@protobase/server 0.45.19 → 0.45.21

package/dist/better-auth/create-auth.d.ts

@@ -1,6 +1,7 @@
 import { StaffSignIn } from "./staff-log.js";
 import { RoleDefinitions, RolesInput } from "./organizations/role-definitions.js";
 import { ConnectedApp } from "./mcp/connected-apps.js";
+import { ReplacingContext } from "./end-replaced-session.js";
 import { UserDeletionListener } from "./user-deletion.js";
 import "./auth-base-path.js";
 import { Mailer } from "../mail/smtp-mailer.js";
@@ -3752,7 +3753,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               userId: string;
               expiresAt: Date;
               token: string;
-              ipAddress? /** The app keeps each user's metadata, in the column `users.metadata` names. */ : string | null | undefined;
+              ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
             };
             user: Record<string, any> & {
@@ -8590,25 +8591,6 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   })[];
   disabledPaths: string[];
   databaseHooks: {
-    session?: {
-      create: {
-        before: (session: {
-          userId: string;
-          activeOrganizationId?: string | null;
-        } & Record<string, unknown>) => Promise<{
-          data: {
-            activeOrganizationId: string;
-            userId: string;
-          };
-        } | undefined>;
-      };
-      update: {
-        after: (session: {
-          userId: string;
-          activeOrganizationId?: string | null;
-        }) => Promise<void>;
-      };
-    } | undefined;
     user: {
       create: {
         after?: ((user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>) | undefined;
@@ -8654,6 +8636,13 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         }>;
       };
     };
+    session: {
+      create: {
+        after: (session: {
+          token: string;
+        }, ctx: ReplacingContext | null) => Promise<void>;
+      };
+    };
   };
   rateLimit: {
     enabled: true;

package/dist/better-auth/create-auth.js

@@ -5,6 +5,7 @@ import { defaultSignInPolicy } from "./sign-in-policy.js";
 import { roleDefinitions } from "./organizations/role-definitions.js";
 import { signInPolicyPlugin } from "./policy-plugin.js";
 import { goTrueSessionsPlugin } from "../gotrue/sessions-plugin.js";
+import { endReplacedSession } from "./end-replaced-session.js";
 import { authBasePath } from "./auth-base-path.js";
 import { mobileRequests } from "./mobile-requests.js";
 import { passwordLength } from "./new-account-password.js";
@@ -43,6 +44,13 @@ import { betterAuth } from "better-auth";
 import { admin, emailOTP, genericOAuth, jwt } from "better-auth/plugins";
 import { adminAc, userAc } from "better-auth/plugins/admin/access";
 //#region src/better-auth/create-auth.ts
+const withEndedReplaced = (hooks) => ({
+	...hooks,
+	create: {
+		...hooks.create,
+		after: endReplacedSession
+	}
+});
 const platformOperator = () => readOperatorSettings(globalThis.process?.env ?? {});
 const platformSignInSettings = () => readPlatformSignIn(globalThis.process?.env ?? {});
 const platformOrigins = () => readOrigins(globalThis.process?.env ?? {});
@@ -244,7 +252,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				},
 				update: { before: async (user) => ({ data: confirmedOnUpdate(user, /* @__PURE__ */ new Date()) }) }
 			},
-			...organizations && { session: sessionOrganizationHooks(context) }
+			session: withEndedReplaced(organizations ? sessionOrganizationHooks(context) : {})
 		},
 		rateLimit: {
 			enabled: true,

package/dist/better-auth/end-replaced-session.d.ts

@@ -0,0 +1,17 @@
+//#region src/better-auth/end-replaced-session.d.ts
+/** The part of Better Auth's endpoint context that ending a replaced session reads. */
+export type ReplacingContext = {
+  getSignedCookie: (name: string, secret: string) => Promise<string | null | false>;
+  context: {
+    authCookies: {
+      sessionToken: {
+        name: string;
+      };
+    };
+    secret: string;
+    internalAdapter: {
+      deleteSession: (token: string) => Promise<void>;
+    };
+  };
+};
+//#endregion

package/dist/better-auth/end-replaced-session.js

@@ -0,0 +1,15 @@
+//#region src/better-auth/end-replaced-session.ts
+/**
+* Better Auth's `databaseHooks.session.create.after`: a sign-in in a browser ends the session that browser's cookie
+* held, whoever it was for, as the new session's cookie replaces it. Without this the old session would stand until it
+* expired, and with it the devices registered in it, which then kept getting their user's push in someone else's
+* browser. A staff sign-in as someone ends it too: nothing restores the earlier session when it stops.
+*/
+const endReplacedSession = async (session, ctx) => {
+	if (!ctx) return;
+	const held = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);
+	if (!held || held === session.token) return;
+	await ctx.context.internalAdapter.deleteSession(held);
+};
+//#endregion
+export { endReplacedSession };

