@protobase/server 0.45.14 → 0.45.16

package/dist/better-auth/auth-mail/auth-emails.d.ts

@@ -1,5 +1,6 @@
 import "./account-exists-email.js";
 import "./invitation-email.js";
+import "./no-account-email.js";
 import "./reset-password-email.js";
 import "./sign-in-code-email.js";
 import "./sign-up-code-email.js";

package/dist/better-auth/auth-mail/auth-emails.js

@@ -1,8 +1,9 @@
 import { accountExistsEmail } from "./account-exists-email.js";
 import { invitationEmail } from "./invitation-email.js";
+import { noAccountEmail } from "./no-account-email.js";
 import { resetPasswordEmail } from "./reset-password-email.js";
 import { signInCodeEmail } from "./sign-in-code-email.js";
 import { signUpCodeEmail } from "./sign-up-code-email.js";
 import { staffSignInEmail } from "./staff-sign-in-email.js";
 import { twoFactorCodeEmail } from "./two-factor-code-email.js";
-export { accountExistsEmail, invitationEmail, resetPasswordEmail, signInCodeEmail, signUpCodeEmail, staffSignInEmail, twoFactorCodeEmail };
+export { accountExistsEmail, invitationEmail, noAccountEmail, resetPasswordEmail, signInCodeEmail, signUpCodeEmail, staffSignInEmail, twoFactorCodeEmail };

package/dist/better-auth/auth-mail/no-account-email.d.ts

@@ -0,0 +1 @@
+import "../../index.js";

package/dist/better-auth/auth-mail/no-account-email.js

@@ -0,0 +1,32 @@
+import { defineEmail } from "../../mail/define-email.js";
+import { EmailButton, EmailLayout, EmailNote } from "../../mail/email-layout.js";
+import { signInPath } from "@protobase/schema";
+import { Text } from "react-email";
+import { jsx, jsxs } from "react/jsx-runtime";
+//#region src/better-auth/auth-mail/no-account-email.tsx
+const NoAccountEmail = ({ app }) => /* @__PURE__ */ jsxs(EmailLayout, {
+	app,
+	preview: `No ${app.name} account uses this address`,
+	heading: "No account for this address",
+	children: [
+		/* @__PURE__ */ jsxs(Text, { children: [
+			"Someone asked for a code to sign in to ",
+			app.name,
+			" with this address. No account uses it, so no code was sent."
+		] }),
+		/* @__PURE__ */ jsx(Text, { children: "If you have an account, sign in again with the address you signed up with." }),
+		/* @__PURE__ */ jsxs(EmailButton, {
+			href: new URL(signInPath(), app.url).href,
+			children: ["Sign in to ", app.name]
+		}),
+		/* @__PURE__ */ jsx(EmailNote, { children: "If this was not you, ignore this email: nothing was changed." })
+	]
+});
+/** The email to an address that asked for a sign-in code while no account uses it: no code, a hint to try another address. */
+const noAccountEmail = defineEmail({
+	name: "no-account",
+	subject: ({ app }) => `No ${app.name} account uses this address`,
+	component: NoAccountEmail
+});
+//#endregion
+export { noAccountEmail };

package/dist/better-auth/create-auth.d.ts

@@ -3118,6 +3118,14 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       INVALID_OTP: import("better-auth").RawError<"INVALID_OTP">;
       TOO_MANY_ATTEMPTS: import("better-auth").RawError<"TOO_MANY_ATTEMPTS">;
     };
+  } | {
+    id: "protobase-no-account-mail";
+    hooks: {
+      after: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "protobase-sign-up";
     endpoints: {
@@ -3744,7 +3752,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               userId: string;
               expiresAt: Date;
               token: string;
-              ipAddress?: string | null | undefined;
+              ipAddress? /** The app keeps each user's metadata, in the column `users.metadata` names. */ : string | null | undefined;
               userAgent?: string | null | undefined;
             };
             user: Record<string, any> & {

package/dist/better-auth/create-auth.js

@@ -29,6 +29,7 @@ import { platformSignInFor, platformSignInProvider, readPlatformSignIn, resolveP
 import { appSignInPolicy } from "./app-sign-in-policy.js";
 import { assertNoEndpointKeyClashes } from "./endpoint-key-clashes.js";
 import { emailInDomains, resolveSamlProviders, samlDisabledPaths, samlGuardPlugin, samlPlugin } from "./saml-sign-in.js";
+import { noAccountMailPlugin } from "./no-account-mail.js";
 import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
 import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
 import { confirmedOnCreate, confirmedOnUpdate, emailConfirmedField } from "./email-confirmed.js";
@@ -162,7 +163,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				formerDomain: hosts[0],
 				origins: appOrigins(options.baseURL, origins)
 			}),
-			...mail ? [emailOTP(emailCodeOptions(mail))] : [],
+			...mail ? [emailOTP(emailCodeOptions(mail)), noAccountMailPlugin(mail)] : [],
 			...mail && signUpRole ? [signUpPlugin({
 				role: signUpRole,
 				mail,

package/dist/better-auth/no-account-mail.js

@@ -0,0 +1,24 @@
+import { sendAuthEmail } from "./auth-mail/send-auth-email.js";
+import { APIError, createAuthMiddleware } from "better-auth/api";
+//#region src/better-auth/no-account-mail.ts
+/**
+* Mails an address that asked for a sign-in code while no account uses it, so its owner knows to try another address.
+* The email OTP plugin answers such a request as it answers one for an account, and mails nothing; this hook sends the
+* no-account email after it, so the answer still tells nobody which addresses have an account.
+*/
+const noAccountMailPlugin = (mail) => ({
+	id: "protobase-no-account-mail",
+	hooks: { after: [{
+		matcher: (ctx) => ctx.path === "/email-otp/send-verification-otp",
+		handler: createAuthMiddleware(async (ctx) => {
+			if (ctx.context.returned instanceof APIError) return;
+			const { email, type } = ctx.body;
+			if (type !== "sign-in") return;
+			const address = email.toLowerCase();
+			if (await ctx.context.internalAdapter.findUserByEmail(address)) return;
+			await ctx.context.runInBackgroundOrAwait(sendAuthEmail(mail, "noAccountEmail", address, {}, ctx.context.baseURL));
+		})
+	}] }
+});
+//#endregion
+export { noAccountMailPlugin };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.45.14";
+var version = "0.45.16";
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.45.14",
+  "version": "0.45.16",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.45.14",
-    "@protobase/query": "0.45.14",
-    "@protobase/schema": "0.45.14",
+    "@protobase/layout": "0.45.16",
+    "@protobase/query": "0.45.16",
+    "@protobase/schema": "0.45.16",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",