@protobase/server 0.33.4 → 0.34.1

package/dist/write-pipeline.js

@@ -1,11 +1,13 @@
 import { HttpProblem, badRequest } from "./problem.js";
 import { tenantScope } from "./tenant.js";
 import { requestAccess, requireOperation, targetFilter, writableFields } from "./request-access.js";
-import { deleteRecord, fetchRecord, insertRecord, restoreRecord } from "./records.js";
+import { bindingOf, pendingBinding } from "./encryption/binding.js";
+import { deleteRecord, fetchRecord, insertRecord, restoreRecord, updateRecord } from "./records.js";
 import { writeTransaction } from "./transactions.js";
 import { blockedDelete } from "./blocked-delete.js";
 import { isDatabaseError } from "./error-handler.js";
 import { attachFiles } from "./files/attach.js";
+import { encryptedValuesOf, hasEncryptedValues, sealValues } from "./encryption/seal-values.js";
 import { actorSettings, wakeDispatch } from "./changes/actor.js";
 import { validateBody } from "./validate-body.js";
 import { assertWritten, checkParents, checkPrecondition, decide, denied, firstKeyField, keyOf, missing, notifier, shown } from "./write-shared.js";
@@ -21,6 +23,14 @@ const withOwner = (access, values) => {
 		[owner]: caller
 	};
 };
+const bindEncrypted = async (trx, deps, access, row, inserted, shape) => {
+	const { entry, full } = access;
+	if (!hasEncryptedValues(full, row)) return inserted;
+	const values = sealValues(deps.encryption, full, encryptedValuesOf(full, row), (field) => bindingOf(full, field, inserted.record));
+	const bound = await updateRecord(trx, entry, keyOf(access, inserted.record), tenantScope(entry, access.session)?.tenantValue, values, shape);
+	if (!bound) throw new Error(`A ${entry.name} record was created whose key the API cannot address, so its encrypted fields cannot be bound to it`);
+	return bound;
+};
 const create = async (trx, deps, access, body) => {
 	const { entry, full } = access;
 	const scope = tenantScope(entry, access.session);
@@ -33,7 +43,9 @@ const create = async (trx, deps, access, body) => {
 	const filter = await decide(access, "create", void 0, row);
 	const parents = checkParents(trx, access, "create");
 	await parents(row);
-	const created = await insertRecord(trx, entry, row, { etagFields: Object.keys(access.model.fields) });
+	const shape = { etagFields: Object.keys(access.model.fields) };
+	const inserted = await insertRecord(trx, entry, sealValues(deps.encryption, full, row, (field) => pendingBinding(full, field)), shape);
+	const created = await bindEncrypted(trx, deps, access, row, inserted, shape);
 	await assertWritten(trx, access, created, "create", access.resolved.rowFilter.create, filter);
 	await parents(created.record);
 	if (full.position) await checkRankAfter(trx, deps, access, full.position.field, [{

package/dist/write-shared.js

@@ -1,3 +1,4 @@
+import { maskEncrypted } from "./encryption/mask-stored.js";
 import { forbidden, notFound, preconditionFailed, preconditionRequired } from "./problem.js";
 import { tenantScope } from "./tenant.js";
 import { andFilters, recordDecision } from "./request-access.js";
@@ -44,7 +45,10 @@ const assertWritten = async (trx, access, written, operation, ...filters) => {
 		fields: [firstKeyField(access)]
 	})) throw denied(access.entry, `leave in that state (${operation})`);
 };
-/** The caller sees the readable fields only, files as objects with their URL; hooks get the whole record. */
+/**
+* The caller sees the readable fields only, files as objects with their URL; hooks get the whole record, a set encrypted
+* field as `encrypted`.
+*/
 const shown = async (access, written) => ({
 	record: (await presentFiles(access, [pickFields(written.record, Object.keys(access.model.fields))]))[0],
 	etag: written.etag
@@ -58,8 +62,8 @@ const notifier = (deps, access) => async (trx, kind, before, after) => {
 		user: session.user,
 		...session.tenant !== void 0 && { tenant: session.tenant },
 		...session.anonymous && { anonymous: true },
-		...before && { before },
-		...after && { after }
+		...before && { before: maskEncrypted(access.full, before) },
+		...after && { after: maskEncrypted(access.full, after) }
 	};
 	for (const hook of deps.hooks) await hook(event, trx);
 	await scheduleRemovedFiles(access, kind, before, after);

package/dist/write-update.js

@@ -1,7 +1,10 @@
+import { badRequest } from "./problem.js";
 import { tenantScope } from "./tenant.js";
 import { targetFilter } from "./request-access.js";
+import { bindingOf } from "./encryption/binding.js";
 import { fetchRecord, updateRecord } from "./records.js";
 import { attachFiles } from "./files/attach.js";
+import { sealValues } from "./encryption/seal-values.js";
 import { validateBody } from "./validate-body.js";
 import { assertWritten, checkParents, checkPrecondition, decide, denied, firstKeyField, missing, notifier } from "./write-shared.js";
 //#region src/write-update.ts
@@ -40,11 +43,18 @@ const planUpdate = async (trx, access, key, body, ifMatch, required = true) => {
 		parents
 	};
 };
+const refuseKeyChange = (access, plan) => {
+	const { full, entry } = access;
+	if (!Object.values(full.fields).some((field) => field.encrypted)) return;
+	if (full.primaryKey.some((name) => Object.hasOwn(plan.values, name) && String(plan.values[name]) !== String(plan.current.record[name]))) throw badRequest("key-change-unsupported", `The key of a ${entry.name} record cannot change: its encrypted fields are bound to it`);
+};
 /** Writes a planned update, checks the row as written against the filters, and runs the hooks. */
 const applyUpdate = async (trx, deps, access, key, plan) => {
-	const { entry } = access;
+	const { entry, full } = access;
+	refuseKeyChange(access, plan);
 	const tenant = tenantScope(entry, access.session)?.tenantValue;
-	const updated = await updateRecord(trx, entry, key, tenant, plan.values, { etagFields: Object.keys(access.model.fields) });
+	const values = sealValues(deps.encryption, full, plan.values, (field) => bindingOf(full, field, plan.current.record));
+	const updated = await updateRecord(trx, entry, key, tenant, values, { etagFields: Object.keys(access.model.fields) });
 	await assertWritten(trx, access, updated, "update", access.resolved.rowFilter.update, plan.filter);
 	await plan.parents(updated.record);
 	await notifier(deps, access)(trx, "update", plan.current.record, updated.record);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.33.4",
+  "version": "0.34.1",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,18 +30,22 @@
     "access": "public"
   },
   "dependencies": {
-    "@better-auth/passkey": "^1.7.7",
-    "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.33.4",
-    "@protobase/query": "0.33.4",
-    "@protobase/schema": "0.33.4",
+    "@better-auth/cimd": "^1.7.12",
+    "@better-auth/mcp": "^1.7.12",
+    "@better-auth/oauth-provider": "^1.7.12",
+    "@better-auth/passkey": "^1.7.12",
+    "@better-auth/sso": "^1.7.12",
+    "@protobase/layout": "0.34.1",
+    "@protobase/query": "0.34.1",
+    "@protobase/schema": "0.34.1",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",
     "@simplewebauthn/server": "^13.3.1",
     "altcha-lib": "^2.6.0",
     "bcryptjs": "^3.0.3",
-    "better-auth": "^1.7.7",
+    "better-auth": "^1.7.12",
+    "better-call": "1.4.4",
     "cron-parser": "^5.10.1",
     "file-type": "^22.1.1",
     "hono": "^4.13.13",