package/dist/better-auth/live-sessions.js

@@ -0,0 +1,24 @@
+//#region src/better-auth/live-sessions.ts
+/**
+* Which of the sessions with these ids still stand, read from the store: each live one's id with its user's id. A
+* session signed out, revoked, ended by a ban or a newer sign-in in the same browser, or expired is not among them.
+* Reads by the session's id, never its token.
+*/
+const liveSessionsIn = async (context, ids, now = /* @__PURE__ */ new Date()) => {
+	const live = /* @__PURE__ */ new Map();
+	if (ids.length === 0) return live;
+	const rows = await context.adapter.findMany({
+		model: "session",
+		where: [{
+			field: "id",
+			operator: "in",
+			value: [...ids]
+		}]
+	});
+	for (const row of rows) if (ids.includes(row.id) && new Date(row.expiresAt) > now) live.set(row.id, String(row.userId));
+	return live;
+};
+/** `liveSessionsIn` on the store of this Better Auth instance. */
+const liveSessions = (auth) => async (ids) => liveSessionsIn(await auth.$context, ids);
+//#endregion
+export { liveSessions, liveSessionsIn };

package/dist/create-admin.js

@@ -58,6 +58,7 @@ import { historyRoutes } from "./notifications/history-routes.js";
 import { deviceRoutes } from "./notifications/routes.js";
 import { notificationSenders, webPushKey } from "./notifications/senders-of.js";
 import { pushJob } from "./notifications/push-job.js";
+import { liveSessions } from "./better-auth/live-sessions.js";
 import { visitorsBrowse, withAnonymous } from "./anonymous.js";
 import { checkBottomBars, checkShell } from "./check-shell.js";
 import { checkOwnerFields } from "./check-owners.js";
@@ -210,6 +211,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		...runtime && { runtime },
 		...errorReporting && { errorReporting },
 		...maps && { maps },
+		...notifications && notifications.ui !== false && { bell: true },
 		...pushKey && { webPushKey: pushKey },
 		...locale && { locale },
 		plugins,
@@ -374,7 +376,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	if (notifications) {
 		const devices = deviceStore(db, notifications);
 		if (auth) removeDevicesWithUsers(auth, devices);
-		app.route(devicesPath(systemPath), guarded((routes) => void routes.route("/", deviceRoutes(devices))));
+		app.route(devicesPath(systemPath), guarded((routes) => void routes.route("/", deviceRoutes(devices, { sessionRequired: Boolean(auth) }))));
 		const history = historyStore(db, notifications);
 		if (auth) removeHistoryWithUsers(auth, history);
 		app.route(historyPath(systemPath), guarded((routes) => void routes.route("/", historyRoutes(history, auth?.origins ?? []))));
@@ -437,7 +439,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		...withHistory && days !== void 0 ? [pruneHistoryJob(changes, days)] : [],
 		...mentions ? [mentions] : [],
 		...fill ? [fill] : [],
-		...notifications ? [pushJob(notifications, senders)] : []
+		...notifications ? [pushJob(notifications, senders, auth && liveSessions(auth))] : []
 	] });
 };
 //#endregion

package/dist/deps.d.ts

@@ -47,6 +47,8 @@ export type Deps = {
   errorReporting?: ErrorReportingSettings;
   /** The map style the admin app draws maps with and the layers they may switch to, which `/meta` names to everyone. */
   maps?: MapSettings;
+  /** Whether the shell draws the notification bell: notifications are on and their `ui` is not false. */
+  bell?: boolean;
   /** The VAPID public key browsers subscribe for Web Push with, when notifications have a web sender, which `/meta` names to everyone. */
   webPushKey?: string;
   /** The language the admin app's screens are in for everyone, which `/meta` names to everyone. */

package/dist/meta.d.ts

@@ -49,9 +49,13 @@ export type CallerMeta = {
   errorReporting?: ErrorReportingSettings;
   /** The map style the admin app draws its maps with, and the layers they may switch to, when the app has one: public, as the tiles are. */
   maps?: MapSettings;
-  /** The VAPID public key browsers subscribe for Web Push with, when the app's notifications deliver to browsers: public, as any VAPID key is. */
+  /**
+   * With notifications: `bell` when the shell draws the bell, which `ui: false` turns off, and the VAPID public key
+   * browsers subscribe for Web Push with, when the app's notifications deliver to browsers: public, as any VAPID key is.
+   */
   notifications?: {
-    webPushKey: string;
+    bell?: true;
+    webPushKey?: string;
   };
   /** The language the admin app's screens are in, when the app sets one for everyone. */
   locale?: Locale;

package/dist/meta.js

@@ -90,7 +90,10 @@ const createMeta = (deps, appName, appIcon) => {
 			...deps.runtime && seesRuntime(session.user.roles) && { runtime: { url: deps.runtime } },
 			...deps.errorReporting && { errorReporting: deps.errorReporting },
 			...deps.maps && { maps: deps.maps },
-			...deps.webPushKey && { notifications: { webPushKey: deps.webPushKey } },
+			...(deps.bell || deps.webPushKey) && { notifications: {
+				...deps.bell && { bell: true },
+				...deps.webPushKey && { webPushKey: deps.webPushKey }
+			} },
 			...deps.locale && { locale: deps.locale },
 			...deps.files && deps.files.trustedHosts.length > 0 && { files: { trustedHosts: deps.files.trustedHosts } },
 			...plugins.length > 0 && { plugins },

