@protobase/server 0.46.7 → 0.46.9

package/dist/better-auth/create-auth.d.ts

@@ -111,6 +111,12 @@ export type CreateAuthOptions = {
    * Supabase Auth's. The first sign-in with one stores the password again as Better Auth hashes it. Default none.
    */
   passwordHashes?: PasswordHash[];
+  /**
+   * Refuses a new password that appears in a known data breach, by Have I Been Pwned's password list: at sign-up, from
+   * an invitation, and when a password is set, changed, reset or given by an admin. Only the first five characters of
+   * the password's SHA-1 hash leave the server. While the list cannot be reached, setting a password fails. Default off.
+   */
+  leakedPasswords?: boolean;
   /**
    * The identity provider the operator's staff sign in with to sign in as people of this app, for support. Defaults
    * to the one the platform passes in `PROTOBASE_OPERATOR_ISSUER`, `PROTOBASE_OPERATOR_CLIENT_ID` and
@@ -2587,6 +2593,18 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       RESOLVED_USER_INVALID: import("better-auth").RawError<"RESOLVED_USER_INVALID">;
     };
     options: import("@better-auth/passkey").PasskeyOptions | undefined;
+  } | {
+    id: "protobase-strong-sign-ins";
+    hooks: {
+      before: {
+        matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+      after: {
+        matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "email-otp";
     version: string;
@@ -4511,6 +4529,17 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         status: boolean;
       }>;
     };
+  } | {
+    id: "protobase-leaked-passwords";
+    hooks: {
+      before: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
+    $ERROR_CODES: {
+      PASSWORD_COMPROMISED: import("better-auth").RawError<"PASSWORD_COMPROMISED">;
+    };
   } | {
     id: "protobase-gotrue-sessions";
     endpoints: {
@@ -8790,6 +8819,8 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   /** The policy until an admin saves one. */
   signInPolicy: SignInPolicy;
   passwordReset: boolean;
+  /** New passwords are checked against Have I Been Pwned's list of leaked ones (`leakedPasswords`). */
+  leakedPasswords: boolean;
   /** Open sign-up is on and offered: the app asks for it, and can mail the codes. */
   signUp: boolean;
   /** The role of accounts made by open sign-up, while it is offered. */

