@protobase/server 0.31.2 → 0.33.0

package/dist/better-auth/without-session-tokens.js

@@ -0,0 +1,36 @@
+import { authBasePath } from "./auth-base-path.js";
+//#region src/better-auth/without-session-tokens.ts
+const apiTokenPath = `${authBasePath}/token`;
+const withoutTokens = (value) => {
+	if (Array.isArray(value)) return value.map(withoutTokens);
+	if (value === null || typeof value !== "object") return value;
+	return Object.fromEntries(Object.entries(value).filter(([key, field]) => !(key === "token" && typeof field === "string")).map(([key, field]) => [key, withoutTokens(field)]));
+};
+const parsed = (text) => {
+	try {
+		return JSON.parse(text);
+	} catch (error) {
+		if (error instanceof SyntaxError) throw new Error("Better Auth answered malformed JSON");
+		throw error;
+	}
+};
+/**
+* Better Auth's answer to the page without the session tokens in its JSON, such as `get-session`'s `session.token` or a
+* sign-in's `token`: the session is the httpOnly cookie's alone, so script on the page never holds a long-lived credential.
+*/
+const withoutSessionTokens = async (request, response) => {
+	if (new URL(request.url).pathname === apiTokenPath) return response;
+	if (response.body === null) return response;
+	if (!response.headers.get("content-type")?.toLowerCase().includes("application/json")) return response;
+	const text = await response.text();
+	const headers = new Headers(response.headers);
+	headers.delete("content-length");
+	const body = text ? JSON.stringify(withoutTokens(parsed(text))) : null;
+	return new Response(body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+};
+//#endregion
+export { withoutSessionTokens };

package/dist/create-admin.js

@@ -22,6 +22,7 @@ import { readAppName } from "./app-name.js";
 import { realtimePath, restPath, storagePath, supabaseFunctionsPath, supabasePath } from "./supabase-paths.js";
 import { goTruePath } from "./gotrue/keys.js";
 import { authBasePath } from "./better-auth/auth-base-path.js";
+import { withoutSessionTokens } from "./better-auth/without-session-tokens.js";
 import { organizationRoutes } from "./better-auth/organizations/admin-routes.js";
 import { statusRoute } from "./better-auth/status-route.js";
 import { goTrueTokens } from "./gotrue/access-tokens.js";
@@ -253,7 +254,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 			registry,
 			db
 		}));
-		app.on(["GET", "POST"], `${authBasePath}/*`, (c) => auth.handler(c.req.raw));
+		app.on(["GET", "POST"], `${authBasePath}/*`, async (c) => withoutSessionTokens(c.req.raw, await auth.handler(c.req.raw)));
 		app.route(goTruePath, goTrueRoutes(auth));
 		if (auth.origins.length > 1) app.get(webauthnPath, (c) => c.json({ origins: auth.origins }));
 	}

package/dist/functions/define-function.d.ts

@@ -47,6 +47,11 @@ export type CorsOptions = {
 type SharedOptions = {
   /** Answers CORS preflights before authentication and adds the CORS headers to every response, problems included. */
   cors?: CorsOptions;
+  /**
+   * Also answers at `/api/sb/functions/v1/<name>`, as Supabase's `verify_jwt` does, where the app's publishable key alone
+   * admits a caller. For functions moved from Supabase; not together with `roles` or `capability`.
+   */
+  supabase?: boolean;
 };
 /** A function anyone may call, such as a webhook; it can still ask for a caller with `context.caller()`. */
 export type PublicFunctionOptions = SharedOptions & {
@@ -78,7 +83,7 @@ export type FunctionSource = ApiFunction | FunctionHandler | FunctionApp;
 /**
  * A function of your own, served at `/api/functions/<name>`. Without options it needs a signed-in caller, through the
  * app's `authenticate`, and with the app's `roles` one whose roles hold `*`; `{ roles }` or `{ capability }` opens it
- * to more, `{ public: true }` to anyone, as for a webhook.
+ * to more, `{ public: true }` to anyone, as for a webhook. `{ supabase: true }` serves it at `/api/sb/functions/v1/<name>` too.
  */
 export declare function defineFunction(handler: FunctionHandler | FunctionApp): ApiFunction;
 export declare function defineFunction(options: PublicFunctionOptions, handler: PublicFunctionHandler | FunctionApp<PublicFunctionContext>): ApiFunction;

package/dist/functions/supabase-routes.js

@@ -7,11 +7,12 @@ import { Hono } from "hono";
 import { cors } from "hono/cors";
 //#region src/functions/supabase-routes.ts
 /**
-* The app's functions again at `/api/sb/functions/v1/<name>`, as Supabase serves Edge Functions. A protected function lets in
-* a request its app's keys admit, as Supabase's `verify_jwt` does, and a public one anyone. Either gets the key-made
-* caller, not the app's session, so a function with `roles` is served at `/api/functions/<name>` only. As on Supabase,
-* the function sees the path from its name on, `/<name>/more/parts`, and a CORS preflight, which carries no key,
-* reaches it unchecked.
+* The functions with `supabase: true` again at `/api/sb/functions/v1/<name>`, as Supabase serves Edge Functions. A
+* protected one lets in a request its app's keys admit, as Supabase's `verify_jwt` does, the publishable key alone
+* included, and a public one anyone. Either gets the key-made caller, not the app's session, so neither may have
+* `roles` or `capability`: that stops startup. As on Supabase, the function sees the path from its name on,
+* `/<name>/more/parts`, and a CORS preflight, which carries no key, reaches it unchecked. Every other function is a 404
+* here, and none of its code runs.
 */
 const supabaseFunctionRoutes = ({ functions, db, keys, caller, onError }) => {
 	const app = new Hono().basePath(supabaseFunctionsPath);
@@ -19,9 +20,17 @@ const supabaseFunctionRoutes = ({ functions, db, keys, caller, onError }) => {
 	const hasKeys = keys.publishable !== void 0 || keys.secret !== void 0;
 	for (const [name, fn] of Object.entries(functions)) {
 		const { options } = fn;
+		if (options.supabase !== true) {
+			app.all(`/${name}/*`, () => {
+				throw notFound(`The function "${name}" answers at /api/functions/${name} only: give it supabase: true to answer here too`);
+			});
+			continue;
+		}
+		const { roles, capability } = options;
+		const gated = roles !== void 0 ? "roles" : capability !== void 0 ? "a capability" : void 0;
+		if (gated) throw new Error(`The function "${name}" has supabase: true and ${gated}, which /api/sb/functions/v1 cannot check: drop one`);
 		if (options.cors) app.use(`/${name}/*`, cors(options.cors));
 		app.all(`/${name}/*`, (c) => runInBackground(async () => {
-			if (!options.public && options.roles) throw notFound(`The function "${name}" checks roles, so it is served at /api/functions/${name} only`);
 			const request = relativeRequest(c.req.raw, supabaseFunctionsPath);
 			if (options.public || c.req.method === "OPTIONS") {
 				let resolved;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.31.2",
+  "version": "0.33.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,9 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.31.2",
-    "@protobase/query": "0.31.2",
-    "@protobase/schema": "0.31.2",
+    "@protobase/layout": "0.33.0",
+    "@protobase/query": "0.33.0",
+    "@protobase/schema": "0.33.0",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",