package/dist/notifications/caller.js

@@ -12,5 +12,19 @@ const ownSignInUser = (session) => {
 	if (userId === "" || session.user.id === void 0 || session.user.id === null) throw refuse();
 	return userId;
 };
+/**
+* The caller of a device request: `ownSignInUser`'s user, and the id of the session they signed in with, when their
+* authenticator names one. With `sessionRequired`, as with Protobase's auth, whose devices get push only while their
+* session stands, a caller without one is refused too.
+*/
+const ownSignInDevice = (session, sessionRequired) => {
+	const userId = ownSignInUser(session);
+	const sessionId = session.signIn?.session;
+	if (sessionRequired && (typeof sessionId !== "string" || sessionId === "")) throw forbidden("own-sign-in-only", "Only someone signed in as themselves can reach their devices and notifications");
+	return {
+		userId,
+		sessionId: typeof sessionId === "string" && sessionId !== "" ? sessionId : null
+	};
+};
 //#endregion
-export { ownSignInUser };
+export { ownSignInDevice, ownSignInUser };

package/dist/notifications/deliver.js

@@ -15,7 +15,8 @@ const listed = (counts) => [...counts].map(([method, count]) => `${count} in ${m
 /**
 * One try of a send, resuming from `given`: for a user send, each user's history entry when the send is for the inbox
 * (once, as `record` marks it), then the user's devices as the store lists them now; for a device send, the devices
-* with those ids now. A device the store gives that is not the user's, or not one asked for, gets nothing. Each kind's
+* with those ids now. A device the store gives that is not the user's, or not one asked for, gets nothing. With
+* `liveSessions`, a device whose session no longer stands is removed instead of pushed to. Each kind's
 * devices go to its sender in one batch; a kind without a sender is skipped. An answer of `gone` removes the device,
 * `retry` leaves it to the next try once and gives up on it the second time, and any other is done. A sender that
 * throws leaves its batch to the next try. The try then throws, counting what is left, so the job retries it, or
@@ -57,7 +58,20 @@ const deliver = async ({ to, message }, given, steps) => {
 		progress.retried.push(device.id);
 		left.retried += 1;
 	};
-	const push = async (devices) => {
+	const standing = async (devices) => {
+		const { liveSessions } = steps;
+		if (!liveSessions) return devices;
+		const pending = devices.filter((device) => !done.has(device.id));
+		const live = await liveSessions([...new Set(pending.flatMap((device) => device.sessionId === null ? [] : [device.sessionId]))]);
+		const stands = (device) => device.sessionId !== null && live.get(device.sessionId) === device.userId;
+		for (const device of pending.filter((device) => !stands(device))) {
+			await storeCall("remove", () => steps.devices.remove(device.userId, device.id));
+			markDone(device.id);
+		}
+		return pending.filter(stands);
+	};
+	const push = async (given) => {
+		const devices = await standing(given);
 		for (const device of devices) if (!steps.senders.some((sender) => sender.kinds.includes(device.kind))) markDone(device.id);
 		for (const sender of steps.senders) {
 			const batch = devices.filter((device) => sender.kinds.includes(device.kind) && !done.has(device.id));

package/dist/notifications/device-input.js

@@ -7,6 +7,7 @@ const text = (max) => z.string().min(1).max(max).regex(/^[^\u0000-\u001f\u007f]*
 const base64url = (bytes) => z.string().max(200).regex(/^[A-Za-z0-9_-]+$/).refine((value) => Buffer.from(value, "base64url").length === bytes);
 const appId = z.string().regex(/^[A-Za-z0-9._-]{1,155}$/);
 const userAgent = text(512).optional();
+const userId = text(255).optional();
 const web = z.strictObject({
 	kind: z.literal("web"),
 	endpoint: text(2048).refine(isPushEndpoint),
@@ -14,20 +15,23 @@ const web = z.strictObject({
 		p256dh: base64url(65),
 		auth: base64url(16)
 	}),
-	userAgent
+	userAgent,
+	userId
 });
 const apns = z.strictObject({
 	kind: z.literal("apns"),
 	token: z.string().regex(/^[0-9a-f]{64,200}$/),
 	environment: z.enum(apnsEnvironments),
 	appId,
-	userAgent
+	userAgent,
+	userId
 });
 const fcm = z.strictObject({
 	kind: z.literal("fcm"),
 	token: z.string().regex(/^[A-Za-z0-9_:-]{1,4096}$/),
 	appId: appId.optional(),
-	userAgent
+	userAgent,
+	userId
 });
 const registration = z.discriminatedUnion("kind", [
 	web,
@@ -37,8 +41,9 @@ const registration = z.discriminatedUnion("kind", [
 /** The largest register body, in bytes. */
 const maxDeviceBodyBytes = 8192;
 /**
-* The device a register request's JSON body describes, or a 400 that names the first field at fault and never its
-* value: one kind's fields only, each within its format and length, and nothing else, such as a user.
+* The device a register request's JSON body describes, and the user it names when it names one, or a 400 that names
+* the first field at fault and never its value: one kind's fields only, each within its format and length, and
+* nothing else.
 */
 const deviceInput = (body) => {
 	const parsed = registration.safeParse(body);
@@ -46,7 +51,13 @@ const deviceInput = (body) => {
 		const field = parsed.error.issues[0].path.join(".") || "body";
 		throw badRequest("invalid-device", `The device is invalid: ${field}`);
 	}
-	const device = parsed.data;
+	const { userId } = parsed.data;
+	return {
+		device: deviceOf(parsed.data),
+		...userId !== void 0 && { userId }
+	};
+};
+const deviceOf = (device) => {
 	const base = { userAgent: device.userAgent ?? null };
 	if (device.kind === "web") return {
 		...base,