package/dist/better-auth/create-auth.js

@@ -13,6 +13,9 @@ import { platformMailer } from "../mail/platform-mailer.js";
 import { readOperatorSettings, resolveOperator } from "./operator-provider.js";
 import { defaultInvitationUrl } from "./invitations/invitation-link-hook.js";
 import { lastAdminGuardPlugin } from "./last-admin-guard.js";
+import { setPasswordPath, setPasswordPlugin } from "./set-password.js";
+import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
+import { leakedPasswordsPlugin } from "./leaked-passwords.js";
 import { userDeletion } from "./user-deletion.js";
 import { revokeMcpGrants } from "./mcp/revoke-grants.js";
 import { coreNames, pluginNames } from "./snake-case-names.js";
@@ -25,7 +28,6 @@ import { resolveOrganizations } from "./organizations/options.js";
 import { passkeyHosts, readPasskeyDomain, resolvePasskeyDomain } from "./passkey-domain.js";
 import { passkeyPlugin } from "./passkey-plugin.js";
 import { passwordResetOptions } from "./password-reset.js";
-import { setPasswordPath, setPasswordPlugin } from "./set-password.js";
 import { rolesPlugin } from "./roles/roles-plugin.js";
 import { platformSignInFor, platformSignInProvider, readPlatformSignIn, resolvePlatformSignIn } from "./platform-sign-in.js";
 import { appSignInPolicy } from "./app-sign-in-policy.js";
@@ -33,10 +35,10 @@ import { assertNoEndpointKeyClashes } from "./endpoint-key-clashes.js";
 import { emailInDomains, resolveSamlProviders, samlDisabledPaths, samlGuardPlugin, samlPlugin } from "./saml-sign-in.js";
 import { noAccountMailPlugin } from "./no-account-mail.js";
 import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
-import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
 import { confirmedOnCreate, confirmedOnUpdate, emailConfirmedField } from "./email-confirmed.js";
 import { rehashPasswordsPlugin, verifyAcceptedHash } from "./password-hashes.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
+import { strongSignInsPlugin } from "./strong-sign-ins.js";
 import { twoFactorAfterPasswordOrCode } from "./two-factor-challenge.js";
 import { metadataField, userFieldsNamed, userModel, userTable, withUserColumns } from "./user-table.js";
 import { usersPlugin } from "./users/users-plugin.js";
@@ -172,6 +174,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				formerDomain: hosts[0],
 				origins: appOrigins(options.baseURL, origins)
 			}),
+			strongSignInsPlugin(),
 			...mail ? [emailOTP(emailCodeOptions(mail)), noAccountMailPlugin(mail)] : [],
 			...mail && signUpRole ? [signUpPlugin({
 				role: signUpRole,
@@ -182,6 +185,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			...saml.length > 0 ? [samlPlugin(saml, options.baseURL), samlGuardPlugin(samlIds)] : [],
 			signInPolicyPlugin(policy),
 			setPasswordPlugin(),
+			...options.leakedPasswords ? [leakedPasswordsPlugin()] : [],
 			goTrueSessionsPlugin({
 				issuer: goTrueIssuer(options.baseURL),
 				jwt: jwtOptions,
@@ -384,6 +388,8 @@ const createAuth = (options) => {
 		/** The policy until an admin saves one. */
 		signInPolicy,
 		passwordReset: Boolean(mailer),
+		/** New passwords are checked against Have I Been Pwned's list of leaked ones (`leakedPasswords`). */
+		leakedPasswords: Boolean(options.leakedPasswords),
 		/** Open sign-up is on and offered: the app asks for it, and can mail the codes. */
 		signUp: Boolean(signUpRole && mailer),
 		/** The role of accounts made by open sign-up, while it is offered. */

package/dist/better-auth/leaked-passwords.js

@@ -0,0 +1,47 @@
+import { passwordLength } from "./new-account-password.js";
+import { setPasswordPath } from "./set-password.js";
+import { signUpPaths } from "./sign-up/sign-up-plugin.js";
+import { APIError, createAuthMiddleware } from "better-auth/api";
+import { haveIBeenPwned, isPasswordCompromised } from "better-auth/plugins/haveibeenpwned";
+//#region src/better-auth/leaked-passwords.ts
+const { PASSWORD_COMPROMISED } = haveIBeenPwned().$ERROR_CODES;
+const leakedPasswordMessage = "This password appears in a known data breach. Choose a different one.";
+const passwordFields = {
+	"/sign-up/email": "password",
+	"/change-password": "newPassword",
+	"/reset-password": "newPassword",
+	"/admin/create-user": "password",
+	"/admin/set-user-password": "newPassword",
+	[setPasswordPath]: "newPassword",
+	[signUpPaths.create]: "password",
+	"/invitation/sign-up": "password"
+};
+/** Refuses a password from the Have I Been Pwned corpus with `400 PASSWORD_COMPROMISED`, as Better Auth's plugin does. */
+const rejectLeakedPassword = async (password) => {
+	if (!await isPasswordCompromised(password)) return;
+	throw APIError.from("BAD_REQUEST", {
+		code: PASSWORD_COMPROMISED.code,
+		message: leakedPasswordMessage
+	});
+};
+/**
+* Better Auth's haveIBeenPwned check, on every endpoint of `passwordFields`. It runs before the endpoint, where the
+* plugin itself checks only once the password is hashed: admin account creation, invitation sign-up and sign-up have
+* made the account or used the ticket by then. Only the first five characters of the password's SHA-1 hash leave the
+* server; a password outside the allowed lengths is left to the endpoint, which refuses it without a lookup. When the
+* list cannot be reached, the request fails with a 500.
+*/
+const leakedPasswordsPlugin = () => ({
+	id: "protobase-leaked-passwords",
+	hooks: { before: [{
+		matcher: (ctx) => ctx.path !== void 0 && Object.hasOwn(passwordFields, ctx.path),
+		handler: createAuthMiddleware(async (ctx) => {
+			const password = ctx.body?.[passwordFields[ctx.path]];
+			if (typeof password !== "string" || password.length < passwordLength.min || password.length > passwordLength.max) return;
+			await rejectLeakedPassword(password);
+		})
+	}] },
+	$ERROR_CODES: { PASSWORD_COMPROMISED }
+});
+//#endregion
+export { leakedPasswordsPlugin, rejectLeakedPassword };

