@protobase/server 0.40.8 → 0.40.9

package/dist/better-auth/app-tokens.js

@@ -2,7 +2,7 @@ import { checkedUrl } from "../checked-url.js";
 import { forbidden } from "../problem.js";
 import { jwtAuthenticator } from "../auth/jwt.js";
 import { noGlobalRole } from "./organizations/role-definitions.js";
-import "./auth-base-path.js";
+import { authBasePath } from "./auth-base-path.js";
 import { createRemoteJWKSet, decodeJwt, errors } from "jose";
 //#region src/better-auth/app-tokens.ts
 const claimedIssuer = (request) => {
@@ -19,7 +19,7 @@ const claimedIssuer = (request) => {
 const trustedAuthenticator = (app, issuer) => {
 	const forms = [issuer, `${issuer}/`];
 	const verify = jwtAuthenticator({
-		keys: app.keys ?? createRemoteJWKSet(new URL(`/api/auth/jwks`, issuer)),
+		keys: app.keys ?? createRemoteJWKSet(new URL(`${authBasePath}/jwks`, issuer)),
 		issuer: forms,
 		audience: forms,
 		rolesClaim: "role",

package/dist/better-auth/auth-base-path.d.ts

@@ -0,0 +1 @@
+import "@protobase/schema/internal";

package/dist/better-auth/auth-base-path.js

@@ -1,5 +1,2 @@
-//#region src/better-auth/auth-base-path.ts
-/** Where Better Auth's endpoints are served, below the app's origin. */
-const authBasePath = "/api/auth";
-//#endregion
+import { authBasePath } from "@protobase/schema/internal";
 export { authBasePath };

package/dist/better-auth/create-auth.d.ts

@@ -1,6 +1,7 @@
 import { StaffSignIn } from "./staff-log.js";
 import { RoleDefinitions, RolesInput } from "./organizations/role-definitions.js";
 import { ConnectedApp } from "./mcp/connected-apps.js";
+import "./auth-base-path.js";
 import { Mailer } from "../mail/smtp-mailer.js";
 import { OperatorProvider } from "./operator-provider.js";
 import { OrganizationRole } from "./organizations/store.js";
@@ -8649,7 +8650,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   };
   basePath: string;
   secret: string;
-  trustedOrigins: string[];
+  trustedOrigins: string[] | ((request?: Request) => string[]);
   emailAndPassword: {
     onPasswordReset?: ((data: {
       user: import("better-auth").User;
@@ -8673,6 +8674,11 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     maxPasswordLength: number;
   };
 }> & {
+  /**
+   * Answers a request from the app's iOS or Android build: Better Auth also trusts the Capacitor origin the request
+   * names. Only `createAdmin` with a `mobile` section uses it; `handler` and `api` never trust a Capacitor origin.
+   */
+  handleMobile: (request: Request) => Promise<Response>;
   /** Issuer and audience of the tokens: `baseURL`, on every origin. */
   issuer: string;
   /** Every origin the app is served on, `baseURL`'s first. */

package/dist/better-auth/create-auth.js

@@ -6,6 +6,7 @@ import { roleDefinitions } from "./organizations/role-definitions.js";
 import { signInPolicyPlugin } from "./policy-plugin.js";
 import { goTrueSessionsPlugin } from "../gotrue/sessions-plugin.js";
 import { authBasePath } from "./auth-base-path.js";
+import { mobileRequests } from "./mobile-requests.js";
 import { passwordLength } from "./new-account-password.js";
 import { platformMailer } from "../mail/platform-mailer.js";
 import { readOperatorSettings, resolveOperator } from "./operator-provider.js";
@@ -60,7 +61,7 @@ const organizationPaths = ["/organization/set-active", "/organization/accept-inv
 * The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
 * sign-in provider already resolved.
 */
-const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, appName = defaultAppName, mailer, signUpRole, operator, platformSignIn, saml = [], organizations, mcp, context = noContext, signInPolicy = defaultSignInPolicy }) => {
+const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, appName = defaultAppName, mailer, signUpRole, operator, platformSignIn, saml = [], organizations, mcp, context = noContext, signInPolicy = defaultSignInPolicy, mobile }) => {
 	const secure = options.baseURL.startsWith("https://");
 	const signIn = platformSignInFor(platformSignIn, Object.keys(options.socialProviders ?? {}));
 	const hosts = passkeyHosts([options.baseURL, ...origins]);
@@ -104,6 +105,11 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 		},
 		disableSettingJwtHeader: true
 	};
+	const trusted = [
+		options.baseURL,
+		...origins,
+		...options.trustedOrigins ?? []
+	];
 	const userFields = {
 		...userFieldsNamed(emailConfirmedField, users),
 		...organizations && userFieldsNamed(lastOrganizationField, users),
@@ -115,11 +121,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 		baseURL: multiHostBaseURL(options.baseURL, origins),
 		basePath: authBasePath,
 		secret: options.secret,
-		trustedOrigins: [
-			options.baseURL,
-			...origins,
-			...options.trustedOrigins ?? []
-		],
+		trustedOrigins: mobile ? (request) => [...trusted, ...mobile.trusted(request)] : trusted,
 		emailAndPassword: {
 			enabled: true,
 			disableSignUp: true,
@@ -310,7 +312,9 @@ const createAuth = (options) => {
 	const mcp = options.mcp && resolveMcp(options.baseURL, options.mcp);
 	let instance;
 	const context = () => instance?.$context ?? Promise.reject(/* @__PURE__ */ new Error("The auth instance is not made yet"));
+	const mobile = mobileRequests();
 	const auth = betterAuth(betterAuthOptions(options, {
+		mobile,
 		origins,
 		passkeyDomain,
 		roles,
@@ -329,6 +333,11 @@ const createAuth = (options) => {
 	}));
 	instance = auth;
 	return Object.assign(auth, {
+		/**
+		* Answers a request from the app's iOS or Android build: Better Auth also trusts the Capacitor origin the request
+		* names. Only `createAdmin` with a `mobile` section uses it; `handler` and `api` never trust a Capacitor origin.
+		*/
+		handleMobile: (request) => auth.handler(mobile.grant(request)),
 		/** Issuer and audience of the tokens: `baseURL`, on every origin. */
 		issuer: options.baseURL,
 		/** Every origin the app is served on, `baseURL`'s first. */

