } from "./app-name.js";
 import { realtimePath, restPath, storagePath, supabaseFunctionsPath, supabasePath } from "./supabase-paths.js";
 import { goTruePath } from "./gotrue/keys.js";
 import { authBasePath } from "./better-auth/auth-base-path.js";
+import { withoutSessionTokens } from "./better-auth/without-session-tokens.js";
 import { organizationRoutes } from "./better-auth/organizations/admin-routes.js";
 import { statusRoute } from "./better-auth/status-route.js";
 import { goTrueTokens } from "./gotrue/access-tokens.js";
@@ -253,7 +254,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 			registry,
 			db
 		}));
-		app.on(["GET", "POST"], `${authBasePath}/*`, (c) => auth.handler(c.req.raw));
+		app.on(["GET", "POST"], `${authBasePath}/*`, async (c) => withoutSessionTokens(c.req.raw, await auth.handler(c.req.raw)));
 		app.route(goTruePath, goTrueRoutes(auth));
 		if (auth.origins.length > 1) app.get(webauthnPath, (c) => c.json({ origins: auth.origins }));
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.31.1",
+  "version": "0.32.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,9 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.31.1",
-    "@protobase/query": "0.31.1",
-    "@protobase/schema": "0.31.1",
+    "@protobase/layout": "0.32.0",
+    "@protobase/query": "0.32.0",
+    "@protobase/schema": "0.32.0",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",