package/dist/notifications/device-store.d.ts

@@ -7,10 +7,12 @@ import { Device, NewDevice } from "./device.js";
  */
 export type DeviceStore = {
   /**
-   * Registers the device for `userId`, or refreshes it when the user has it already. A token another user holds moves
-   * to `userId` as a new device: a new id, its fields as given, created and last seen now.
+   * Registers the device for `userId`, or refreshes it when the user has it already, its session included. An APNs or
+   * FCM token another user holds moves to `userId` as a new device: a new id, its fields as given, created and last
+   * seen now. A browser's endpoint another user holds stays theirs, unchanged, and the answer is `undefined`: a browser
+   * can always subscribe afresh, so an endpoint never changes hands.
    */
-  register: (userId: string, device: NewDevice) => Promise<Device>;
+  register: (userId: string, device: NewDevice) => Promise<Device | undefined>;
   /** Removes the device with this id when it is `userId`'s; another user's is left as it is. */
   remove: (userId: string, id: string) => Promise<void>;
   /** The user's devices. */

package/dist/notifications/device.d.ts

@@ -9,7 +9,8 @@ export type ApnsEnvironment = (typeof apnsEnvironments)[number];
  * A device as a signed-in user registers it. `token` is unique among all devices: the APNs or FCM token, or for `web`
  * the subscription's endpoint URL. A field that does not apply to the kind is `null`: the Web Push keys (`p256dh`,
  * `auth`) for web only, the APNs `environment` for apns only, the `appId` (the iOS bundle id or Android package) for
- * apns and fcm.
+ * apns and fcm. `sessionId` is the id of the sign-in session it was registered in, never its token, or `null` when the
+ * app's authenticator names none: with Protobase's auth, the device gets push only while that session stands.
  */
 export type NewDevice = {
   kind: DeviceKind;
@@ -19,6 +20,7 @@ export type NewDevice = {
   environment: ApnsEnvironment | null;
   appId: string | null;
   userAgent: string | null;
+  sessionId: string | null;
 };
 /** A stored device: whose it is, its own id, when it was registered by that user and when last seen. */
 export type Device = NewDevice & {

package/dist/notifications/history-routes.d.ts

@@ -1,4 +1,5 @@
 import "../types.js";
+import "./history-store.js";
 import { Hono } from "hono";
 //#region src/notifications/history-routes.d.ts
 /** How many entries a page of the history holds when the request names no `limit`. */

package/dist/notifications/history-routes.js

@@ -5,7 +5,7 @@ import { ownSignInUser } from "./caller.js";
 import { historyCursor, historyPosition } from "./history-cursor.js";
 import { jsonBody, jsonOnly, limitedBody, queryOf } from "./history-request.js";
 import { historyUrl } from "./history-url.js";
-import "./paths.js";
+import { historyIdParam } from "./paths.js";
 import { Hono } from "hono";
 import { z } from "zod";
 //#region src/notifications/history-routes.ts
@@ -70,11 +70,11 @@ const historyRoutes = (store, origins) => {
 		await store.markAllRead(c.get("historyUser"), new Date(parsed.data.upTo));
 		return c.body(null, 204);
 	});
-	app.post(`/:id/read`, ownSignIn, jsonOnly, limitedBody, async (c) => {
+	app.post(`/:${historyIdParam}/read`, ownSignIn, jsonOnly, limitedBody, async (c) => {
 		queryOf(c, []);
 		const body = await jsonBody(c);
 		if (body !== void 0 && (typeof body !== "object" || body === null || Array.isArray(body) || Object.keys(body).length > 0)) throw badRequest("invalid-mark", "Marking one read takes no body");
-		const id = c.req.param("id");
+		const id = c.req.param(historyIdParam);
 		if (historyIdPattern.test(id)) await store.markRead(c.get("historyUser"), id);
 		return c.body(null, 204);
 	});

package/dist/notifications/history.d.ts

@@ -1,4 +1,5 @@
 import { JsonObject } from "./json-value.js";
+import { historyIdPattern } from "@protobase/schema/internal";
 //#region src/notifications/history.d.ts
 /**
  * A notification as the history keeps it for its user's inbox: what a panel shows of it. `title` and `body` are plain
@@ -22,8 +23,6 @@ export type HistoryPosition = {
   createdAt: Date;
   id: string;
 };
-/** What an entry id looks like in every history store: it goes into a path, so no `/`, `.`, `?`, `#` or `%`. */
-export declare const historyIdPattern: RegExp;
 /** The longest title, body and url, as a push message takes them, and the most bytes of `data` as JSON. */
 export declare const historyLimits: {
   readonly title: 256;
@@ -31,4 +30,5 @@ export declare const historyLimits: {
   readonly url: 2048;
   readonly dataBytes: 4096;
 };
-//#endregion
+//#endregion
+export { historyIdPattern };

