@protobase/server 0.33.4 → 0.34.0

package/dist/assistant/query-tools.js

@@ -48,7 +48,7 @@ const readOnlyQueryTool = (db, options = {}) => defineTool({
 */
 const readWriteQueryTool = (db, options = {}) => defineTool({
 	name: "propose_write_query",
-	description: "Proposes one PostgreSQL INSERT, UPDATE or DELETE ending in a RETURNING clause. The user sees the statement and your summary and must approve it; only then it runs in a read-write transaction, and you get the returned rows as JSON, or the answer that it did not run. Use it only when the user asked for a change.",
+	description: "Proposes one PostgreSQL INSERT, UPDATE or DELETE ending in a RETURNING clause. The user sees the statement and your summary and must approve it; only then it runs in a read-write transaction, and you get the returned rows as JSON, or the answer that it did not run. Use it only when the user asked for a change. Never write a value that starts with pbenc: or a column that holds such values: those are encrypted fields, which only the app's own forms and API can write.",
 	parameters: {
 		type: "object",
 		properties: {

package/dist/auth/jwt.d.ts

@@ -1,4 +1,5 @@
 import { Authenticator, TenantValue } from "../types.js";
+import { DpopReplayStore } from "better-auth/oauth2";
 import { JWTPayload, JWTVerifyGetKey } from "jose";
 //#region src/auth/jwt.d.ts
 export type JwtOptions = {
@@ -19,8 +20,21 @@ export type JwtOptions = {
   algorithms?: string[];
   /** A fixed tenant (or resolver) used instead of any claim, for single-tenant deployments. */
   tenant?: TenantValue | (() => Promise<TenantValue | undefined>);
+  /** The token type its header must name, such as `at+jwt` for an OAuth access token (RFC 9068). Default any. */
+  typ?: string;
+  /**
+   * Takes OAuth access tokens bound to a key (DPoP, RFC 9449) as well as bearer ones: the `DPoP` scheme with a proof in
+   * the `DPoP` header, made for `url` with the request's method. A bound token works only with a fresh proof from its
+   * key, each proof once (`replayStore`); a bearer token is refused with the `DPoP` scheme. Default bearer tokens only.
+   */
+  dpop?: {
+    url: string;
+    replayStore: () => Promise<DpopReplayStore>;
+  };
+  /** Keeps the OAuth client the token was issued to, its `client_id` and `scope`, in the session's `client`. */
+  oauthClient?: boolean;
 };
-export type JwtVerifyOptions = Pick<JwtOptions, 'jwksUrl' | 'keys' | 'issuer' | 'audience' | 'algorithms'>;
+export type JwtVerifyOptions = Pick<JwtOptions, 'jwksUrl' | 'keys' | 'issuer' | 'audience' | 'algorithms' | 'typ'>;
 /** Verifies a JWT against a JWKS and returns its claims; a token that does not verify is a 401 problem. */
 export declare const jwtVerifier: (options: JwtVerifyOptions) => (token: string) => Promise<JWTPayload>;
 /** Verifies `Authorization: Bearer <jwt>` against a JWKS; `sub` is the user id. Without the header, `MissingCredentials`. */