package/dist/better-auth/passkey-plugin.js

@@ -2,9 +2,9 @@ import { pluginNames } from "./snake-case-names.js";
 import * as z$1 from "zod";
 import { APIError, createAuthEndpoint, getSessionFromCtx } from "better-auth/api";
 import { generateRandomString } from "better-auth/crypto";
+import { setSessionCookie } from "better-auth/cookies";
 import { PASSKEY_ERROR_CODES, passkey } from "@better-auth/passkey";
 import { generateAuthenticationOptions, verifyAuthenticationResponse } from "@simplewebauthn/server";
-import { setSessionCookie } from "better-auth/cookies";
 //#region src/better-auth/passkey-plugin.ts
 const challengeCookie = "better-auth-passkey";
 const challengeSeconds = 300;

package/dist/better-auth/strong-sign-ins.js

@@ -0,0 +1,64 @@
+import { isStaffSession } from "./staff-checks.js";
+import { APIError, createAuthMiddleware, getSessionFromCtx } from "better-auth/api";
+//#region src/better-auth/strong-sign-ins.ts
+const twoFactorPaths = [
+	"/two-factor/verify-totp",
+	"/two-factor/verify-otp",
+	"/two-factor/verify-backup-code"
+];
+/**
+* The Better Auth endpoints that prove a passkey or a second step: each signs in a new session, or confirms the one the
+* request's cookie names, as the second step does for someone signed in already.
+*/
+const strongSignInPaths = ["/passkey/verify-authentication", ...twoFactorPaths];
+const identifierOf = (sessionId) => `protobase-strong-sign-in-${sessionId}`;
+/** Notes that the session proved a passkey or a second step now; the note ends with the session. */
+const saveStrongSignIn = async (internal, session, now = /* @__PURE__ */ new Date()) => {
+	const identifier = identifierOf(session.id);
+	await internal.deleteVerificationByIdentifier(identifier);
+	await internal.createVerificationValue({
+		identifier,
+		value: now.toISOString(),
+		expiresAt: session.expiresAt
+	});
+};
+/** When the session last proved a passkey or a second step, if it did and its note has not expired. */
+const strongSignInAt = async (internal, sessionId, now = /* @__PURE__ */ new Date()) => {
+	const found = await internal.findVerificationValue(identifierOf(sessionId));
+	if (!found || new Date(found.expiresAt) <= now) return void 0;
+	return new Date(found.value);
+};
+/**
+* Records the sessions that sign in, or confirm, with a passkey or a second step, since Better Auth's sessions do not
+* say how they began: a reveal that asks for a recent strong sign-in reads it (`strongSignInAt`). The session is the
+* one the answer signed in, or else the one the request's cookie names. A staff session is never recorded: staff
+* proved nothing as the person. Nor is the code that turns two-factor authentication on, which a session alone may
+* ask for on an account without a password: it proves the authenticator app just added, not the person.
+*/
+const strongSignInsPlugin = () => {
+	const turningOn = /* @__PURE__ */ new WeakSet();
+	return {
+		id: "protobase-strong-sign-ins",
+		hooks: {
+			before: [{
+				matcher: (context) => context.path !== void 0 && twoFactorPaths.includes(context.path),
+				handler: createAuthMiddleware(async (ctx) => {
+					const signedIn = await getSessionFromCtx(ctx);
+					if (signedIn && !signedIn.user.twoFactorEnabled && ctx.headers) turningOn.add(ctx.headers);
+				})
+			}],
+			after: [{
+				matcher: (context) => context.path !== void 0 && strongSignInPaths.includes(context.path),
+				handler: createAuthMiddleware(async (ctx) => {
+					if (ctx.context.returned instanceof APIError) return;
+					if (ctx.headers && turningOn.has(ctx.headers)) return;
+					const session = ctx.context.newSession?.session ?? (await getSessionFromCtx(ctx))?.session;
+					if (!session || isStaffSession(session)) return;
+					await saveStrongSignIn(ctx.context.internalAdapter, session);
+				})
+			}]
+		}
+	};
+};
+//#endregion
+export { saveStrongSignIn, strongSignInAt, strongSignInPaths, strongSignInsPlugin };