package/dist/notifications/history.js

@@ -1,7 +1,6 @@
 import { isJsonObject, jsonProblem } from "./json-value.js";
+import { historyIdPattern } from "@protobase/schema/internal";
 //#region src/notifications/history.ts
-/** What an entry id looks like in every history store: it goes into a path, so no `/`, `.`, `?`, `#` or `%`. */
-const historyIdPattern = /^[A-Za-z0-9_-]{1,64}$/;
 /** The longest title, body and url, as a push message takes them, and the most bytes of `data` as JSON. */
 const historyLimits = {
 	title: 256,

package/dist/notifications/options.d.ts

@@ -3,7 +3,7 @@ import { HistoryStore } from "./history-store.js";
 import { PushSender } from "./sender.js";
 //#region src/notifications/options.d.ts
 /** The columns of the devices table, by the name Protobase gives them. */
-export declare const deviceColumns: readonly ["id", "user_id", "kind", "token", "p256dh", "auth", "environment", "app_id", "user_agent", "created_at", "last_seen_at"];
+export declare const deviceColumns: readonly ["id", "user_id", "kind", "token", "p256dh", "auth", "environment", "app_id", "user_agent", "session_id", "created_at", "last_seen_at"];
 export type DeviceColumn = (typeof deviceColumns)[number];
 /** The columns of the history table, by the name Protobase gives them. */
 export declare const historyColumns: readonly ["id", "user_id", "title", "body", "url", "data", "created_at", "read_at"];

package/dist/notifications/options.js

@@ -13,6 +13,7 @@ const deviceColumns = [
 	"environment",
 	"app_id",
 	"user_agent",
+	"session_id",
 	"created_at",
 	"last_seen_at"
 ];

package/dist/notifications/paths.d.ts

@@ -1,16 +1,2 @@
-//#region src/notifications/paths.d.ts
-/** The name of the device id in a device's path. */
-export declare const deviceIdParam = "id";
-/** The path of the caller's devices under the API's system path (`/api`), or of one of them by its id. */
-export declare const devicesPath: (systemPath: string, id?: string) => string;
-/** The name of the entry id in the path that marks one entry of the history read. */
-export declare const historyIdParam = "id";
-/**
- * The path of the caller's notification history under the API's system path (`/api`): the list itself, `unread` its
- * unread count, `read` marking all read, or `{ read: id }` marking one entry read. An id that could leave the history's
- * path, any but letters, digits, `_` and `-`, is refused.
- */
-export declare const historyPath: (systemPath: string, part?: "unread" | "read" | {
-  read: string;
-}) => string;
-//#endregion
+import { deviceIdParam, devicesPath, historyIdParam, historyPath } from "@protobase/schema/internal";
+export { deviceIdParam, devicesPath, historyIdParam, historyPath };

package/dist/notifications/paths.js

@@ -1,22 +1,2 @@
-import { historyIdPattern } from "./history.js";
-//#region src/notifications/paths.ts
-/** The name of the device id in a device's path. */
-const deviceIdParam = "id";
-/** The path of the caller's devices under the API's system path (`/api`), or of one of them by its id. */
-const devicesPath = (systemPath, id) => `${systemPath}/notifications/devices${id === void 0 ? "" : `/${encodeURIComponent(id)}`}`;
-/** The name of the entry id in the path that marks one entry of the history read. */
-const historyIdParam = "id";
-/**
-* The path of the caller's notification history under the API's system path (`/api`): the list itself, `unread` its
-* unread count, `read` marking all read, or `{ read: id }` marking one entry read. An id that could leave the history's
-* path, any but letters, digits, `_` and `-`, is refused.
-*/
-const historyPath = (systemPath, part) => {
-	const base = `${systemPath}/notifications/history`;
-	if (part === void 0) return base;
-	if (typeof part === "string") return `${base}/${part}`;
-	if (!historyIdPattern.test(part.read)) throw new Error("A history entry id is letters, digits, \"_\" and \"-\" only");
-	return `${base}/${part.read}/read`;
-};
-//#endregion
+import { deviceIdParam, devicesPath, historyIdParam, historyPath } from "@protobase/schema/internal";
 export { deviceIdParam, devicesPath, historyIdParam, historyPath };

package/dist/notifications/postgres-store.js

@@ -25,6 +25,7 @@ const deviceOf = (row) => ({
 	environment: row.environment,
 	appId: row.app_id,
 	userAgent: row.user_agent,
+	sessionId: row.session_id,
 	createdAt: new Date(row.created_at),
 	lastSeenAt: new Date(row.last_seen_at)
 });
@@ -54,6 +55,7 @@ const postgresDeviceStore = (db, options = {}) => {
 				environment: device.environment,
 				app_id: device.appId,
 				user_agent: device.userAgent,
+				session_id: device.sessionId,
 				created_at: now,
 				last_seen_at: now
 			};
@@ -69,6 +71,7 @@ const postgresDeviceStore = (db, options = {}) => {
 				"environment",
 				"app_id",
 				"user_agent",
+				"session_id",
 				"last_seen_at"
 			].map((name) => sql`${column(name)} = excluded.${column(name)}`);
 			const [stored] = await rows(sql`insert into ${devices} as d (${names}) values (${given})
@@ -77,6 +80,7 @@ const postgresDeviceStore = (db, options = {}) => {
 				keep("created_at"),
 				...replaced
 			])}
+        where ${sameUser} or (${sql.ref(`d.${columns.kind}`)} <> 'web' and excluded.${column("kind")} <> 'web')
         returning ${selected}`);
 			return stored;
 		},