package/dist/auth/jwt.js

@@ -1,4 +1,5 @@
 import { MissingCredentials, unauthorized } from "../problem.js";
+import { enforceDpopBinding, isDpopBindingError, parseAccessTokenAuthorization } from "better-auth/oauth2";
 import { createRemoteJWKSet, errors, jwtVerify } from "jose";
 //#region src/auth/jwt.ts
 const asymmetric = [
@@ -17,6 +18,20 @@ const rolesOf = (claim) => {
 	if (typeof claim === "string") return claim.split(/[\s,]+/).filter(Boolean);
 	return Array.isArray(claim) ? claim.filter((role) => typeof role === "string") : [];
 };
+const authorizationOf = (header, dpop) => {
+	if (dpop) {
+		const authorization = parseAccessTokenAuthorization(header);
+		if (!authorization || authorization.scheme === "Unknown" || !authorization.token) throw unauthorized("Send an access token in the Authorization header");
+		return authorization;
+	}
+	const [scheme, token] = header.split(" ");
+	if (scheme?.toLowerCase() !== "bearer" || !token) throw unauthorized("Send a bearer token in the Authorization header");
+	return {
+		scheme: "Bearer",
+		token
+	};
+};
+const scopesOf = (claim) => typeof claim === "string" ? claim.split(" ").filter(Boolean) : [];
 /** Verifies a JWT against a JWKS and returns its claims; a token that does not verify is a 401 problem. */
 const jwtVerifier = (options) => {
 	const keys = options.keys ?? (options.jwksUrl ? createRemoteJWKSet(new URL(options.jwksUrl)) : void 0);
@@ -25,7 +40,8 @@ const jwtVerifier = (options) => {
 		return (await jwtVerify(token, keys, {
 			algorithms: options.algorithms ?? asymmetric,
 			...options.issuer && { issuer: options.issuer },
-			...options.audience && { audience: options.audience }
+			...options.audience && { audience: options.audience },
+			...options.typ && { typ: options.typ }
 		}).catch((error) => {
 			if (error instanceof errors.JOSEError) throw unauthorized("The bearer token is invalid or expired");
 			throw error;
@@ -39,14 +55,33 @@ const jwtSessions = (options) => {
 	return async (request) => {
 		const header = request.headers.get("authorization");
 		if (header === null) throw new MissingCredentials("Send a bearer token in the Authorization header");
-		const [scheme, token] = header.split(" ");
-		if (scheme?.toLowerCase() !== "bearer" || !token) throw unauthorized("Send a bearer token in the Authorization header");
-		const payload = await verify(token);
+		const authorization = authorizationOf(header, Boolean(options.dpop));
+		const payload = await verify(authorization.token);
+		if (options.dpop) {
+			const { url, replayStore } = options.dpop;
+			const proofJwt = request.headers.get("dpop") ?? void 0;
+			await enforceDpopBinding({
+				payload,
+				authorization,
+				proofJwt,
+				method: request.method,
+				url,
+				replayStore: await replayStore()
+			}).catch((error) => {
+				if (isDpopBindingError(error)) throw unauthorized(error.message);
+				throw error;
+			});
+		}
 		const { sub, [tenantClaim]: tenant, [rolesClaim]: roles } = payload;
 		const extraRoles = options.extraRolesClaim === void 0 ? [] : rolesOf(payload[options.extraRolesClaim]);
 		if (!sub) throw unauthorized("The bearer token has no subject");
 		const claimed = typeof tenant === "string" || typeof tenant === "number" ? tenant : void 0;
 		const tenantValue = options.tenant === void 0 ? claimed : typeof options.tenant === "function" ? await options.tenant() : options.tenant;
+		const { client_id: clientId, scope } = payload;
+		const client = options.oauthClient && typeof clientId === "string" ? { client: {
+			id: clientId,
+			scopes: scopesOf(scope)
+		} } : {};
 		return {
 			payload,
 			session: {
@@ -54,7 +89,8 @@ const jwtSessions = (options) => {
 					id: sub,
 					roles: [.../* @__PURE__ */ new Set([...rolesOf(roles), ...extraRoles])]
 				},
-				...tenantValue !== void 0 && { tenant: tenantValue }
+				...tenantValue !== void 0 && { tenant: tenantValue },
+				...client
 			}
 		};
 	};

package/dist/better-auth/authenticator.d.ts

@@ -19,6 +19,21 @@ export type BetterAuthAuthenticatorOptions = {
   cache?: JwksCacheOptions;
   /** Other Protobase apps whose users this API admits with their own tokens, so their admin apps can draw its resources (see `TrustedApp`). */
   apps?: TrustedApp[];
+  /** The audience the tokens must name; default `issuer`, the app's own tokens. */
+  audience?: string;
+};
+/**
+ * Verifies the app's tokens, and with `forAudience` the OAuth access tokens it issues for another audience, such as
+ * its MCP endpoint (`auth.mcp.resource`).
+ */
+export type BetterAuthAuthenticator = Authenticator & {
+  /**
+   * An authenticator for the OAuth access tokens issued for `audience` alone: the app's keys, a `typ` of `at+jwt`, and
+   * proof of the key for a DPoP-bound token, checked against `audience` as the URL it guards (the endpoint must answer
+   * at exactly that URL). The app's own tokens and trusted apps' are refused; the session keeps the token's `client`.
+   * With `jwksUrl` instead of `auth`, a DPoP proof's single use holds in this process only.
+   */
+  forAudience: (audience: string) => Authenticator;
 };
 /** How the tokens of this Better Auth instance verify: its key set, and its issuer as both issuer and audience. */
 export declare const betterAuthTokens: (options: Pick<BetterAuthAuthenticatorOptions, "auth" | "jwksUrl" | "issuer" | "cache">) => JwtVerifyOptions & {
@@ -33,5 +48,5 @@ export declare const betterAuthTokens: (options: Pick<BetterAuthAuthenticatorOpt
  * a token works until it expires. With `apps`, the tokens of those apps are admitted too, with the roles each gives
  * its users here.
  */
-export declare const betterAuthAuthenticator: (options: BetterAuthAuthenticatorOptions) => Authenticator;
+export declare const betterAuthAuthenticator: (options: BetterAuthAuthenticatorOptions) => BetterAuthAuthenticator;
 //#endregion

