@protobase/server 0.37.0 → 0.37.2

package/dist/better-auth/session-token.js

@@ -7,11 +7,16 @@ const messageOf = (body) => {
 };
 /**
 * The bearer token of the session a request's cookie carries, minted as `GET /api/auth/token` would, with the same
-* plugin hooks (the sign-in policy's hold-back included) but without its rate limit: a forged cookie fails its
-* signature before any store read. No session is a 401 problem, a refusal a 403 with Better Auth's message; any other
-* error stays as it is.
+* plugin hooks (the sign-in policy's hold-back included). The direct call has no rate limit, so nothing before the
+* signature check may read the store: the session is read first, which refuses a cookie that is missing, forged or for
+* no session before any store read, and the policy is read only for a session that exists. No session is a 401
+* problem, a refusal a 403 with Better Auth's message; any other error, such as a store failure, stays as it is.
 */
 const betterAuthSessionToken = (auth) => async (request) => {
+	if (await auth.api.getSession({
+		headers: request.headers,
+		query: { disableRefresh: true }
+	}) === null) throw unauthorized("Sign in first");
 	try {
 		const { token } = await auth.api.getToken({ headers: request.headers });
 		return token;

package/dist/create-admin.d.ts

@@ -75,8 +75,9 @@ export type CreateAdminInput = {
   /** @internal Verifies a user's token on `/api/sb/rest/v1`, `/api/sb/realtime/v1` and `/api/sb/storage/v1` and gives its claims, which tests fake; those `/api/sb/auth/v1` signs otherwise. */
   verifyToken?: (token: string) => Promise<JWTPayload>;
   /**
-   * The host's WebSocket upgrade, such as `@hono/node-server`'s, with which an app with keys and live resources serves
-   * supabase-js's Realtime at `/api/sb/realtime/v1/websocket`; without it, the app serves none.
+   * The host's WebSocket upgrade, `@hono/node-server`'s `upgradeWebSocket`, the only one supported: function sockets use
+   * its `ws` socket's send callback and `bufferedAmount`. With it, functions accept sockets, and an app with keys and
+   * live resources serves supabase-js's Realtime at `/api/sb/realtime/v1/websocket`; without it, the app serves none.
    */
   upgradeWebSocket?: UpgradeWebSocket;
 };

package/dist/functions/define-function.d.ts

@@ -14,9 +14,11 @@ export type PublicFunctionContext = {
   /** The caller, through the app's own `authenticate`: rejects with a 401 problem when the request carries no valid token. */
   caller: () => Promise<FunctionCaller>;
   /**
-   * Answers a WebSocket upgrade with a socket: return its response. A request that is no upgrade is a 426 problem. A
-   * protected function's caller is checked again every minute while the socket is open, which closes with 1008 once
-   * they would be refused; a public function checks its own callers.
+   * Answers a WebSocket upgrade with a socket: return its response. A request that is no upgrade is a 426 problem. While
+   * the socket is open, the caller of a protected function, and of a public one once `caller()` resolved, is checked
+   * again every minute: their credential, the function's roles, and the same user, tenant, organization and roles. The
+   * socket closes with 1008 once they would be refused. The function's own checks, such as access to one record, are
+   * not repeated unless it passes them as `recheck`.
    */
   acceptWebSocket: (events: SocketEvents) => Response;
 };

package/dist/functions/function-socket.d.ts

@@ -14,5 +14,11 @@ export type SocketEvents = {
   /** Text arrives as a string, binary as an ArrayBuffer. The next message waits until a returned promise settles. */
   onMessage?: (data: string | ArrayBuffer, socket: FunctionSocket) => void | Promise<void>;
   onClose?: (code: number, reason: string) => void | Promise<void>;
+  /**
+   * Checked every minute after the framework's own check, while the socket is open; what it returns is ignored. Throw
+   * or reject with a 401, 403 or 404 problem to close the socket with 1008; any other error is reported and closes it
+   * with 1011.
+   */
+  recheck?: () => unknown;
 };
 //#endregion

package/dist/functions/function-socket.js

@@ -61,8 +61,12 @@ const socketEvents = (events, { report, recheck }) => {
 					return raw.bufferedAmount;
 				}
 			};
-			if (recheck) stopRecheck = recheckWhileOpen({
-				check: recheck,
+			const check = async () => {
+				await recheck?.();
+				await events.recheck?.();
+			};
+			if (recheck || events.recheck) stopRecheck = recheckWhileOpen({
+				check,
 				close: end,
 				report
 			});

