@protobase/server 0.46.8 → 0.46.9

package/dist/better-auth/create-auth.d.ts

@@ -2593,6 +2593,18 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       RESOLVED_USER_INVALID: import("better-auth").RawError<"RESOLVED_USER_INVALID">;
     };
     options: import("@better-auth/passkey").PasskeyOptions | undefined;
+  } | {
+    id: "protobase-strong-sign-ins";
+    hooks: {
+      before: {
+        matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+      after: {
+        matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "email-otp";
     version: string;

package/dist/better-auth/create-auth.js

@@ -38,6 +38,7 @@ import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./
 import { confirmedOnCreate, confirmedOnUpdate, emailConfirmedField } from "./email-confirmed.js";
 import { rehashPasswordsPlugin, verifyAcceptedHash } from "./password-hashes.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
+import { strongSignInsPlugin } from "./strong-sign-ins.js";
 import { twoFactorAfterPasswordOrCode } from "./two-factor-challenge.js";
 import { metadataField, userFieldsNamed, userModel, userTable, withUserColumns } from "./user-table.js";
 import { usersPlugin } from "./users/users-plugin.js";
@@ -173,6 +174,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				formerDomain: hosts[0],
 				origins: appOrigins(options.baseURL, origins)
 			}),
+			strongSignInsPlugin(),
 			...mail ? [emailOTP(emailCodeOptions(mail)), noAccountMailPlugin(mail)] : [],
 			...mail && signUpRole ? [signUpPlugin({
 				role: signUpRole,

package/dist/better-auth/strong-sign-ins.js

@@ -0,0 +1,64 @@
+import { isStaffSession } from "./staff-checks.js";
+import { APIError, createAuthMiddleware, getSessionFromCtx } from "better-auth/api";
+//#region src/better-auth/strong-sign-ins.ts
+const twoFactorPaths = [
+	"/two-factor/verify-totp",
+	"/two-factor/verify-otp",
+	"/two-factor/verify-backup-code"
+];
+/**
+* The Better Auth endpoints that prove a passkey or a second step: each signs in a new session, or confirms the one the
+* request's cookie names, as the second step does for someone signed in already.
+*/
+const strongSignInPaths = ["/passkey/verify-authentication", ...twoFactorPaths];
+const identifierOf = (sessionId) => `protobase-strong-sign-in-${sessionId}`;
+/** Notes that the session proved a passkey or a second step now; the note ends with the session. */
+const saveStrongSignIn = async (internal, session, now = /* @__PURE__ */ new Date()) => {
+	const identifier = identifierOf(session.id);
+	await internal.deleteVerificationByIdentifier(identifier);
+	await internal.createVerificationValue({
+		identifier,
+		value: now.toISOString(),
+		expiresAt: session.expiresAt
+	});
+};
+/** When the session last proved a passkey or a second step, if it did and its note has not expired. */
+const strongSignInAt = async (internal, sessionId, now = /* @__PURE__ */ new Date()) => {
+	const found = await internal.findVerificationValue(identifierOf(sessionId));
+	if (!found || new Date(found.expiresAt) <= now) return void 0;
+	return new Date(found.value);
+};
+/**
+* Records the sessions that sign in, or confirm, with a passkey or a second step, since Better Auth's sessions do not
+* say how they began: a reveal that asks for a recent strong sign-in reads it (`strongSignInAt`). The session is the
+* one the answer signed in, or else the one the request's cookie names. A staff session is never recorded: staff
+* proved nothing as the person. Nor is the code that turns two-factor authentication on, which a session alone may
+* ask for on an account without a password: it proves the authenticator app just added, not the person.
+*/
+const strongSignInsPlugin = () => {
+	const turningOn = /* @__PURE__ */ new WeakSet();
+	return {
+		id: "protobase-strong-sign-ins",
+		hooks: {
+			before: [{
+				matcher: (context) => context.path !== void 0 && twoFactorPaths.includes(context.path),
+				handler: createAuthMiddleware(async (ctx) => {
+					const signedIn = await getSessionFromCtx(ctx);
+					if (signedIn && !signedIn.user.twoFactorEnabled && ctx.headers) turningOn.add(ctx.headers);
+				})
+			}],
+			after: [{
+				matcher: (context) => context.path !== void 0 && strongSignInPaths.includes(context.path),
+				handler: createAuthMiddleware(async (ctx) => {
+					if (ctx.context.returned instanceof APIError) return;
+					if (ctx.headers && turningOn.has(ctx.headers)) return;
+					const session = ctx.context.newSession?.session ?? (await getSessionFromCtx(ctx))?.session;
+					if (!session || isStaffSession(session)) return;
+					await saveStrongSignIn(ctx.context.internalAdapter, session);
+				})
+			}]
+		}
+	};
+};
+//#endregion
+export { saveStrongSignIn, strongSignInAt, strongSignInPaths, strongSignInsPlugin };

