@protobase/server 0.46.2 → 0.46.4

package/dist/better-auth/auth-mail/auth-emails.d.ts

@@ -1,4 +1,5 @@
 import "./account-exists-email.js";
+import "./change-email-code-email.js";
 import "./invitation-email.js";
 import "./no-account-email.js";
 import "./reset-password-email.js";

package/dist/better-auth/auth-mail/auth-emails.js

@@ -1,4 +1,5 @@
 import { accountExistsEmail } from "./account-exists-email.js";
+import { changeEmailCodeEmail } from "./change-email-code-email.js";
 import { invitationEmail } from "./invitation-email.js";
 import { noAccountEmail } from "./no-account-email.js";
 import { resetPasswordEmail } from "./reset-password-email.js";
@@ -6,4 +7,4 @@ import { signInCodeEmail } from "./sign-in-code-email.js";
 import { signUpCodeEmail } from "./sign-up-code-email.js";
 import { staffSignInEmail } from "./staff-sign-in-email.js";
 import { twoFactorCodeEmail } from "./two-factor-code-email.js";
-export { accountExistsEmail, invitationEmail, noAccountEmail, resetPasswordEmail, signInCodeEmail, signUpCodeEmail, staffSignInEmail, twoFactorCodeEmail };
+export { accountExistsEmail, changeEmailCodeEmail, invitationEmail, noAccountEmail, resetPasswordEmail, signInCodeEmail, signUpCodeEmail, staffSignInEmail, twoFactorCodeEmail };

package/dist/better-auth/auth-mail/change-email-code-email.d.ts

@@ -0,0 +1 @@
+import "../../index.js";

package/dist/better-auth/auth-mail/change-email-code-email.js

@@ -0,0 +1,32 @@
+import { defineEmail } from "../../mail/define-email.js";
+import { EmailCode, EmailLayout, EmailNote } from "../../mail/email-layout.js";
+import { Text } from "react-email";
+import { jsx, jsxs } from "react/jsx-runtime";
+//#region src/better-auth/auth-mail/change-email-code-email.tsx
+const ChangeEmailCodeEmail = ({ app, code, lifetime }) => /* @__PURE__ */ jsxs(EmailLayout, {
+	app,
+	preview: `Your code to sign in to ${app.name} with this address`,
+	heading: "Confirm your new address",
+	children: [
+		/* @__PURE__ */ jsxs(Text, { children: [
+			"Use this code to sign in to ",
+			app.name,
+			" with this address from now on:"
+		] }),
+		/* @__PURE__ */ jsx(EmailCode, { code }),
+		/* @__PURE__ */ jsxs(Text, { children: [
+			"It works for ",
+			lifetime,
+			", once."
+		] }),
+		/* @__PURE__ */ jsx(EmailNote, { children: "If you did not ask for this, ignore this email: nobody can move an account to your address without the code." })
+	]
+});
+/** The email to the new address with the code that moves the account to it. */
+const changeEmailCodeEmail = defineEmail({
+	name: "change-email-code",
+	subject: ({ app }) => `Confirm your new ${app.name} address`,
+	component: ChangeEmailCodeEmail
+});
+//#endregion
+export { changeEmailCodeEmail };

package/dist/better-auth/create-auth.d.ts

@@ -4476,6 +4476,41 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-set-password";
+    endpoints: {
+      setFirstPassword: import("better-call").StrictEndpoint<"/account/set-password", {
+        method: "POST";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        body: import("zod").ZodObject<{
+          newPassword: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        status: boolean;
+      }>;
+    };
   } | {
     id: "protobase-gotrue-sessions";
     endpoints: {
@@ -8669,6 +8704,10 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         window: number;
         max: number;
       };
+      "/account/set-password": {
+        window: number;
+        max: number;
+      };
       '/invitation/sign-up': {
         window: number;
         max: number;

