@protobase/server 0.44.4 → 0.44.5

package/dist/better-auth/create-auth.d.ts

@@ -4445,7 +4445,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           twoFactor: boolean;
           authenticatorApp: boolean;
         };
-        missing: ("passkey" | "twoFactor")[];
+        missing: ("twoFactor" | "passkey")[];
       }>;
     };
     hooks: {
@@ -5318,7 +5318,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         }[];
         total: number;
       }>;
-      acceptInvitation: import("better-call").StrictEndpoint<"/invitation/accept", {
+      acceptInvitationOfLink: import("better-call").StrictEndpoint<"/invitation/accept", {
         method: "POST";
         body: import("zod").ZodObject<{
           token: import("zod").ZodString;
@@ -5356,6 +5356,44 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           organizationId: string;
         };
       }>;
+      acceptOwnInvitation: import("better-call").StrictEndpoint<"/invitation/accept-own", {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          invitationId: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+      }, {
+        member: {
+          appRoles: string[];
+          id: string;
+          createdAt: Date;
+          role: string;
+          userId: string;
+          organizationId: string;
+        };
+      }>;
     };
     hooks: {
       after: {
@@ -5368,7 +5406,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   } | {
     id: "protobase-users";
     endpoints: {
-      getInvitation: import("better-call").StrictEndpoint<"/invitation", {
+      invitationOfLink: import("better-call").StrictEndpoint<"/invitation", {
         method: "GET";
         query: import("zod").ZodObject<{
           token: import("zod").ZodString;
@@ -5523,7 +5561,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         roles: string[];
         expiresAt: string;
       }>;
-      listUserInvitations: import("better-call").StrictEndpoint<"/users/invitations", {
+      listAppInvitations: import("better-call").StrictEndpoint<"/users/invitations", {
         method: "GET";
         use: import("better-call").Middleware<{
           use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{

package/dist/better-auth/create-auth.js

@@ -26,6 +26,7 @@ import { passwordResetOptions } from "./password-reset.js";
 import { rolesPlugin } from "./roles/roles-plugin.js";
 import { platformSignInFor, platformSignInProvider, readPlatformSignIn, resolvePlatformSignIn } from "./platform-sign-in.js";
 import { appSignInPolicy } from "./app-sign-in-policy.js";
+import { assertNoEndpointKeyClashes } from "./endpoint-key-clashes.js";
 import { emailInDomains, resolveSamlProviders, samlDisabledPaths, samlGuardPlugin, samlPlugin } from "./saml-sign-in.js";
 import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
 import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
@@ -313,7 +314,7 @@ const createAuth = (options) => {
 	let instance;
 	const context = () => instance?.$context ?? Promise.reject(/* @__PURE__ */ new Error("The auth instance is not made yet"));
 	const mobile = mobileRequests();
-	const auth = betterAuth(betterAuthOptions(options, {
+	const authOptions = betterAuthOptions(options, {
 		mobile,
 		origins,
 		passkeyDomain,
@@ -330,7 +331,9 @@ const createAuth = (options) => {
 		...organizations && { organizations },
 		...mcp && { mcp },
 		...(organizations || mcp) && { context }
-	}));
+	});
+	assertNoEndpointKeyClashes(authOptions.plugins);
+	const auth = betterAuth(authOptions);
 	instance = auth;
 	return Object.assign(auth, {
 		/**