package/dist/functions/routes.js

@@ -18,8 +18,8 @@ const isUpgrade = (request) => request.headers.get("upgrade")?.toLowerCase() ===
 * a call without a valid token is the authenticator's 401 problem, and one its gate refuses a 403; a public one gets the caller only when it asks. Each
 * call runs as background work, so calls that hold the database for long leave a connection to page requests. Once a
 * call ends, failed or not, `wake` runs, so what it wrote reaches open pages without waiting for the dispatcher's poll.
-* A function may answer an upgrade with a socket, only once it returned; a protected one's caller is checked again
-* every minute while it is open.
+* A function may answer an upgrade with a socket, only once it returned. While it is open, its caller is checked again
+* every minute: a protected function's always, a public one's once `caller()` resolved.
 */
 const functionRoutes = ({ basePath, functions, authenticate, access, db, records, onError, wake, upgradeWebSocket, upgradeAuthenticate = authenticate, report }) => {
 	const app = new Hono().basePath(basePath);
@@ -33,6 +33,11 @@ const functionRoutes = ({ basePath, functions, authenticate, access, db, records
 		};
 	};
 	const call = (work) => work().finally(wake);
+	const recheckCaller = async (name, gate, request, first) => {
+		const again = await upgradeAuthenticate(request);
+		requireGate(name, gate, again);
+		if (!sameCaller(first, again)) throw forbidden("caller-changed", "Your access changed: open the socket again");
+	};
 	for (const [name, fn] of Object.entries(functions)) {
 		const prefix = `${basePath}/${name}`;
 		const { options } = fn;
@@ -42,26 +47,28 @@ const functionRoutes = ({ basePath, functions, authenticate, access, db, records
 			const request = relativeRequest(c.req.raw, prefix);
 			if (options.public) {
 				let caller;
+				let admitted;
+				const resolveCaller = () => caller ??= callerOf(c.req.raw).then((resolved) => (admitted = resolved.session, resolved));
+				const recheck = async () => {
+					if (admitted) await recheckCaller(name, gate, c.req.raw, admitted);
+				};
 				const acceptor = socketAcceptor({
 					c,
 					upgradeWebSocket,
-					report
+					report,
+					recheck
 				});
 				const context = {
 					name,
 					db,
-					caller: () => caller ??= callerOf(c.req.raw),
+					caller: resolveCaller,
 					acceptWebSocket: acceptor.accept
 				};
 				return acceptor.answer(name, await invokeFunction(name, fn, request, context));
 			}
 			const caller = await callerOf(c.req.raw);
 			requireGate(name, gate, caller.session);
-			const recheck = async () => {
-				const again = await upgradeAuthenticate(c.req.raw);
-				requireGate(name, gate, again);
-				if (!sameCaller(caller.session, again)) throw forbidden("caller-changed", "Your access changed: open the socket again");
-			};
+			const recheck = () => recheckCaller(name, gate, c.req.raw, caller.session);
 			const acceptor = socketAcceptor({
 				c,
 				upgradeWebSocket,

package/dist/functions/socket-recheck.js

@@ -1,10 +1,17 @@
 import { HttpProblem } from "../problem.js";
 //#region src/functions/socket-recheck.ts
-const isRefusal = (error) => error instanceof HttpProblem && (error.status === 401 || error.status === 403);
+const refusals = /* @__PURE__ */ new Set([
+	401,
+	403,
+	404
+]);
+const isRefusal = (error) => error instanceof HttpProblem && refusals.has(error.status);
 /**
-* Runs `check` every `everyMs` while a socket is open, one check after the other. A refusal closes the socket with 1008
-* (Policy Violation) and the problem's title; any other error is reported and closes it with 1011, so an outage that
-* stops the check ends the access too. Returns the function that stops it.
+* Runs `check` every `everyMs` while a socket is open, one check after the other. A refusal, such as a record the caller
+* can no longer see (404), closes the socket with 1008 (Policy Violation) and the problem's title; any other error is
+* reported and closes it with 1011, so an outage that stops the check ends the access too. A check still pending after
+* another `everyMs` counts as such an error, so a hung store never leaves a socket open unchecked. Returns the function
+* that stops it.
 */
 const recheckWhileOpen = ({ check, close, report, everyMs = 6e4 }) => {
 	let stopped = false;
@@ -16,9 +23,14 @@ const recheckWhileOpen = ({ check, close, report, everyMs = 6e4 }) => {
 		report(error);
 		close(1011, "Internal Error");
 	};
-	const run = () => check().then(() => {
-		if (!stopped) schedule();
-	}, end);
+	const run = () => {
+		timer = setTimeout(() => end(/* @__PURE__ */ new Error(`A socket's check did not finish within ${everyMs} ms`)), everyMs);
+		timer.unref?.();
+		check().then(() => {
+			clearTimeout(timer);
+			if (!stopped) schedule();
+		}, end);
+	};
 	const schedule = () => {
 		timer = setTimeout(run, everyMs);
 		timer.unref?.();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.37.0",
+  "version": "0.37.2",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.37.0",
-    "@protobase/query": "0.37.0",
-    "@protobase/schema": "0.37.0",
+    "@protobase/layout": "0.37.2",
+    "@protobase/query": "0.37.2",
+    "@protobase/schema": "0.37.2",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",