package/dist/better-auth/create-auth.js

@@ -25,6 +25,7 @@ import { resolveOrganizations } from "./organizations/options.js";
 import { passkeyHosts, readPasskeyDomain, resolvePasskeyDomain } from "./passkey-domain.js";
 import { passkeyPlugin } from "./passkey-plugin.js";
 import { passwordResetOptions } from "./password-reset.js";
+import { setPasswordPath, setPasswordPlugin } from "./set-password.js";
 import { rolesPlugin } from "./roles/roles-plugin.js";
 import { platformSignInFor, platformSignInProvider, readPlatformSignIn, resolvePlatformSignIn } from "./platform-sign-in.js";
 import { appSignInPolicy } from "./app-sign-in-policy.js";
@@ -180,6 +181,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			...signIn ? [genericOAuth({ config: [platformSignInProvider(signIn)] })] : [],
 			...saml.length > 0 ? [samlPlugin(saml, options.baseURL), samlGuardPlugin(samlIds)] : [],
 			signInPolicyPlugin(policy),
+			setPasswordPlugin(),
 			goTrueSessionsPlugin({
 				issuer: goTrueIssuer(options.baseURL),
 				jwt: jwtOptions,
@@ -267,6 +269,10 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 					window: 60,
 					max: 5
 				},
+				[setPasswordPath]: {
+					window: 60,
+					max: 5
+				},
 				"/invitation/sign-up": {
 					window: 60,
 					max: options.signInPerMinute ?? 5

package/dist/better-auth/set-password.js

@@ -0,0 +1,27 @@
+import * as z$1 from "zod";
+import { createAuthEndpoint, sessionMiddleware, setPassword } from "better-auth/api";
+//#region src/better-auth/set-password.ts
+const setPasswordPath = "/account/set-password";
+/**
+* `POST /account/set-password { newPassword }`: gives the signed-in account its first password, such as one made by
+* signing up with emailed codes or a provider. It is Better Auth's server-only `setPassword`, with its length rules;
+* an account that has a password already answers `400 PASSWORD_ALREADY_SET` and changes it with `/change-password`.
+* Every session, the one asking included, and every MCP grant stays: nothing was known to anyone else before. The
+* sign-in policy refuses it while passwords are off, and the staff plugin refuses it for a staff session.
+*/
+const setPasswordPlugin = () => ({
+	id: "protobase-set-password",
+	endpoints: { setFirstPassword: createAuthEndpoint(setPasswordPath, {
+		method: "POST",
+		use: [sessionMiddleware],
+		body: z$1.object({ newPassword: z$1.string() })
+	}, async (ctx) => {
+		await setPassword({
+			...ctx,
+			body: { newPassword: ctx.body.newPassword }
+		});
+		return ctx.json({ status: true });
+	}) }
+});
+//#endregion
+export { setPasswordPath, setPasswordPlugin };

package/dist/better-auth/sign-in-enforcement.js

@@ -3,7 +3,8 @@ import { signInPolicyMethods } from "./sign-in-policy.js";
 const passwordPaths = [
 	"/sign-in/email",
 	"/request-password-reset",
-	"/reset-password"
+	"/reset-password",
+	"/account/set-password"
 ];
 const emailCodePaths = ["/sign-in/email-otp"];
 const passkeyPaths = [

package/dist/better-auth/sign-in-mail.js

@@ -2,14 +2,16 @@ import { sendAuthEmail } from "./auth-mail/send-auth-email.js";
 const codeLifetimeMinutes = 5;
 const codeLifetime = "5 minutes";
 /**
-* Better Auth's email OTP plugin as sign-in only: never a sign-up, codes stored hashed, sent with `mail`. The
-* plugin's other uses (email verification, its own password reset, changing the address) are not offered.
+* Better Auth's email OTP plugin for signing in and changing the address: never a sign-up, codes stored hashed, sent
+* with `mail`. A new address gets its own email, with the code that moves the account to it. The plugin's other uses
+* (email verification, its own password reset) are not offered.
 */
 const emailCodeOptions = (mail) => ({
 	disableSignUp: true,
 	expiresIn: 300,
 	storeOTP: "hashed",
-	sendVerificationOTP: ({ email, otp }, ctx) => sendAuthEmail(mail, "signInCodeEmail", email, {
+	changeEmail: { enabled: true },
+	sendVerificationOTP: ({ email, otp, type }, ctx) => sendAuthEmail(mail, type === "change-email" ? "changeEmailCodeEmail" : "signInCodeEmail", email, {
 		code: otp,
 		lifetime: codeLifetime
 	}, ctx?.context.baseURL)
@@ -20,9 +22,7 @@ const unusedEmailCodePaths = [
 	"/email-otp/verify-email",
 	"/email-otp/request-password-reset",
 	"/forget-password/email-otp",
-	"/email-otp/reset-password",
-	"/email-otp/request-email-change",
-	"/email-otp/change-email"
+	"/email-otp/reset-password"
 ];
 /** The two-factor plugin's emailed code, sent with `mail`; stored hashed. */
 const twoFactorCodeOptions = (mail) => ({

