@protobase/server 0.46.7 → 0.46.8

package/dist/better-auth/create-auth.d.ts

@@ -111,6 +111,12 @@ export type CreateAuthOptions = {
    * Supabase Auth's. The first sign-in with one stores the password again as Better Auth hashes it. Default none.
    */
   passwordHashes?: PasswordHash[];
+  /**
+   * Refuses a new password that appears in a known data breach, by Have I Been Pwned's password list: at sign-up, from
+   * an invitation, and when a password is set, changed, reset or given by an admin. Only the first five characters of
+   * the password's SHA-1 hash leave the server. While the list cannot be reached, setting a password fails. Default off.
+   */
+  leakedPasswords?: boolean;
   /**
    * The identity provider the operator's staff sign in with to sign in as people of this app, for support. Defaults
    * to the one the platform passes in `PROTOBASE_OPERATOR_ISSUER`, `PROTOBASE_OPERATOR_CLIENT_ID` and
@@ -4511,6 +4517,17 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         status: boolean;
       }>;
     };
+  } | {
+    id: "protobase-leaked-passwords";
+    hooks: {
+      before: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
+    $ERROR_CODES: {
+      PASSWORD_COMPROMISED: import("better-auth").RawError<"PASSWORD_COMPROMISED">;
+    };
   } | {
     id: "protobase-gotrue-sessions";
     endpoints: {
@@ -8790,6 +8807,8 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   /** The policy until an admin saves one. */
   signInPolicy: SignInPolicy;
   passwordReset: boolean;
+  /** New passwords are checked against Have I Been Pwned's list of leaked ones (`leakedPasswords`). */
+  leakedPasswords: boolean;
   /** Open sign-up is on and offered: the app asks for it, and can mail the codes. */
   signUp: boolean;
   /** The role of accounts made by open sign-up, while it is offered. */

package/dist/better-auth/create-auth.js

@@ -13,6 +13,9 @@ import { platformMailer } from "../mail/platform-mailer.js";
 import { readOperatorSettings, resolveOperator } from "./operator-provider.js";
 import { defaultInvitationUrl } from "./invitations/invitation-link-hook.js";
 import { lastAdminGuardPlugin } from "./last-admin-guard.js";
+import { setPasswordPath, setPasswordPlugin } from "./set-password.js";
+import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
+import { leakedPasswordsPlugin } from "./leaked-passwords.js";
 import { userDeletion } from "./user-deletion.js";
 import { revokeMcpGrants } from "./mcp/revoke-grants.js";
 import { coreNames, pluginNames } from "./snake-case-names.js";
@@ -25,7 +28,6 @@ import { resolveOrganizations } from "./organizations/options.js";
 import { passkeyHosts, readPasskeyDomain, resolvePasskeyDomain } from "./passkey-domain.js";
 import { passkeyPlugin } from "./passkey-plugin.js";
 import { passwordResetOptions } from "./password-reset.js";
-import { setPasswordPath, setPasswordPlugin } from "./set-password.js";
 import { rolesPlugin } from "./roles/roles-plugin.js";
 import { platformSignInFor, platformSignInProvider, readPlatformSignIn, resolvePlatformSignIn } from "./platform-sign-in.js";
 import { appSignInPolicy } from "./app-sign-in-policy.js";
@@ -33,7 +35,6 @@ import { assertNoEndpointKeyClashes } from "./endpoint-key-clashes.js";
 import { emailInDomains, resolveSamlProviders, samlDisabledPaths, samlGuardPlugin, samlPlugin } from "./saml-sign-in.js";
 import { noAccountMailPlugin } from "./no-account-mail.js";
 import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
-import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
 import { confirmedOnCreate, confirmedOnUpdate, emailConfirmedField } from "./email-confirmed.js";
 import { rehashPasswordsPlugin, verifyAcceptedHash } from "./password-hashes.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
@@ -182,6 +183,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			...saml.length > 0 ? [samlPlugin(saml, options.baseURL), samlGuardPlugin(samlIds)] : [],
 			signInPolicyPlugin(policy),
 			setPasswordPlugin(),
+			...options.leakedPasswords ? [leakedPasswordsPlugin()] : [],
 			goTrueSessionsPlugin({
 				issuer: goTrueIssuer(options.baseURL),
 				jwt: jwtOptions,
@@ -384,6 +386,8 @@ const createAuth = (options) => {
 		/** The policy until an admin saves one. */
 		signInPolicy,
 		passwordReset: Boolean(mailer),
+		/** New passwords are checked against Have I Been Pwned's list of leaked ones (`leakedPasswords`). */
+		leakedPasswords: Boolean(options.leakedPasswords),
 		/** Open sign-up is on and offered: the app asks for it, and can mail the codes. */
 		signUp: Boolean(signUpRole && mailer),
 		/** The role of accounts made by open sign-up, while it is offered. */