package/dist/better-auth/token-standing.js

@@ -4,6 +4,7 @@ import { parseRoles } from "./parse-roles.js";
 import { effectiveRoles, globalRoles } from "./organizations/app-roles.js";
 import { findMember, findOrganization } from "./organizations/store.js";
 import { isStaffSession } from "./staff-checks.js";
+import { strongSignInAt } from "./strong-sign-ins.js";
 //#region src/better-auth/token-standing.ts
 /**
 * The sign-in a session row stands for: staff started it when the admin plugin's `impersonatedBy` names someone. A row
@@ -53,7 +54,8 @@ const checkUserStanding = async (context, claims, organizations, now = /* @__PUR
 * Whether a token still stands, read from the store on every request: its session is not signed out or expired, and
 * its user still stands (`checkUserStanding`). A token that fails is a 401, so the client asks its session for a new
 * one, which carries the roles as they are now or is refused. Answers the sign-in the token's session stands for
-* (`signInOf`), `undefined` for a token without one.
+* (`signInOf`), `undefined` for a token without one; the user's own one also reads, when asked, when it last proved a
+* passkey or a second step (`strongSignInAt`).
 */
 const checkTokenStanding = async (context, claims, organizations, now = /* @__PURE__ */ new Date()) => {
 	const session = claims.sessionId === void 0 ? void 0 : await context.adapter.findOne({
@@ -65,7 +67,12 @@ const checkTokenStanding = async (context, claims, organizations, now = /* @__PU
 	});
 	if (claims.sessionId !== void 0 && (!session || session.userId !== claims.userId || session.expiresAt <= now)) throw revoked();
 	await checkUserStanding(context, claims, organizations, now);
-	return session ? signInOf(session, claims.sessionId) : void 0;
+	const signIn = session ? signInOf(session, claims.sessionId) : void 0;
+	if (!signIn || signIn.staff) return signIn;
+	return {
+		...signIn,
+		strongAt: () => strongSignInAt(context.internalAdapter, claims.sessionId)
+	};
 };
 //#endregion
 export { checkTokenStanding, checkUserStanding, signInOf, tokenClaims };

package/dist/gotrue/email-code-routes.js

@@ -3,6 +3,7 @@ import { readSignInPolicy } from "../better-auth/policy-store.js";
 import { checkNewAccountPassword } from "../better-auth/new-account-password.js";
 import { createSignedUpAccount } from "../better-auth/sign-up/sign-up-account.js";
 import { consumeSignUpTicket } from "../better-auth/sign-up/sign-up-ticket.js";
+import { rejectLeakedPassword } from "../better-auth/leaked-passwords.js";
 import { GoTrueError } from "./errors.js";
 import { callBetterAuth, signedInToken } from "./forward.js";
 import { hasPendingSignUp, savePendingSignUp, takePendingSignUp } from "./pending-sign-up.js";
@@ -79,6 +80,7 @@ const emailCodeRoutes = ({ auth, context, sessionOf }) => {
 		if (!auth.signUp) throw signUpDisabled();
 		checkMetadata(data);
 		checkNewAccountPassword(await signUpPolicy(), password);
+		if (auth.leakedPasswords) await rejectLeakedPassword(password);
 		await sendSignUpCode(c.req.raw, email);
 		await savePendingSignUp(await context(), email, {
 			passwordHash: await (await context()).password.hash(password),