package/dist/better-auth/staff-checks.js

@@ -39,7 +39,10 @@ const staffLabel = (claims) => typeof claims.email === "string" && claims.email
 const accountChanges = [
 	"/change-password",
 	"/set-password",
+	"/account/set-password",
 	"/change-email",
+	"/email-otp/request-email-change",
+	"/email-otp/change-email",
 	"/delete-user",
 	"/link-social",
 	"/unlink-account",

package/dist/better-auth/status-route.js

@@ -9,7 +9,7 @@ import { Hono } from "hono";
 * `GET {authBase}/status`: `needsAdmin` while the admin store has no user, so a login page can say how to create one;
 * `signInMethods`, the ways to sign in the sign-in policy leaves on (`password`, `emailCode`, `passkey`), so it offers
 * only those; `passwordReset` when reset mail can be sent and passwords are on, so it offers "Forgot password?" only
-* then; `signUp` when the app has open sign-up, so it offers "Create an account"; the ids of the `socialProviders` people can sign in with, so it offers "Continue with GitHub" when `github` is
+* then; `changeEmail` when mail can be sent, so the account page offers to change the address with an emailed code; `signUp` when the app has open sign-up, so it offers "Create an account"; the ids of the `socialProviders` people can sign in with, so it offers "Continue with GitHub" when `github` is
 * one; `platformSignIn`, the id and name of the platform's provider when it is one of them; `samlProviders`, the id and name of each SAML provider, when the app has any; `staffSignIn`, the
 * operator provider's name, when staff can sign in as people; `passkeyDomains`, when people have passkeys for more than
 * one of the app's hosts, the RP IDs a passkey sign-in can ask for, the passkey domain first; with organizations, who may create them and the roles
@@ -37,6 +37,7 @@ const statusRoute = (auth, { anonymous = false, plugins = [], locale } = {}) =>
 			needsAdmin: !await hasUsers(auth),
 			signInMethods,
 			passwordReset: auth.passwordReset && policy.password === "allowed",
+			...auth.mail && { changeEmail: true },
 			...auth.signUp && { signUp: true },
 			socialProviders,
 			...platformSignIn && { platformSignIn },

package/dist/create-admin.js

@@ -96,7 +96,7 @@ import { recordRoutes } from "./routes/record.js";
 import { createScanGuard } from "./scan-guard.js";
 import { failedJobs, failedJobsView } from "./jobs/failed-jobs.js";
 import { Hono } from "hono";
-import { checkPages } from "@protobase/layout";
+import { accountPage, accountPageName, checkPages, settingsResources, withSettingsFields } from "@protobase/layout";
 //#region src/create-admin.ts
 const declaredRoles = (auth, roles) => {
 	const names = [...auth?.roles ?? [], ...Object.keys(roles?.definitions ?? {})];
@@ -130,7 +130,9 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	const apiFunctions = Object.fromEntries(Object.entries(functions).map(([name, source]) => [name, toApiFunction(name, source)]));
 	const viewModels = views.map((view) => view.toModel());
 	const userMenuModel = userMenu?.toUserMenuModel();
-	const pageModels = pages.map((entry) => entry.toModel());
+	const allPages = pages.map((entry) => entry.toModel());
+	const pageModels = allPages.filter((entry) => entry.name !== accountPageName);
+	const accountModel = allPages.find((entry) => entry.name === accountPageName) ?? accountPage.toModel();
 	checkShell(registry, viewModels, userMenuModel, pageModels.map((entry) => entry.name));
 	const bottomBarModels = bottomBars.map((bar) => bar.toBottomBarModel());
 	checkBottomBars(registry, bottomBarModels, pageModels.map((entry) => entry.name), declaredRoles(auth, options.roles));
@@ -141,8 +143,9 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	if (options.mcp) checkMcpWrites(registry, declaredRoles(auth, options.roles), options.mcp.writes);
 	checkPositionAfter(registry);
 	checkParents(registry);
-	checkPages(pageModels, {
-		models: Object.fromEntries(registry.entries.map((entry) => [entry.name, entry.model])),
+	const resourceModels = Object.fromEntries(registry.entries.map((entry) => [entry.name, entry.model]));
+	checkPages([...pageModels, accountModel], {
+		models: resourceModels,
 		actions: (resource) => new Set(viewModels.filter((view) => view.resource === resource).flatMap((view) => view.actions.map((action) => action.name))),
 		createPages: new Set(viewModels.filter((view) => view.create).map((view) => view.resource))
 	});
@@ -188,7 +191,8 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		db,
 		registry,
 		views: viewModels,
-		pages: pageModels,
+		pages: pageModels.map((entry) => withSettingsFields(entry, resourceModels)),
+		account: withSettingsFields(accountModel, resourceModels),
 		...userMenuModel && { userMenu: userMenuModel },
 		bottomBars: bottomBarModels,
 		basePath,
@@ -207,6 +211,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 			...options.roles && { roles: options.roles },
 			...options.defaultAccess && { defaultAccess: options.defaultAccess }
 		},
+		settingsResources: settingsResources([...pageModels, accountModel]),
 		rowPermissions: (resource) => typeof options.rowPermissions === "object" ? !options.rowPermissions.except.includes(resource) : options.rowPermissions !== false,
 		...assistant && { assistant: assistant.kind === "external" ? assistant.url : `${systemPath}/assistant` },
 		...runtime && { runtime },

