@protobase/server 0.40.6 → 0.40.8

package/dist/better-auth/authenticator.d.ts

@@ -31,7 +31,9 @@ export type BetterAuthAuthenticator = Authenticator & {
    * An authenticator for the OAuth access tokens issued for `audience` alone: the app's keys, a `typ` of `at+jwt`, and
    * proof of the key for a DPoP-bound token, checked against `audience` as the URL it guards (the endpoint must answer
    * at exactly that URL). The app's own tokens and trusted apps' are refused; the session keeps the token's `client`.
-   * With `jwksUrl` instead of `auth`, a DPoP proof's single use holds in this process only.
+   * With `auth`, every request also reads the store to check that the person still allows the client
+   * (`checkMcpGrant`), so a disconnected client or a secured account ends its tokens at once. With `jwksUrl` instead of
+   * `auth`, a token works until it expires, and a DPoP proof's single use holds in this process only.
    */
   forAudience: (audience: string) => Authenticator;
 };

package/dist/better-auth/authenticator.js

@@ -2,6 +2,7 @@ import { jwtSessions } from "../auth/jwt.js";
 import { noGlobalRole } from "./organizations/role-definitions.js";
 import { cachedKeys } from "./jwks-cache.js";
 import { withTrustedApps } from "./app-tokens.js";
+import { checkMcpGrant } from "./mcp/grant-standing.js";
 import { checkTokenStanding, tokenClaims } from "./token-standing.js";
 import { createDpopReplayStore, createInMemoryDpopReplayStore } from "better-auth/oauth2";
 //#region src/better-auth/authenticator.ts
@@ -43,7 +44,7 @@ const betterAuthAuthenticator = (options) => {
 		});
 		const verify = async (request) => {
 			const { payload, session } = await sessions(request);
-			if (auth && standing) await checkTokenStanding(await auth.$context, tokenClaims(payload, session.user.roles, organizations ? session.tenant : void 0), organizations);
+			if (auth) await standing(await auth.$context, payload, session);
 			return session;
 		};
 		if (!organizations) return verify;
@@ -62,7 +63,13 @@ const betterAuthAuthenticator = (options) => {
 	};
 	let replayStore;
 	const dpopReplayStore = () => replayStore ??= options.auth ? options.auth.$context.then(({ internalAdapter }) => createDpopReplayStore(internalAdapter)) : Promise.resolve(createInMemoryDpopReplayStore());
-	const own = sessionOf({ audience: options.audience ?? issuer }, true);
+	const ownStanding = (context, payload, session) => checkTokenStanding(context, tokenClaims(payload, session.user.roles, organizations ? session.tenant : void 0), organizations);
+	const own = sessionOf({ audience: options.audience ?? issuer }, ownStanding);
+	const grantStanding = (context, payload, session) => checkMcpGrant(context.adapter, {
+		userId: payload.sub,
+		clientId: session.client?.id,
+		issuedAt: payload.iat
+	});
 	return Object.assign(withTrustedApps(own, issuer, options.apps ?? []), { forAudience: (audience) => sessionOf({
 		audience,
 		typ: "at+jwt",
@@ -71,7 +78,7 @@ const betterAuthAuthenticator = (options) => {
 			replayStore: dpopReplayStore
 		},
 		oauthClient: true
-	}, false) });
+	}, grantStanding) });
 };
 //#endregion
 export { betterAuthAuthenticator, betterAuthTokens };

package/dist/better-auth/create-auth.d.ts

@@ -8446,6 +8446,24 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-mcp-refresh-reuse";
+    hooks: {
+      before: {
+        matcher: (context: {
+          path?: string;
+          body?: unknown;
+        }) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+      after: {
+        matcher: (context: {
+          path?: string;
+          body?: unknown;
+        }) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "protobase-mcp-connected-apps";
     endpoints: {

package/dist/better-auth/mcp/grant-standing.js

@@ -0,0 +1,26 @@
+import { unauthorized } from "../../problem.js";
+import "./consent-check.js";
+//#region src/better-auth/mcp/grant-standing.ts
+/**
+* Whether an MCP access token's grant still stands, read from the store on every request: the person still allows its
+* client with a consent made no later than the token. Disconnecting the client, or securing the account, deletes the
+* consents (`revokeMcpGrants`), so its access tokens stop at once instead of working out their 15 minutes, and stay
+* stopped when the person allows the client again, whose new consent is newer than them. Not the browser session that
+* allowed the client: the grant outlives it. A lookup that fails is not caught.
+*/
+const checkMcpGrant = async (adapter, { userId, clientId, issuedAt }) => {
+	if (clientId === void 0) throw unauthorized("The access token names no client");
+	if (issuedAt === void 0) throw unauthorized("The access token has no issue time");
+	if (!(await adapter.findMany({
+		model: "oauthConsent",
+		where: [{
+			field: "userId",
+			value: userId
+		}, {
+			field: "clientId",
+			value: clientId
+		}]
+	})).some((consent) => new Date(consent.createdAt).getTime() <= issuedAt * 1e3)) throw unauthorized("The client was disconnected: connect it again");
+};
+//#endregion
+export { checkMcpGrant };