package/dist/gotrue/errors.js

@@ -35,7 +35,8 @@ const known = {
 	BANNED_USER: [403, "user_banned"],
 	NO_ADMIN_YET: [422, "signup_disabled"],
 	PASSWORD_LENGTH: [422, "weak_password"],
-	PASSWORD_REQUIRED: [422, "weak_password"]
+	PASSWORD_REQUIRED: [422, "weak_password"],
+	PASSWORD_COMPROMISED: [422, "weak_password"]
 };
 /** A refusal of Better Auth, by its status and body, as GoTrue's: a known code becomes GoTrue's, any other its own in lower case. */
 const fromBetterAuth = (status, body) => {

package/dist/gotrue/user-routes.js

@@ -2,6 +2,7 @@ import { effectiveSignInPolicy } from "../better-auth/sign-in-policy.js";
 import { readSignInPolicy } from "../better-auth/policy-store.js";
 import { goTrueUser, userMetadata } from "./user-json.js";
 import { checkNewAccountPassword } from "../better-auth/new-account-password.js";
+import { rejectLeakedPassword } from "../better-auth/leaked-passwords.js";
 import { revokeMcpGrants } from "../better-auth/mcp/revoke-grants.js";
 import { goTrueTokens } from "./access-tokens.js";
 import { GoTrueError } from "./errors.js";
@@ -75,6 +76,7 @@ const userRoutes = ({ auth, context }) => {
 		if (data !== void 0 && !auth.userMetadata) throw new GoTrueError(400, "validation_failed", "This app keeps no user metadata: leave data out");
 		if (password !== void 0) {
 			checkNewAccountPassword(effectiveSignInPolicy((await readSignInPolicy(ctx.adapter, auth.signInPolicy)).policy, { mail: auth.mail }), password);
+			if (auth.leakedPasswords) await rejectLeakedPassword(password);
 			const hash = await ctx.password.hash(password);
 			if (await ctx.internalAdapter.findCredentialAccount(user.id)) await ctx.internalAdapter.updatePassword(user.id, hash);
 			else await ctx.internalAdapter.linkAccount({

package/dist/openapi/resource-paths.js

@@ -192,7 +192,7 @@ const resourcePaths = (access) => {
 		...auth,
 		404: error("NotFound")
 	};
-	const sensitive = Object.values(access.readable.fields).filter((field) => field.sensitive).map((field) => field.name);
+	const sensitive = [...Object.values(access.readable.fields).filter((field) => field.sensitive).map((field) => field.name), ...Object.keys(entry.source.computedReveals ?? {})];
 	const aiActions = (pickView(access.deps.views, access.session.user.roles, entry.name)?.actions ?? []).filter((action) => action.run?.kind === "ai").map((action) => action.name);
 	const paths = {
 		[`/${entry.name}`]: {
@@ -330,7 +330,7 @@ const resourcePaths = (access) => {
 			operationId: `reveal_${entry.name}`,
 			tags: tag,
 			summary: `Reveal a sensitive field of a ${entry.name} record`,
-			description: "A sensitive field never comes with the record. This returns its value for one record, with the same access as a get, and publishes an audit event first.",
+			description: "A sensitive field never comes with the record. This returns its value for one record, or makes the value of a computed reveal, with the same access as a get, and publishes an audit event first. A field that needs a recent strong sign-in is a 403 `strong-sign-in-required` until the caller confirms it's them with a passkey or a second step.",
 			parameters: [param("key")],
 			requestBody: {
 				required: true,
@@ -356,7 +356,8 @@ const resourcePaths = (access) => {
 						}
 					})
 				},
-				...keyErrors
+				...keyErrors,
+				403: error("Forbidden")
 			}
 		} } },
 		...aiActions.length > 0 && { [`/${entry.name}/{key}:generate`]: { post: {