package/dist/notifications/push-job.js

@@ -26,10 +26,11 @@ const recordOnce = (db, options, job) => async (userId, entry, progress) => {
 };
 /**
 * The job that delivers what `sendNotification` sends, through `senders` (guarded, see `notificationSenders`) and the
-* stores `options` configure. A try resumes where the last one stopped (see `deliver`); once delivered, the job keeps
-* no message. A few tries only: a device that keeps asking for a retry is given up on the second time.
+* stores `options` configure; with `liveSessions`, as with Protobase's auth, only to devices whose session stands. A
+* try resumes where the last one stopped (see `deliver`); once delivered, the job keeps no message. A few tries only: a
+* device that keeps asking for a retry is given up on the second time.
 */
-const pushJob = (options, senders) => defineJob({
+const pushJob = (options, senders, liveSessions) => defineJob({
 	name: pushJobName,
 	payload: pushPayload,
 	maxAttempts: 5,
@@ -42,7 +43,8 @@ const pushJob = (options, senders) => defineJob({
 			record: recordOnce(db, options, job),
 			save: (progress) => saveJobProgress(db, job, progress),
 			hold: () => holdJob(db, job),
-			complete: () => replaceJobData(db, job, { complete: true })
+			complete: () => replaceJobData(db, job, { complete: true }),
+			...liveSessions && { liveSessions }
 		});
 	}
 });

package/dist/notifications/routes.js

@@ -1,14 +1,16 @@
 import { HttpProblem } from "../problem.js";
-import { ownSignInUser } from "./caller.js";
-import "./paths.js";
+import { ownSignInDevice } from "./caller.js";
+import { deviceIdParam } from "./paths.js";
 import { deviceInput, maxDeviceBodyBytes } from "./device-input.js";
 import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
 //#region src/notifications/routes.ts
 /** The most devices one user keeps: registering one more drops their least recently seen. */
 const maxDevicesPerUser = 20;
-const ownSignIn = async (c, next) => {
-	c.set("deviceUser", ownSignInUser(c.get("session")));
+const ownSignIn = (sessionRequired) => async (c, next) => {
+	const { userId, sessionId } = ownSignInDevice(c.get("session"), sessionRequired);
+	c.set("deviceUser", userId);
+	c.set("deviceSession", sessionId);
 	await next();
 };
 const jsonOnly = async (c, next) => {
@@ -33,21 +35,31 @@ const dropOldest = async (store, userId, kept) => {
 };
 /**
 * The caller's own devices, mounted at `devicesPath` behind the API's authenticator: `POST` registers or refreshes the
-* device the request comes from, `DELETE` with its id removes it. Tokens travel in the body only, never the URL.
+* device the request comes from, in the caller's session, `DELETE` with its id removes it. Tokens travel in the body
+* only, never the URL. A register is a 409 that stores nothing when the body names a user other than the caller
+* (`other-user`), or when another user holds the browser's endpoint (`device-held`), which a browser answers by
+* subscribing afresh. With `sessionRequired`, a caller whose session has no id is refused.
 */
-const deviceRoutes = (store) => {
+const deviceRoutes = (store, { sessionRequired = false } = {}) => {
 	const app = new Hono();
-	app.post("/", ownSignIn, jsonOnly, limited, async (c) => {
+	const caller = ownSignIn(sessionRequired);
+	app.post("/", caller, jsonOnly, limited, async (c) => {
 		const userId = c.get("deviceUser");
-		const device = deviceInput(await c.req.json());
+		const given = deviceInput(await c.req.json());
+		if (given.userId !== void 0 && given.userId !== userId) throw new HttpProblem(409, "other-user", "Conflict", "The device is registered for the user signed in");
+		const device = {
+			...given.device,
+			sessionId: c.get("deviceSession")
+		};
 		const stored = await store.register(userId, device);
+		if (!stored) throw new HttpProblem(409, "device-held", "Conflict", "Another user holds this subscription: subscribe again");
 		if (stored.userId !== userId || stored.token !== device.token) throw new Error("The device store answered register with another device");
 		await dropOldest(store, userId, stored);
 		return c.json(answer(stored));
 	});
-	app.delete(`/:id`, ownSignIn, async (c) => {
+	app.delete(`/:${deviceIdParam}`, caller, async (c) => {
 		const userId = c.get("deviceUser");
-		const id = c.req.param("id");
+		const id = c.req.param(deviceIdParam);
 		if ((await store.listForUser(userId)).some((device) => device.id === id)) await store.remove(userId, id);
 		return c.body(null, 204);
 	});