package/dist/better-auth/mcp/mcp-plugins.js

@@ -4,6 +4,7 @@ import { pluginNames } from "../snake-case-names.js";
 import { mcpConnectedApps } from "./connected-apps.js";
 import { consentReference } from "./consent-reference.js";
 import { mcpTokenClaims } from "./mcp-token-claims.js";
+import { mcpRefreshReuse } from "./refresh-reuse.js";
 import { mcpRequestDefaults } from "./request-defaults.js";
 import { mcpSetupGate } from "./setup-gate.js";
 import { mcpSignedQueryGuard } from "./signed-query-guard.js";
@@ -56,7 +57,8 @@ const mcpUnusedPaths = [
 /**
 * The Better Auth plugins of an OAuth provider for MCP clients, after the `jwt` plugin, in this order: the guard on
 * signed queries, the request defaults, the setup gate, the provider (`mcp()`), and client metadata documents
-* (`cimd()`), the revocation when the account is secured (`mcpGrantRevocation`), and the person's list of connected
+* (`cimd()`), the revocation when the account is secured (`mcpGrantRevocation`) or a refresh token is reused
+* (`mcpRefreshReuse`), and the person's list of connected
 * apps, where they disconnect one (`mcpConnectedApps`). A client registers itself, the person signs in on the app's own pages and allows it on the connect
 * page, and the client gets 15-minute access tokens for the MCP resource only, with refresh tokens, carrying the role
 * and organization the person worked in when they allowed it.
@@ -101,6 +103,7 @@ const mcpAuthPlugins = ({ mcp: resolved, organizations, mail, defaultPolicy, def
 		metadataProfile: "mcp-2026-07-28"
 	}),
 	mcpGrantRevocation(),
+	mcpRefreshReuse(),
 	mcpConnectedApps({ definitions })
 ];
 //#endregion

package/dist/better-auth/mcp/refresh-reuse.js

@@ -0,0 +1,66 @@
+import { revokeMcpGrants } from "./revoke-grants.js";
+import { base64url } from "jose";
+import { createAuthMiddleware } from "better-auth/api";
+//#region src/better-auth/mcp/refresh-reuse.ts
+const refreshModel = "oauthRefreshToken";
+/** The refresh token a request to the token or revocation endpoint presents, or `undefined`. */
+const presentedRefreshToken = (path, body) => {
+	if (typeof body !== "object" || body === null) return void 0;
+	const params = body;
+	if (path === "/oauth2/token" && params.grant_type === "refresh_token" && typeof params.refresh_token === "string") return params.refresh_token;
+	if (path === "/oauth2/revoke" && params.token_type_hint !== "access_token" && typeof params.token === "string") return params.token;
+};
+const storedToken = async (token) => base64url.encode(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token))));
+/** The stored row of a refresh token, before the provider handles it. */
+const findRefreshToken = async (adapter, token) => await adapter.findOne({
+	model: refreshModel,
+	where: [{
+		field: "token",
+		value: await storedToken(token)
+	}]
+}) ?? void 0;
+/**
+* Ends the grant after the provider took a refresh token for stolen: when a rotated one is presented again, it deletes
+* every refresh token of that client and person (`invalidateRefreshFamily`) but leaves the consent, so the access
+* tokens would still be taken. A row the request found before and that is gone after was deleted that way, so the
+* grant is revoked (`revokeMcpGrants`), and the client's access tokens stop at once (`checkMcpGrant`).
+*/
+const endGrantIfFamilyInvalidated = async (adapter, before) => {
+	if (await adapter.findOne({
+		model: refreshModel,
+		where: [{
+			field: "id",
+			value: before.id
+		}]
+	})) return;
+	await revokeMcpGrants(adapter, before.userId, before.clientId);
+};
+/**
+* Hooks around the token and revocation endpoints that disconnect a client whose refresh token was reused
+* (`endGrantIfFamilyInvalidated`). A failure to read or delete is not caught: the request answers 500.
+*/
+const mcpRefreshReuse = () => {
+	const found = /* @__PURE__ */ new WeakMap();
+	const matcher = (context) => presentedRefreshToken(context.path, context.body) !== void 0;
+	return {
+		id: "protobase-mcp-refresh-reuse",
+		hooks: {
+			before: [{
+				matcher,
+				handler: createAuthMiddleware(async (ctx) => {
+					const row = await findRefreshToken(ctx.context.adapter, presentedRefreshToken(ctx.path, ctx.body));
+					if (row) found.set(ctx.context, row);
+				})
+			}],
+			after: [{
+				matcher,
+				handler: createAuthMiddleware(async (ctx) => {
+					const row = found.get(ctx.context);
+					if (row) await endGrantIfFamilyInvalidated(ctx.context.adapter, row);
+				})
+			}]
+		}
+	};
+};
+//#endregion
+export { endGrantIfFamilyInvalidated, findRefreshToken, mcpRefreshReuse, presentedRefreshToken };