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.46.7";
+var version = "0.46.9";
 //#endregion
 export { version };

package/dist/resource-source.d.ts

@@ -1,7 +1,7 @@
 import { SubscriptionDefinition } from "./webhooks/subscription.js";
 import "./index.js";
 import { PageDefinition } from "@protobase/layout";
-import { AccessSource, BottomBarSource, EventMatch, FileProcessor, UserMenuSource, ViewModel } from "@protobase/schema";
+import { AccessSource, BottomBarSource, ComputedReveal, EventMatch, FileProcessor, UserMenuSource, ViewModel } from "@protobase/schema";
 import { z } from "zod";
 //#region src/resource-source.d.ts
 type FieldSource = {
@@ -24,6 +24,8 @@ export type ResourceSource = AccessSource & {
     message: string;
   }> | undefined)[];
   recordSchema(): z.ZodType;
+  /** Its values revealed like sensitive fields but computed when asked (`.reveals()`), by name. */
+  readonly computedReveals?: Readonly<Record<string, ComputedReveal<any>>>;
   /** The code predicates of its events, by event name. */
   eventMatches?(): Record<string, EventMatch<any>>;
 };

package/dist/reveal-service.js

@@ -1,4 +1,4 @@
-import { badRequest, notFound } from "./problem.js";
+import { HttpProblem, badRequest, notFound } from "./problem.js";
 import { tenantScope } from "./tenant.js";
 import { requestAccess, requireOperation } from "./request-access.js";
 import { readTransaction } from "./transactions.js";
@@ -16,15 +16,76 @@ const revealedValue = (deps, model, field, record) => {
 		field: field.name
 	});
 };
+/** The refusal of a reveal that needs a strong sign-in more recent than the caller's, which the app answers by asking them to confirm it's them. */
+const strongSignInRequired = (minutes) => new HttpProblem(403, "strong-sign-in-required", "Forbidden", `Confirm it's you with a passkey or a second step: this needs one in the last ${minutes} minutes.`, { minutes });
+const requireStrongSignIn = async (session, minutes, now = /* @__PURE__ */ new Date()) => {
+	const at = session.signIn && !session.signIn.staff && !session.client ? await session.signIn.strongAt?.() : void 0;
+	if (at && now.getTime() - at.getTime() <= minutes * 6e4) return;
+	throw strongSignInRequired(minutes);
+};
+const computedRevealFor = async (access, name) => {
+	const reveals = access.entry.source.computedReveals ?? {};
+	const reveal = Object.hasOwn(reveals, name) ? reveals[name] : void 0;
+	if (!reveal?.read) return reveal;
+	const { session } = access;
+	return await reveal.read({
+		user: {
+			id: session.user.id,
+			roles: session.user.roles
+		},
+		operation: "read",
+		model: access.full,
+		...session.organization && { organization: session.organization }
+	}) === true ? reveal : void 0;
+};
+const publishReveal = async (deps, entry, session, request, field) => {
+	const tenant = tenantScope(entry, session)?.tenantValue;
+	await deps.audit.publish({
+		type: "field.revealed",
+		at: (/* @__PURE__ */ new Date()).toISOString(),
+		actor: {
+			id: session.user.id,
+			roles: [...session.user.roles]
+		},
+		...tenant !== void 0 && { tenant },
+		resource: entry.name,
+		recordKey: encodeKey(request.key),
+		field,
+		origin: request.origin
+	});
+};
+const revealComputed = async (access, reveal, request, name) => {
+	const { deps, entry, session } = access;
+	const fields = Object.values(access.model.fields);
+	const found = await readTransaction(deps.db, deps.statementTimeoutMs, (trx) => fetchReadable(trx, access, request.key, "hide", { fields }));
+	if (!found) throw notFound(`No ${entry.name} with this key`);
+	if (reveal.strongSignIn) await requireStrongSignIn(session, reveal.strongSignIn.minutes ?? 15);
+	const record = Object.fromEntries(fields.map((field) => [field.name, found.record[field.name] ?? null]));
+	const value = await reveal.value(record, {
+		user: {
+			id: session.user.id,
+			roles: session.user.roles