package/dist/better-auth/leaked-passwords.js

@@ -0,0 +1,47 @@
+import { passwordLength } from "./new-account-password.js";
+import { setPasswordPath } from "./set-password.js";
+import { signUpPaths } from "./sign-up/sign-up-plugin.js";
+import { APIError, createAuthMiddleware } from "better-auth/api";
+import { haveIBeenPwned, isPasswordCompromised } from "better-auth/plugins/haveibeenpwned";
+//#region src/better-auth/leaked-passwords.ts
+const { PASSWORD_COMPROMISED } = haveIBeenPwned().$ERROR_CODES;
+const leakedPasswordMessage = "This password appears in a known data breach. Choose a different one.";
+const passwordFields = {
+	"/sign-up/email": "password",
+	"/change-password": "newPassword",
+	"/reset-password": "newPassword",
+	"/admin/create-user": "password",
+	"/admin/set-user-password": "newPassword",
+	[setPasswordPath]: "newPassword",
+	[signUpPaths.create]: "password",
+	"/invitation/sign-up": "password"
+};
+/** Refuses a password from the Have I Been Pwned corpus with `400 PASSWORD_COMPROMISED`, as Better Auth's plugin does. */
+const rejectLeakedPassword = async (password) => {
+	if (!await isPasswordCompromised(password)) return;
+	throw APIError.from("BAD_REQUEST", {
+		code: PASSWORD_COMPROMISED.code,
+		message: leakedPasswordMessage
+	});
+};
+/**
+* Better Auth's haveIBeenPwned check, on every endpoint of `passwordFields`. It runs before the endpoint, where the
+* plugin itself checks only once the password is hashed: admin account creation, invitation sign-up and sign-up have
+* made the account or used the ticket by then. Only the first five characters of the password's SHA-1 hash leave the
+* server; a password outside the allowed lengths is left to the endpoint, which refuses it without a lookup. When the
+* list cannot be reached, the request fails with a 500.
+*/
+const leakedPasswordsPlugin = () => ({
+	id: "protobase-leaked-passwords",
+	hooks: { before: [{
+		matcher: (ctx) => ctx.path !== void 0 && Object.hasOwn(passwordFields, ctx.path),
+		handler: createAuthMiddleware(async (ctx) => {
+			const password = ctx.body?.[passwordFields[ctx.path]];
+			if (typeof password !== "string" || password.length < passwordLength.min || password.length > passwordLength.max) return;
+			await rejectLeakedPassword(password);
+		})
+	}] },
+	$ERROR_CODES: { PASSWORD_COMPROMISED }
+});
+//#endregion
+export { leakedPasswordsPlugin, rejectLeakedPassword };

package/dist/better-auth/passkey-plugin.js

@@ -2,9 +2,9 @@ import { pluginNames } from "./snake-case-names.js";
 import * as z$1 from "zod";
 import { APIError, createAuthEndpoint, getSessionFromCtx } from "better-auth/api";
 import { generateRandomString } from "better-auth/crypto";
+import { setSessionCookie } from "better-auth/cookies";
 import { PASSKEY_ERROR_CODES, passkey } from "@better-auth/passkey";
 import { generateAuthenticationOptions, verifyAuthenticationResponse } from "@simplewebauthn/server";
-import { setSessionCookie } from "better-auth/cookies";
 //#region src/better-auth/passkey-plugin.ts
 const challengeCookie = "better-auth-passkey";
 const challengeSeconds = 300;