package/dist/notifications/schema-sql.js

@@ -2,6 +2,11 @@ import { quoteIdent } from "../changes/capture-sql.js";
 //#region src/notifications/schema-sql.ts
 /** A table by its schema, when one is named, and its name, quoted. */
 const qualified = ({ schema, table }) => schema ? `${quoteIdent(schema)}.${quoteIdent(table)}` : quoteIdent(table);
+/** The session column, added to a devices table written before devices kept the session they were registered in. */
+const deviceSessionColumnSql = ({ schema, table, columns }) => `alter table ${qualified({
+	schema,
+	table
+})} add column ${quoteIdent(columns.session_id)} text`;
 /**
 * The devices table: the token unique, so registering one moves it; with auth, its user column points at auth's users
 * table and goes with the user. A field that does not apply to the kind must be NULL, and nothing has a default.
@@ -24,6 +29,7 @@ const devicesTableSql = ({ schema, table, columns }, user) => {
   ${c.environment} text check (${c.environment} in ('sandbox', 'production')),
   ${c.app_id} text,
   ${c.user_agent} text,
+  ${c.session_id} text,
   ${c.created_at} timestamptz not null,
   ${c.last_seen_at} timestamptz not null,
   check (
@@ -37,4 +43,4 @@ const devicesTableSql = ({ schema, table, columns }, user) => {
 	];
 };
 //#endregion
-export { devicesTableSql, qualified };
+export { deviceSessionColumnSql, devicesTableSql, qualified };

package/dist/notifications/schema.d.ts

@@ -5,7 +5,8 @@ import { Db } from "@protobase/query";
 /**
  * The SQL that adds the tables `notifications()` keeps devices and each user's history in, under the names its options
  * give; with `auth`, their user columns point at auth's users table. Each table is left out when it exists or a store
- * of the app's own replaces it; `undefined` when none is left.
+ * of the app's own replaces it, and an existing devices table without its session column gets that column;
+ * `undefined` when nothing is left.
  */
 export declare const notificationsMigration: (db: Db, options?: NotificationsOptions, auth?: AdminAuth) => Promise<string | undefined>;
 /** Refuses to start while the devices or the history table lacks what `notifications()` needs, naming it. */

package/dist/notifications/schema.js

@@ -1,7 +1,7 @@
 import { migrationCommand } from "../changes/capture-schema.js";
 import { historyNames, notificationsNames } from "./options.js";
 import { storeSchema } from "../better-auth/auth-tables.js";
-import { devicesTableSql, qualified } from "./schema-sql.js";
+import { deviceSessionColumnSql, devicesTableSql, qualified } from "./schema-sql.js";
 import { historyTableSql } from "./history-sql.js";
 import { sql } from "kysely";
 //#region src/notifications/schema.ts
@@ -17,29 +17,39 @@ const userIdType = async (db, users) => {
 	const { rows } = await sql`select format_type(atttypid, atttypmod) as type from pg_attribute where attrelid = ${oid} and attname = 'id'`.execute(db);
 	return rows[0].type;
 };
+const columnsOf = async (db, oid) => (await sql`select attname as name, attnum as num from pg_attribute where attrelid = ${oid} and attnum > 0 and not attisdropped`.execute(db)).rows;
+const uniqueOn = async (db, oid, num) => (await sql`select exists (select from pg_index where indrelid = ${oid} and indisunique and indpred is null and indexprs is null and indnatts = 1 and indkey[0] = ${num}) as found`.execute(db)).rows[0].found;
+const cascadesFrom = async (db, oid, num, users) => (await sql`select exists (select from pg_constraint where conrelid = ${oid} and contype = 'f' and confdeltype = 'c'
+    and conkey = array[${num}]::int2[] and confrelid = to_regclass(${qualified(users)})) as found`.execute(db)).rows[0].found;
+const lacksSessionColumn = async (db, names) => {
+	const oid = await regclass(db, qualified(names));
+	return oid !== null && !(await columnsOf(db, oid)).some((row) => row.name === names.columns.session_id);
+};
 /**
 * The SQL that adds the tables `notifications()` keeps devices and each user's history in, under the names its options
 * give; with `auth`, their user columns point at auth's users table. Each table is left out when it exists or a store
-* of the app's own replaces it; `undefined` when none is left.
+* of the app's own replaces it, and an existing devices table without its session column gets that column;
+* `undefined` when nothing is left.
 */
 const notificationsMigration = async (db, options = {}, auth) => {
 	const devices = !options.store && notificationsNames(options);
 	const history = !options.historyStore && historyNames(options);
 	const missing = async (names) => names && await regclass(db, qualified(names)) === null;
 	const [needsDevices, needsHistory] = [await missing(devices), await missing(history)];
-	if (!needsDevices && !needsHistory) return void 0;
+	const needsSession = devices && !needsDevices && await lacksSessionColumn(db, devices);
+	if (!needsDevices && !needsHistory && !needsSession) return void 0;
 	const users = auth && authUsersTable(auth);
-	const user = users ? {
+	const user = users && (needsDevices || needsHistory) ? {
 		type: await userIdType(db, users),
 		references: `${qualified(users)} (id)`
 	} : { type: "text" };
-	const statements = [...needsDevices && devices ? devicesTableSql(devices, user) : [], ...needsHistory && history ? historyTableSql(history, user) : []];
+	const statements = [
+		...needsDevices && devices ? devicesTableSql(devices, user) : [],
+		...needsSession && devices ? [deviceSessionColumnSql(devices)] : [],
+		...needsHistory && history ? historyTableSql(history, user) : []
+	];
 	return `${[...new Set(statements)].join(";\n\n")};`;
 };
-const columnsOf = async (db, oid) => (await sql`select attname as name, attnum as num from pg_attribute where attrelid = ${oid} and attnum > 0 and not attisdropped`.execute(db)).rows;
-const uniqueOn = async (db, oid, num) => (await sql`select exists (select from pg_index where indrelid = ${oid} and indisunique and indpred is null and indexprs is null and indnatts = 1 and indkey[0] = ${num}) as found`.execute(db)).rows[0].found;
-const cascadesFrom = async (db, oid, num, users) => (await sql`select exists (select from pg_constraint where conrelid = ${oid} and contype = 'f' and confdeltype = 'c'
-    and conkey = array[${num}]::int2[] and confrelid = to_regclass(${qualified(users)})) as found`.execute(db)).rows[0].found;
 const missingTable = (what, table) => /* @__PURE__ */ new Error(`The ${what} table ${table} of notifications() is missing. Write it as a migration with \`${migrationCommand}\`, apply it with the project's migrations, then start again.`);
 /**
 * Refuses to start while the devices table lacks what `notifications()` needs, naming it: the table, each column under