package/dist/better-auth/authenticator.js

@@ -3,6 +3,7 @@ import { noGlobalRole } from "./organizations/role-definitions.js";
 import { cachedKeys } from "./jwks-cache.js";
 import { withTrustedApps } from "./app-tokens.js";
 import { checkTokenStanding, tokenClaims } from "./token-standing.js";
+import { createDpopReplayStore, createInMemoryDpopReplayStore } from "better-auth/oauth2";
 //#region src/better-auth/authenticator.ts
 /** How the tokens of this Better Auth instance verify: its key set, and its issuer as both issuer and audience. */
 const betterAuthTokens = (options) => {
@@ -28,33 +29,49 @@ const betterAuthAuthenticator = (options) => {
 	const tokens = betterAuthTokens(options);
 	const { issuer } = tokens;
 	const organizations = options.organizations ?? Boolean(options.auth?.organizations);
-	const sessions = jwtSessions({
-		...tokens,
-		rolesClaim: "role",
-		...organizations && {
-			tenantClaim: "org",
-			extraRolesClaim: "app_roles"
-		},
-		...options.tenant !== void 0 && { tenant: options.tenant }
-	});
 	const { auth } = options;
-	const verify = async (request) => {
-		const { payload, session } = await sessions(request);
-		if (auth) await checkTokenStanding(await auth.$context, tokenClaims(payload, session.user.roles, organizations ? session.tenant : void 0), organizations);
-		return session;
-	};
-	return withTrustedApps(!organizations ? verify : async (request) => {
-		const session = await verify(request);
-		const user = {
-			...session.user,
-			roles: session.user.roles.filter((role) => role !== noGlobalRole)
+	const sessionOf = (verifyOptions, standing) => {
+		const sessions = jwtSessions({
+			...tokens,
+			rolesClaim: "role",
+			...organizations && {
+				tenantClaim: "org",
+				extraRolesClaim: "app_roles"
+			},
+			...options.tenant !== void 0 && { tenant: options.tenant },
+			...verifyOptions
+		});
+		const verify = async (request) => {
+			const { payload, session } = await sessions(request);
+			if (auth && standing) await checkTokenStanding(await auth.$context, tokenClaims(payload, session.user.roles, organizations ? session.tenant : void 0), organizations);
+			return session;
 		};
-		return {
-			...session,
-			user,
-			...session.tenant !== void 0 && { organization: { id: session.tenant } }
+		if (!organizations) return verify;
+		return async (request) => {
+			const session = await verify(request);
+			const user = {
+				...session.user,
+				roles: session.user.roles.filter((role) => role !== noGlobalRole)
+			};
+			return {
+				...session,
+				user,
+				...session.tenant !== void 0 && { organization: { id: session.tenant } }
+			};
 		};
-	}, issuer, options.apps ?? []);
+	};
+	let replayStore;
+	const dpopReplayStore = () => replayStore ??= options.auth ? options.auth.$context.then(({ internalAdapter }) => createDpopReplayStore(internalAdapter)) : Promise.resolve(createInMemoryDpopReplayStore());
+	const own = sessionOf({ audience: options.audience ?? issuer }, true);
+	return Object.assign(withTrustedApps(own, issuer, options.apps ?? []), { forAudience: (audience) => sessionOf({
+		audience,
+		typ: "at+jwt",
+		dpop: {
+			url: audience,
+			replayStore: dpopReplayStore
+		},
+		oauthClient: true
+	}, false) });
 };
 //#endregion
 export { betterAuthAuthenticator, betterAuthTokens };