package/dist/gotrue/email-code-routes.js

@@ -3,6 +3,7 @@ import { readSignInPolicy } from "../better-auth/policy-store.js";
 import { checkNewAccountPassword } from "../better-auth/new-account-password.js";
 import { createSignedUpAccount } from "../better-auth/sign-up/sign-up-account.js";
 import { consumeSignUpTicket } from "../better-auth/sign-up/sign-up-ticket.js";
+import { rejectLeakedPassword } from "../better-auth/leaked-passwords.js";
 import { GoTrueError } from "./errors.js";
 import { callBetterAuth, signedInToken } from "./forward.js";
 import { hasPendingSignUp, savePendingSignUp, takePendingSignUp } from "./pending-sign-up.js";
@@ -79,6 +80,7 @@ const emailCodeRoutes = ({ auth, context, sessionOf }) => {
 		if (!auth.signUp) throw signUpDisabled();
 		checkMetadata(data);
 		checkNewAccountPassword(await signUpPolicy(), password);
+		if (auth.leakedPasswords) await rejectLeakedPassword(password);
 		await sendSignUpCode(c.req.raw, email);
 		await savePendingSignUp(await context(), email, {
 			passwordHash: await (await context()).password.hash(password),

package/dist/gotrue/errors.js

@@ -35,7 +35,8 @@ const known = {
 	BANNED_USER: [403, "user_banned"],
 	NO_ADMIN_YET: [422, "signup_disabled"],
 	PASSWORD_LENGTH: [422, "weak_password"],
-	PASSWORD_REQUIRED: [422, "weak_password"]
+	PASSWORD_REQUIRED: [422, "weak_password"],
+	PASSWORD_COMPROMISED: [422, "weak_password"]
 };
 /** A refusal of Better Auth, by its status and body, as GoTrue's: a known code becomes GoTrue's, any other its own in lower case. */
 const fromBetterAuth = (status, body) => {

package/dist/gotrue/user-routes.js

@@ -2,6 +2,7 @@ import { effectiveSignInPolicy } from "../better-auth/sign-in-policy.js";
 import { readSignInPolicy } from "../better-auth/policy-store.js";
 import { goTrueUser, userMetadata } from "./user-json.js";
 import { checkNewAccountPassword } from "../better-auth/new-account-password.js";
+import { rejectLeakedPassword } from "../better-auth/leaked-passwords.js";
 import { revokeMcpGrants } from "../better-auth/mcp/revoke-grants.js";
 import { goTrueTokens } from "./access-tokens.js";
 import { GoTrueError } from "./errors.js";
@@ -75,6 +76,7 @@ const userRoutes = ({ auth, context }) => {
 		if (data !== void 0 && !auth.userMetadata) throw new GoTrueError(400, "validation_failed", "This app keeps no user metadata: leave data out");
 		if (password !== void 0) {
 			checkNewAccountPassword(effectiveSignInPolicy((await readSignInPolicy(ctx.adapter, auth.signInPolicy)).policy, { mail: auth.mail }), password);
+			if (auth.leakedPasswords) await rejectLeakedPassword(password);
 			const hash = await ctx.password.hash(password);
 			if (await ctx.internalAdapter.findCredentialAccount(user.id)) await ctx.internalAdapter.updatePassword(user.id, hash);
 			else await ctx.internalAdapter.linkAccount({

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.46.7";
+var version = "0.46.8";
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.46.7",
+  "version": "0.46.8",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.46.7",
-    "@protobase/query": "0.46.7",
-    "@protobase/schema": "0.46.7",
+    "@protobase/layout": "0.46.8",
+    "@protobase/query": "0.46.8",
+    "@protobase/schema": "0.46.8",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",