package/dist/better-auth/mcp/revoke-grants.js

@@ -3,9 +3,9 @@ import { createAuthMiddleware } from "better-auth/api";
 //#region src/better-auth/mcp/revoke-grants.ts
 /**
 * Disconnects the user's MCP clients, or only `clientId`: deletes their consents, then their access tokens and refresh
-* tokens. Without the consent no code or refresh is exchanged any more (`mcpConsentCheck`), and authorize asks the
-* person again; access tokens already issued work out their 15 minutes. Access tokens go before refresh tokens, as the
-* provider's own revocation does, since an access token's row may name its refresh token.
+* tokens. Without the consent no code or refresh is exchanged any more (`mcpConsentCheck`), access tokens already
+* issued are refused at the next request (`checkMcpGrant`), and authorize asks the person again. Access tokens go
+* before refresh tokens, as the provider's own revocation does, since an access token's row may name its refresh token.
 */
 const revokeMcpGrants = async (adapter, userId, clientId) => {
 	const where = [{

package/dist/better-auth/operator-provider.js

@@ -47,10 +47,10 @@ const resolveOperator = (provider) => {
 		sessionMinutes
 	};
 };
-const base64url = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+const base64url$1 = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 /** A random value for `state`, `nonce` and the PKCE verifier. */
-const randomValue = () => base64url(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)));
-const challengeOf = async (verifier) => base64url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
+const randomValue = () => base64url$1(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)));
+const challengeOf = async (verifier) => base64url$1(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
 /**
 * An OpenID Connect client of the operator provider: the authorization code flow with PKCE, a client secret, and an
 * ID token verified against the provider's keys, issuer, this client and the nonce. The provider's settings and keys

package/dist/meta.d.ts

@@ -19,6 +19,8 @@ export type ResourcePermissions = {
 export type CallerMeta = {
   /** The app's name, which ends the admin app's tab titles. */
   appName: string;
+  /** The Protobase version the server runs: the admin app offers a reload when it changes under an open page. */
+  protobaseVersion: string;
   /** The app's own icon, its favicon's path, when the project has one: the sidebar's logo draws it beside the name. */
   appIcon?: string;
   resources: ResourceModel[];

package/dist/meta.js

@@ -5,6 +5,7 @@ import { pruneView } from "./view-access.js";
 import { activeRole } from "./active-role.js";
 import { pluginsFor } from "./plugins/plugin-settings.js";
 import { metaModel } from "./meta-model.js";
+import { protobaseVersion } from "./protobase-version.js";
 import { seesRuntime } from "./runtime/runtime-settings.js";
 import { sourcesFor } from "./sources/source-settings.js";
 import { prunePage } from "@protobase/layout";
@@ -63,6 +64,7 @@ const createMeta = (deps, appName, appIcon) => {
 		const sources = sourcesFor(deps.sources, session.user.roles);
 		const body = {
 			appName,
+			protobaseVersion,
 			...appIcon && { appIcon },
 			resources: visible.map(metaModel),
 			views,
@@ -98,8 +100,11 @@ const createMeta = (deps, appName, appIcon) => {
 			etag: `"${(await sha256Hex(stableJson(body))).slice(0, 32)}"`
 		};
 	};
-	/** The X-Meta-Version header: the models, and the roles the access depends on, so a role change moves it. */
-	const version = async (roles) => (await sha256Hex(`${await base}|${[...roles].sort().join(",")}`)).slice(0, 32);
+	/**
+	* The X-Meta-Version header: the models, the Protobase version, so the admin app reads `/meta` again on the first
+	* answer after an upgrade, and the roles the access depends on, so a role change moves it.
+	*/
+	const version = async (roles) => (await sha256Hex(`${await base}|${protobaseVersion}|${[...roles].sort().join(",")}`)).slice(0, 32);
 	return {
 		forCaller,
 		version

package/dist/package.js

@@ -0,0 +1,4 @@
+//#region package.json
+var version = "0.40.8";
+//#endregion
+export { version };

package/dist/protobase-version.js

@@ -0,0 +1,6 @@
+import { version } from "./package.js";
+//#region src/protobase-version.ts
+/** The Protobase version this server is, from @protobase/server's package.json: `/meta` names it to the admin app. */
+const protobaseVersion = version;
+//#endregion
+export { protobaseVersion };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.40.6",
+  "version": "0.40.8",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.40.6",
-    "@protobase/query": "0.40.6",
-    "@protobase/schema": "0.40.6",
+    "@protobase/layout": "0.40.8",
+    "@protobase/query": "0.40.8",
+    "@protobase/schema": "0.40.8",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",