@protobase/server 0.46.0 → 0.46.1

package/dist/better-auth/authenticator.d.ts

@@ -32,7 +32,9 @@ export type BetterAuthAuthenticator = Authenticator & {
    * proof of the key for a DPoP-bound token, checked against `audience` as the URL it guards (the endpoint must answer
    * at exactly that URL). The app's own tokens and trusted apps' are refused; the session keeps the token's `client`.
    * With `auth`, every request also reads the store to check that the person still allows the client
-   * (`checkMcpGrant`), so a disconnected client or a secured account ends its tokens at once. With `jwksUrl` instead of
+   * (`checkMcpGrant`), and that they exist unbanned and still hold each role the token carries where it works
+   * (`checkUserStanding`), so a disconnected client, a secured account, a ban, a lowered role or a deletion ends its
+   * tokens at once; the session's roles are the token's checked ones, and nothing later reads the claims again. With `jwksUrl` instead of
    * `auth`, a token works until it expires, and a DPoP proof's single use holds in this process only.
    */
   forAudience: (audience: string) => Authenticator;

package/dist/better-auth/authenticator.js

@@ -3,7 +3,7 @@ import { noGlobalRole } from "./organizations/role-definitions.js";
 import { cachedKeys } from "./jwks-cache.js";
 import { withTrustedApps } from "./app-tokens.js";
 import { checkMcpGrant } from "./mcp/grant-standing.js";
-import { checkTokenStanding, tokenClaims } from "./token-standing.js";
+import { checkTokenStanding, checkUserStanding, tokenClaims } from "./token-standing.js";
 import { createDpopReplayStore, createInMemoryDpopReplayStore } from "better-auth/oauth2";
 //#region src/better-auth/authenticator.ts
 /** How the tokens of this Better Auth instance verify: its key set, and its issuer as both issuer and audience. */
@@ -75,6 +75,8 @@ const betterAuthAuthenticator = (options) => {
 			clientId: session.client?.id,
 			issuedAt: payload.iat
 		});
+		const { sessionId: _, ...claims } = tokenClaims(payload, session.user.roles, organizations ? session.tenant : void 0);
+		await checkUserStanding(context, claims, organizations);
 	};
 	return Object.assign(withTrustedApps(own, issuer, options.apps ?? []), { forAudience: (audience) => sessionOf({
 		audience,

package/dist/better-auth/token-standing.js

@@ -33,22 +33,12 @@ const heldWhere = async ({ adapter }, user, organizations, organizationId) => {
 	return global.length > 0 && await findOrganization(adapter, organizationId) !== null ? global : void 0;
 };
 /**
-* Whether a token still stands, read from the store on every request: its user exists and is not banned, its session
-* is not signed out or expired, and each role it carries is one the user still holds there. A token that fails is a
-* 401, so the client asks its session for a new one, which carries the roles as they are now or is refused. Answers the
-* sign-in the token's session stands for (`signInOf`), `undefined` for a token without one.
+* Whether a token's user still stands, read from the store: they exist and are not banned, and each role the token
+* carries is one they still hold where it works. The part of `checkTokenStanding` an MCP access token gets, whose
+* grant outlives the browser session that made it.
 */
-const checkTokenStanding = async (context, claims, organizations, now = /* @__PURE__ */ new Date()) => {
-	const { adapter } = context;
-	const session = claims.sessionId === void 0 ? void 0 : await adapter.findOne({
-		model: "session",
-		where: [{
-			field: "id",
-			value: claims.sessionId
-		}]
-	});
-	if (claims.sessionId !== void 0 && (!session || session.userId !== claims.userId || session.expiresAt <= now)) throw revoked();
-	const user = await adapter.findOne({
+const checkUserStanding = async (context, claims, organizations, now = /* @__PURE__ */ new Date()) => {
+	const user = await context.adapter.findOne({
 		model: "user",
 		where: [{
 			field: "id",
@@ -58,7 +48,24 @@ const checkTokenStanding = async (context, claims, organizations, now = /* @__PU
 	if (!user || bannedNow(user, now)) throw revoked();
 	const held = await heldWhere(context, user, organizations, claims.organizationId);
 	if (!held || claims.roles.some((role) => !held.includes(role))) throw revoked();
+};
+/**
+* Whether a token still stands, read from the store on every request: its session is not signed out or expired, and
+* its user still stands (`checkUserStanding`). A token that fails is a 401, so the client asks its session for a new
+* one, which carries the roles as they are now or is refused. Answers the sign-in the token's session stands for
+* (`signInOf`), `undefined` for a token without one.
+*/
+const checkTokenStanding = async (context, claims, organizations, now = /* @__PURE__ */ new Date()) => {
+	const session = claims.sessionId === void 0 ? void 0 : await context.adapter.findOne({
+		model: "session",
+		where: [{
+			field: "id",
+			value: claims.sessionId
+		}]
+	});
+	if (claims.sessionId !== void 0 && (!session || session.userId !== claims.userId || session.expiresAt <= now)) throw revoked();
+	await checkUserStanding(context, claims, organizations, now);
 	return session ? signInOf(session, claims.sessionId) : void 0;
 };
 //#endregion
-export { checkTokenStanding, signInOf, tokenClaims };
+export { checkTokenStanding, checkUserStanding, signInOf, tokenClaims };

package/dist/better-auth/users.d.ts

@@ -42,7 +42,10 @@ export declare const createUser: (auth: AdminAuth, input: NewUser) => Promise<{
   role: string;
 }>;
 export declare const listUsers: (auth: AdminAuth) => Promise<StoredUser[]>;
-/** Deletes the user with their sessions and accounts, and what `auth.userDeletion` removes; refuses to delete the last active admin. */
+/**
+ * Deletes the user with their sessions and accounts, their MCP grants with MCP on, and what `auth.userDeletion`
+ * removes; refuses to delete the last active admin.
+ */
 export declare const deleteUser: (auth: AdminAuth, email: string) => Promise<void>;
 /** Sets the role: one of the configured roles, or several separated by commas; refuses to demote the last active admin. */
 export declare const setUserRole: (auth: AdminAuth, input: {

package/dist/better-auth/users.js

@@ -80,13 +80,17 @@ const listUsers = async (auth) => (await allUsers(auth)).map((user) => ({
 	banned: Boolean(user.banned),
 	createdAt: new Date(user.createdAt).toISOString()
 }));
-/** Deletes the user with their sessions and accounts, and what `auth.userDeletion` removes; refuses to delete the last active admin. */
+/**
+* Deletes the user with their sessions and accounts, their MCP grants with MCP on, and what `auth.userDeletion`
+* removes; refuses to delete the last active admin.
+*/
 const deleteUser = async (auth, email) => {
 	const user = await findUser(auth, email);
 	await refuseLastAdmin(auth, user, "delete");
 	const { internalAdapter } = await auth.$context;
 	await auth.userDeletion.run(user.id);
 	await internalAdapter.deleteUserSessions(user.id);
+	if (auth.mcp) await revokeMcpGrants((await auth.$context).adapter, user.id);
 	await internalAdapter.deleteUser(user.id);
 	await auth.userDeletion.run(user.id);
 };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.46.0";
+var version = "0.46.1";
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.46.0",
+  "version": "0.46.1",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.46.0",
-    "@protobase/query": "0.46.0",
-    "@protobase/schema": "0.46.0",
+    "@protobase/layout": "0.46.1",
+    "@protobase/query": "0.46.1",
+    "@protobase/schema": "0.46.1",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",