package/dist/deps.d.ts

@@ -24,6 +24,8 @@ export type Deps = {
   /** The bottom bars, in config order. */
   bottomBars: BottomBarModel[];
   pages: PageModel[];
+  /** The signed-in person's account page, at `/-/account`: the app's page named `account`, or the standard one. */
+  account?: PageModel;
   basePath: string;
   /** Where the system endpoints live (`/meta`, `/openapi.json`, `/docs`): the parent of `basePath`, `/api` by default. */
   systemPath: string;
@@ -33,6 +35,8 @@ export type Deps = {
   /** Run on a create's or update's body before its transaction opens (see `WriteCheck`). */
   writeChecks: readonly WriteCheck[];
   accessOptions: ResolveOptions;
+  /** The resources the pages' `Settings` blocks show: every caller, an admin too, reads and writes only their own records. */
+  settingsResources: ReadonlySet<string>;
   /** Where reveals of sensitive fields are published. */
   audit: AuditQueue;
   /** Gets the errors of work that runs after a request's response is decided, such as a committed write's file cleanup. */

package/dist/list-photos.js

@@ -9,7 +9,7 @@ import { cardPhotoLimit } from "@protobase/schema/internal";
 import { checkFilter, createWhere } from "@protobase/schema";
 import { relatedRows } from "@protobase/query";
 //#region src/list-photos.ts
-const where = createWhere();
+const where$1 = createWhere();
 const invalid = (parameter, message) => badRequest("invalid-parameter", `Invalid ${parameter}: ${message}`, { errors: [{
 	parameter,
 	message
@@ -64,7 +64,7 @@ const recordPhotos = async (deps, request, model, rows) => {
 	if (!request.access || keys.length === 0) return { photos: {} };
 	const { photos, access } = request;
 	const sort = checkedSort(access.model, photos.sort);
-	const filter = checkFilter(access.model, where.in(photos.field, keys));
+	const filter = checkFilter(access.model, where$1.in(photos.field, keys));
 	if (!filter.ok) throw new Error(`Keys of "${model.name}" do not make a filter of "${photos.resource}": ${filter.errors[0].message}`);
 	const scope = readScope(access);
 	const warning = await deps.guard(access.entry, {

package/dist/meta.d.ts

@@ -27,6 +27,8 @@ export type CallerMeta = {
   views: ViewModel[];
   /** The composed pages the caller may open, without the elements that name what they cannot see or do. */
   pages: PageModel[];
+  /** The caller's account page, at `/-/account`, when they are signed in, pruned as the pages are. */
+  account?: PageModel;
   permissions: Record<string, ResourcePermissions>;
   /** The user menu with the resources the caller cannot see left out. */
   userMenu?: UserMenuModel;

package/dist/meta.js

@@ -57,6 +57,7 @@ const createMeta = (deps, appName, appIcon) => {
 			actions: (resource) => new Set(views.find((view) => view.resource === resource)?.actions.map((action) => action.name) ?? [])
 		};
 		const pages = deps.pages.flatMap((page) => prunePage(page, session.user.roles, callerAccess) ?? []);
+		const account = deps.account && !session.anonymous ? prunePage(deps.account, session.user.roles, callerAccess) : void 0;
 		const shown = (item) => item.kind === "link" || (item.kind === "resource" ? visible.some((access) => access.entry.name === item.resource) || prompted.has(item.resource) : pages.some((page) => page.name === item.page));
 		const bar = bottomBarFor(deps.bottomBars, activeRole(session));
 		const barItems = bar?.items.filter(shown) ?? [];
@@ -69,6 +70,7 @@ const createMeta = (deps, appName, appIcon) => {
 			resources: visible.map(metaModel),
 			views,
 			pages,
+			...account && { account },
 			permissions: Object.fromEntries(visible.map(({ entry, resolved, full }) => [entry.name, {
 				read: resolved.operations.read || resolved.operations.list,
 				create: resolved.operations.create,