+		},
+		...session.organization && { organization: session.organization }
+	});
+	await publishReveal(deps, entry, session, request, name);
+	return {
+		field: name,
+		value: value ?? null
+	};
+};
 /**
-* The value of one sensitive field of one record, for a caller who may read the record and the field: the same tenant,
-* row filter and record-level rule as a get. The reveal is published to the audit queue before the value is returned;
-* when publishing fails, so does the reveal.
+* The value of one sensitive field of one record, or of one of its computed reveals (`.reveals()`), for a caller who may
+* read the record and the field: the same tenant, row filter and record-level rule as a get. A field or reveal that
+* needs a recent strong sign-in is refused without one (`strongSignInRequired`). The reveal is published to the audit
+* queue before the value is returned; when publishing fails, so does the reveal.
 */
 const revealField = async (deps, entry, session, request) => {
 	const access = await requestAccess(deps, entry, session);
 	requireOperation(access, "read");
 	const name = typeof request.field === "string" ? request.field : "";
+	const computed = await computedRevealFor(access, name);
+	if (computed) return revealComputed(access, computed, request, name);
 	const field = Object.hasOwn(access.readable.fields, name) ? access.readable.fields[name] : void 0;
 	if (!field) throw badRequest("invalid-parameter", `Unknown field "${name}"`);
 	if (!field.sensitive) throw badRequest("invalid-parameter", `"${name}" is not sensitive; it comes with the record`);
@@ -33,25 +94,13 @@ const revealField = async (deps, entry, session, request) => {
 	const keyFields = [...full.primaryKey, ...tenantField].map((part) => full.fields[part]);
 	const found = await readTransaction(deps.db, deps.statementTimeoutMs, (trx) => fetchReadable(trx, access, request.key, "hide", { fields: [...keyFields, full.fields[name]] }));
 	if (!found) throw notFound(`No ${entry.name} with this key`);
+	if (field.strongSignIn) await requireStrongSignIn(session, field.strongSignIn.minutes);
 	const value = revealedValue(deps, access.full, full.fields[name], found.record);
-	const tenant = tenantScope(entry, session)?.tenantValue;
-	await deps.audit.publish({
-		type: "field.revealed",
-		at: (/* @__PURE__ */ new Date()).toISOString(),
-		actor: {
-			id: session.user.id,
-			roles: [...session.user.roles]
-		},
-		...tenant !== void 0 && { tenant },
-		resource: entry.name,
-		recordKey: encodeKey(request.key),
-		field: name,
-		origin: request.origin
-	});
+	await publishReveal(deps, entry, session, request, name);
 	return {
 		field: name,
 		value
 	};
 };
 //#endregion
-export { revealField };
+export { revealField, strongSignInRequired };

package/dist/types.d.ts

@@ -38,11 +38,13 @@ export type Session = {
   /**
    * The user's own sign-in this request comes with: its session id, when it has one, and whether staff started it as
    * the user. An authenticator sets it only when it knows; without it, what only the user may do, such as registering
-   * their devices for notifications, is refused.
+   * their devices for notifications, is refused. `strongAt` reads when the sign-in last proved a passkey or a second
+   * step, `undefined` when it never did; without it, a reveal that needs a recent strong sign-in is refused.
    */
   signIn?: {
     session?: string;
     staff: boolean;
+    strongAt?: () => Promise<Date | undefined>;
   };
 };
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.46.7",
+  "version": "0.46.9",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.46.7",
-    "@protobase/query": "0.46.7",
-    "@protobase/schema": "0.46.7",
+    "@protobase/layout": "0.46.9",
+    "@protobase/query": "0.46.9",
+    "@protobase/schema": "0.46.9",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",