package/dist/better-auth/mobile-requests.js

@@ -0,0 +1,23 @@
+import { capacitorOrigins } from "../mobile-config.js";
+//#region src/better-auth/mobile-requests.ts
+/**
+* Which requests come from the app's iOS or Android build: `grant` marks a request, and `trusted` gives the Capacitor
+* origin it names as an origin Better Auth trusts, for that very request only. Any other request, or an Origin that is
+* not exactly a Capacitor origin, gets nothing.
+*/
+const mobileRequests = () => {
+	const granted = /* @__PURE__ */ new WeakSet();
+	return {
+		grant: (request) => {
+			granted.add(request);
+			return request;
+		},
+		trusted: (request) => {
+			if (!request || !granted.has(request)) return [];
+			const origin = request.headers.get("origin");
+			return origin !== null && capacitorOrigins.includes(origin) ? [origin] : [];
+		}
+	};
+};
+//#endregion
+export { mobileRequests };

package/dist/create-admin.d.ts

@@ -46,7 +46,10 @@ export type CreateAdminInput = {
   subscriptions?: SubscriptionDefinition[];
   /** Webhook subscriptions made in the admin app, from `extends: [webhooks()]` (see `WebhooksOptions`). */
   webhooks?: WebhooksOptions;
-  /** The app's iOS and Android build (see `MobileConfig`): the API answers its Capacitor origins through CORS. */
+  /**
+   * The app's iOS and Android build (see `MobileConfig`): the API answers its Capacitor origins through CORS, and sign-in
+   * at `/api/auth` trusts the Capacitor origin a request names, without CORS, as the app calls it through native HTTP.
+   */
   mobile?: MobileConfig;
   /** The app's colours, which its web manifest carries (see `AppIdentity`). */
   app?: AppIdentity;

package/dist/create-admin.js

@@ -275,7 +275,8 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 			db
 		}));
 		if (auth.mcp) mcpDiscovery(app, auth);
-		app.on(["GET", "POST"], `${authBasePath}/*`, async (c) => withoutSessionTokens(c.req.raw, await auth.handler(c.req.raw)));
+		const answer = mobile ? auth.handleMobile : auth.handler;
+		app.on(["GET", "POST"], `${authBasePath}/*`, async (c) => withoutSessionTokens(c.req.raw, await answer(c.req.raw)));
 		app.route(goTruePath, goTrueRoutes(auth));
 		if (auth.origins.length > 1) app.get(webauthnPath, (c) => c.json({ origins: auth.origins }));
 	}

package/dist/mobile-config.js

@@ -1,8 +1,6 @@
+import { capacitorOrigin } from "@protobase/schema/internal";
 //#region src/mobile-config.ts
-/**
-* The origins Capacitor's WebView serves the app's files on: `capacitor://localhost` on iOS, `https://localhost` on
-* Android. They hold because `protobase mobile` never sets Capacitor's `server.hostname` or schemes.
-*/
-const capacitorOrigins = ["capacitor://localhost", "https://localhost"];
+/** The origins Capacitor's WebView serves the app's files on: `capacitor://localhost` on iOS, `https://localhost` on Android. */
+const capacitorOrigins = Object.values(capacitorOrigin);
 //#endregion
 export { capacitorOrigins };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.40.8";
+var version = "0.40.9";
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.40.8",
+  "version": "0.40.9",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.40.8",
-    "@protobase/query": "0.40.8",
-    "@protobase/schema": "0.40.8",
+    "@protobase/layout": "0.40.9",
+    "@protobase/query": "0.40.9",
+    "@protobase/schema": "0.40.9",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",