package/dist/better-auth/endpoint-key-clashes.js

@@ -0,0 +1,23 @@
+//#region src/better-auth/endpoint-key-clashes.ts
+/**
+* Each endpoint key more than one plugin registers, with those plugins' ids. Better Auth merges the plugins' endpoints
+* by key into one object, so a later plugin's endpoint silently replaces an earlier one's of the same key, and the
+* earlier one's path answers 404.
+*/
+const endpointKeyClashes = (plugins) => {
+	const owners = /* @__PURE__ */ new Map();
+	for (const plugin of plugins) for (const key of Object.keys(plugin.endpoints ?? {})) owners.set(key, [...owners.get(key) ?? [], plugin.id]);
+	return [...owners].filter(([, ids]) => ids.length > 1).map(([key, ids]) => ({
+		key,
+		plugins: ids
+	}));
+};
+/** Fails when two plugins register an endpoint of the same key, as one would hide the other. */
+const assertNoEndpointKeyClashes = (plugins) => {
+	const clashes = endpointKeyClashes(plugins);
+	if (clashes.length === 0) return;
+	const list = clashes.map(({ key, plugins: ids }) => `${key} (${ids.join(", ")})`).join("; ");
+	throw new Error(`Auth plugins register the same endpoint keys, so one hides the other: ${list}`);
+};
+//#endregion
+export { assertNoEndpointKeyClashes, endpointKeyClashes };

package/dist/better-auth/invitations/invitation-endpoints.js

@@ -19,7 +19,7 @@ const invitationEndpoints = ({ mail, defaultPolicy, organizations }) => ({
 	* `GET /invitation?token=`: who invites, the address and roles, until when, and whether the address has an account;
 	* for an invitation to the app also the app's name, and for an organization's the organization and the role there.
 	*/
-	getInvitation: createAuthEndpoint("/invitation", {
+	invitationOfLink: createAuthEndpoint("/invitation", {
 		method: "GET",
 		query: tokenQuery
 	}, async (ctx) => {

package/dist/better-auth/organizations/accept-invitation.js

@@ -3,23 +3,33 @@ import { findMember, membersOf } from "./store.js";
 import { invalidInvitation, invitationIdOf, verifyInvitationToken } from "../invitations/invitation-token.js";
 import { APIError } from "better-auth/api";
 //#region src/better-auth/organizations/accept-invitation.ts
-/** The pending invitation an emailed link's token names, or a 400 `INVITATION_INVALID`. */
-const invitationOfToken = async (context, token) => {
-	const id = invitationIdOf(token);
-	const row = id && await context.adapter.findOne({
-		model: "invitation",
-		where: [{
-			field: "id",
-			value: id
-		}]
-	});
-	if (!row || !await verifyInvitationToken(context.secret, token, row)) throw new APIError("BAD_REQUEST", invalidInvitation);
+const findInvitation = (context, id) => context.adapter.findOne({
+	model: "invitation",
+	where: [{
+		field: "id",
+		value: id
+	}]
+});
+const pending = (row) => {
 	if (row.status !== "pending" || new Date(row.expiresAt).getTime() < Date.now()) throw new APIError("BAD_REQUEST", invalidInvitation);
 	return {
 		...row,
 		appRoles: parseAppRoles(row.appRoles)
 	};
 };
+/** The pending invitation an emailed link's token names, or a 400 `INVITATION_INVALID`. */
+const invitationOfToken = async (context, token) => {
+	const id = invitationIdOf(token);
+	const row = id && await findInvitation(context, id);
+	if (!row || !await verifyInvitationToken(context.secret, token, row)) throw new APIError("BAD_REQUEST", invalidInvitation);
+	return pending(row);
+};
+/** The pending invitation of `id`, or a 400 `INVITATION_INVALID`; only its own address may accept it (`acceptInvitation`). */
+const invitationOfId = async (context, id) => {
+	const row = await findInvitation(context, id);
+	if (!row) throw new APIError("BAD_REQUEST", invalidInvitation);
+	return pending(row);
+};
 /**
 * Makes `user` a member as the invitation says, with its organization role and app roles, in one transaction with the
 * invitation's acceptance, so a member never exists without the app roles they were invited with. Better Auth's own
@@ -73,4 +83,4 @@ const acceptInvitation = async (context, invitation, user, membershipLimit) => {
 	});
 };
 //#endregion
-export { acceptInvitation, invitationOfToken };
+export { acceptInvitation, invitationOfId, invitationOfToken };