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.46.2";
+var version = "0.46.4";
 //#endregion
 export { version };

package/dist/related-labels.js

@@ -4,7 +4,7 @@ import { exposeRow } from "./rows.js";
 import { checkFilter, createWhere } from "@protobase/schema";
 import { listQuery } from "@protobase/query";
 //#region src/related-labels.ts
-const where = createWhere();
+const where$1 = createWhere();
 const invalid = (entry, message) => badRequest("invalid-parameter", `Invalid labels entry "${entry}": ${message}`, { errors: [{
 	parameter: "labels",
 	message
@@ -55,7 +55,7 @@ const namesOf = async (trx, { field, access }, keys) => {
 			}
 		}
 	};
-	const filter = checkFilter(model, where.in(key, keys));
+	const filter = checkFilter(model, where$1.in(key, keys));
 	if (!filter.ok) throw new Error(`Keys of "${access.entry.name}" do not make a filter: ${filter.errors[0].message}`);
 	const named = (await listQuery(trx, model, {
 		filter: filter.filter,

package/dist/request-access.js

@@ -3,7 +3,7 @@ import { forbidden, notFound, unauthorized } from "./problem.js";
 import { checkedFilter } from "./filter-input.js";
 import { checkOwnerId } from "./owner-id.js";
 import { tenantScope } from "./tenant.js";
-import { checkFilter, resolveAccess, restrictModel } from "@protobase/schema";
+import { checkFilter, resolveAccess, restrictModel, where } from "@protobase/schema";
 //#region src/request-access.ts
 const organizationOf = (session) => session.organization ? { organization: session.organization } : {};
 const withoutSensitive = (model) => ({
@@ -32,6 +32,38 @@ const throughForm = (resolved, form) => {
 		}
 	};
 };
+const noAccess = {
+	operations: {
+		read: false,
+		list: false,
+		create: false,
+		update: false,
+		delete: false
+	},
+	recordChecks: [],
+	readableFields: [],
+	writableFields: {
+		create: [],
+		update: []
+	},
+	rowFilter: {}
+};
+const ownOnly = (resolved, entry, session) => {
+	if (session.anonymous) return noAccess;
+	const own = checkFilter(trusted(entry.model), where.eq(entry.model.owner, session.user.id));
+	if (!own.ok) throw new Error(`The owner filter of "${entry.name}" is invalid: ${own.errors[0].message}`);
+	const { rowFilter } = resolved;
+	const narrowed = (operation) => andFilters([rowFilter[operation], own.filter]);
+	return {
+		...resolved,
+		rowFilter: {
+			read: narrowed("read"),
+			create: narrowed("create"),
+			update: narrowed("update"),
+			delete: narrowed("delete")
+		}
+	};
+};
 /** `form` is the public form a visitor sends, the only way a caller without a token creates. */
 const requestAccess = async (deps, entry, session, form) => {
 	const all = await resolveAccess(entry.source, {
@@ -41,7 +73,8 @@ const requestAccess = async (deps, entry, session, form) => {
 		},
 		...organizationOf(session)
 	}, deps.accessOptions);
-	const resolved = form ? throughForm(all, form) : withoutAnonymousCreate(all, session);
+	const allowed = form ? throughForm(all, form) : withoutAnonymousCreate(all, session);
+	const resolved = deps.settingsResources.has(entry.name) ? ownOnly(allowed, entry, session) : allowed;
 	checkOwnerId(entry, session.user, resolved);
 	const readable = restrictModel(entry.model, resolved);
 	return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.46.2",
+  "version": "0.46.4",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.46.2",
-    "@protobase/query": "0.46.2",
-    "@protobase/schema": "0.46.2",
+    "@protobase/layout": "0.46.4",
+    "@protobase/query": "0.46.4",
+    "@protobase/schema": "0.46.4",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",