package/dist/notifications/send-input.d.ts

@@ -1,3 +1,4 @@
+import "./history.js";
 import { PushMessage } from "./message.js";
 import { Db } from "@protobase/query";
 //#region src/notifications/send-input.d.ts

package/dist/notifications/web-push/web-push-sender.d.ts

@@ -9,7 +9,7 @@ export type WebPushOptions = PostOptions & {
  * The built-in Web Push sender (RFC 8030, 8291, 8292): delivers to `web` devices, signed with the VAPID pair and
  * encrypted for each device's keys. It checks the message as `pushMessage` does and throws before any request when it
  * is not one. A device whose endpoint is not on a browser's push service, or whose keys are not a subscription's, is
- * answered `refused` with no request. It logs nothing, and its errors and answers carry no endpoint, key or token.
+ * answered `refused` with no request. Each device's JSON carries its user's id as `user`. It logs nothing, and its errors and answers carry no endpoint, key or token.
  */
 export declare const webPushSender: (settings: VapidSettings, options?: WebPushOptions) => PushSender;
 //#endregion

package/dist/notifications/web-push/web-push-sender.js

@@ -33,7 +33,7 @@ const headersOf = (message) => {
 * The built-in Web Push sender (RFC 8030, 8291, 8292): delivers to `web` devices, signed with the VAPID pair and
 * encrypted for each device's keys. It checks the message as `pushMessage` does and throws before any request when it
 * is not one. A device whose endpoint is not on a browser's push service, or whose keys are not a subscription's, is
-* answered `refused` with no request. It logs nothing, and its errors and answers carry no endpoint, key or token.
+* answered `refused` with no request. Each device's JSON carries its user's id as `user`. It logs nothing, and its errors and answers carry no endpoint, key or token.
 */
 const webPushSender = (settings, options = {}) => {
 	const authorization = vapidAuthorizer(settings, options.now);
@@ -58,10 +58,14 @@ const webPushSender = (settings, options = {}) => {
 		const message = pushMessage(given);
 		if (devices.some((device) => device.kind !== "web")) throw new Error("The Web Push sender was given a device that is not a web device");
 		const headers = headersOf(message);
-		const plaintext = Buffer.from(JSON.stringify(webPushPayload(message)));
-		if (plaintext.length > 3993) throw new PushMessageError(`message: its Web Push payload is over ${maxPlaintextBytes} bytes`);
+		const payload = webPushPayload(message);
+		const plaintexts = new Map(devices.map((device) => [device.id, Buffer.from(JSON.stringify({
+			...payload,
+			user: device.userId
+		}))]));
+		if ([...plaintexts.values()].some((plaintext) => plaintext.length > 3993)) throw new PushMessageError(`message: its Web Push payload is over ${maxPlaintextBytes} bytes`);
 		const answers = [];
-		for (let start = 0; start < devices.length; start += concurrency) answers.push(...await Promise.all(devices.slice(start, start + concurrency).map((device) => sendOne(device, headers, plaintext))));
+		for (let start = 0; start < devices.length; start += concurrency) answers.push(...await Promise.all(devices.slice(start, start + concurrency).map((device) => sendOne(device, headers, plaintexts.get(device.id)))));
 		return answers;
 	};
 	return {

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.45.19";
+var version = "0.45.21";
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.45.19",
+  "version": "0.45.21",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.45.19",
-    "@protobase/query": "0.45.19",
-    "@protobase/schema": "0.45.19",
+    "@protobase/layout": "0.45.21",
+    "@protobase/query": "0.45.21",
+    "@protobase/schema": "0.45.21",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",