package/dist/better-auth/organizations/invitation-endpoints.js

@@ -1,23 +1,31 @@
-import { acceptInvitation, invitationOfToken } from "./accept-invitation.js";
+import { acceptInvitation, invitationOfId, invitationOfToken } from "./accept-invitation.js";
 import * as z$1 from "zod";
 import { createAuthEndpoint, sessionMiddleware } from "better-auth/api";
 //#region src/better-auth/organizations/invitation-endpoints.ts
+const accept = async (context, invitation, membershipLimit) => {
+	const { user, session } = context.session;
+	const member = await acceptInvitation(context, invitation, user, membershipLimit);
+	await context.internalAdapter.updateSession(session.token, { activeOrganizationId: invitation.organizationId });
+	return { member };
+};
 /**
-* Accepting an organization's emailed invitation signed in. What a link is for, and making an account from it, are the
-* shared invitation endpoints (`invitations/invitation-endpoints.ts`), which serve invitations to the app as well.
+* Accepting an organization's invitation signed in, from its emailed link or from the person's own invitations (Better
+* Auth's `GET /organization/list-user-invitations`). What a link is for, and making an account from it, are the shared
+* invitation endpoints (`invitations/invitation-endpoints.ts`), which serve invitations to the app as well.
 */
-const invitationEndpoints = ({ resolved }) => ({ 
-/** `POST /invitation/accept` with `{ token }`, signed in as the invited address: becomes a member, and works there. */
-acceptInvitation: createAuthEndpoint("/invitation/accept", {
-	method: "POST",
-	body: z$1.object({ token: z$1.string().min(1) }),
-	use: [sessionMiddleware]
-}, async (ctx) => {
-	const invitation = await invitationOfToken(ctx.context, ctx.body.token);
-	const { user, session } = ctx.context.session;
-	const member = await acceptInvitation(ctx.context, invitation, user, resolved.membershipLimit);
-	await ctx.context.internalAdapter.updateSession(session.token, { activeOrganizationId: invitation.organizationId });
-	return ctx.json({ member });
-}) });
+const invitationEndpoints = ({ resolved }) => ({
+	/** `POST /invitation/accept` with `{ token }`, signed in as the invited address: becomes a member, and works there. */
+	acceptInvitationOfLink: createAuthEndpoint("/invitation/accept", {
+		method: "POST",
+		body: z$1.object({ token: z$1.string().min(1) }),
+		use: [sessionMiddleware]
+	}, async (ctx) => ctx.json(await accept(ctx.context, await invitationOfToken(ctx.context, ctx.body.token), resolved.membershipLimit))),
+	/** `POST /invitation/accept-own` with `{ invitationId }`, signed in as the invited address: the same, from their list. */
+	acceptOwnInvitation: createAuthEndpoint("/invitation/accept-own", {
+		method: "POST",
+		body: z$1.object({ invitationId: z$1.string().min(1) }),
+		use: [sessionMiddleware]
+	}, async (ctx) => ctx.json(await accept(ctx.context, await invitationOfId(ctx.context, ctx.body.invitationId), resolved.membershipLimit)))
+});
 //#endregion
 export { invitationEndpoints };

package/dist/better-auth/users/user-endpoints.js

@@ -56,7 +56,7 @@ const userEndpoints = ({ definitions, mail, invitationUrl, invitationSeconds })
 		return ctx.json(answerOf(invitation));
 	}),
 	/** `GET /users/invitations`: the pending invitations to the app, oldest first. */
-	listUserInvitations: createAuthEndpoint("/users/invitations", {
+	listAppInvitations: createAuthEndpoint("/users/invitations", {
 		method: "GET",
 		use: [admins]
 	}, async (ctx) => ctx.json({ invitations: (await listAppInvitations(ctx.context)).map(answerOf) })),

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.44.4";
+var version = "0.44.5";
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.44.4",
+  "version": "0.44.5",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.44.4",
-    "@protobase/query": "0.44.4",
-    "@protobase/schema": "0.44.4",
+    "@protobase/layout": "0.44.5",
+    "@protobase/query": "0.44.5",
+    "@protobase/schema": "0.44.5",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",