package/dist/better-auth/token-standing.js

@@ -4,6 +4,7 @@ import { parseRoles } from "./parse-roles.js";
 import { effectiveRoles, globalRoles } from "./organizations/app-roles.js";
 import { findMember, findOrganization } from "./organizations/store.js";
 import { isStaffSession } from "./staff-checks.js";
+import { strongSignInAt } from "./strong-sign-ins.js";
 //#region src/better-auth/token-standing.ts
 /**
 * The sign-in a session row stands for: staff started it when the admin plugin's `impersonatedBy` names someone. A row
@@ -53,7 +54,8 @@ const checkUserStanding = async (context, claims, organizations, now = /* @__PUR
 * Whether a token still stands, read from the store on every request: its session is not signed out or expired, and
 * its user still stands (`checkUserStanding`). A token that fails is a 401, so the client asks its session for a new
 * one, which carries the roles as they are now or is refused. Answers the sign-in the token's session stands for
-* (`signInOf`), `undefined` for a token without one.
+* (`signInOf`), `undefined` for a token without one; the user's own one also reads, when asked, when it last proved a
+* passkey or a second step (`strongSignInAt`).
 */
 const checkTokenStanding = async (context, claims, organizations, now = /* @__PURE__ */ new Date()) => {
 	const session = claims.sessionId === void 0 ? void 0 : await context.adapter.findOne({
@@ -65,7 +67,12 @@ const checkTokenStanding = async (context, claims, organizations, now = /* @__PU
 	});
 	if (claims.sessionId !== void 0 && (!session || session.userId !== claims.userId || session.expiresAt <= now)) throw revoked();
 	await checkUserStanding(context, claims, organizations, now);
-	return session ? signInOf(session, claims.sessionId) : void 0;
+	const signIn = session ? signInOf(session, claims.sessionId) : void 0;
+	if (!signIn || signIn.staff) return signIn;
+	return {
+		...signIn,
+		strongAt: () => strongSignInAt(context.internalAdapter, claims.sessionId)
+	};
 };
 //#endregion
 export { checkTokenStanding, checkUserStanding, signInOf, tokenClaims };

package/dist/openapi/resource-paths.js

@@ -192,7 +192,7 @@ const resourcePaths = (access) => {
 		...auth,
 		404: error("NotFound")
 	};
-	const sensitive = Object.values(access.readable.fields).filter((field) => field.sensitive).map((field) => field.name);
+	const sensitive = [...Object.values(access.readable.fields).filter((field) => field.sensitive).map((field) => field.name), ...Object.keys(entry.source.computedReveals ?? {})];
 	const aiActions = (pickView(access.deps.views, access.session.user.roles, entry.name)?.actions ?? []).filter((action) => action.run?.kind === "ai").map((action) => action.name);
 	const paths = {
 		[`/${entry.name}`]: {
@@ -330,7 +330,7 @@ const resourcePaths = (access) => {
 			operationId: `reveal_${entry.name}`,
 			tags: tag,
 			summary: `Reveal a sensitive field of a ${entry.name} record`,
-			description: "A sensitive field never comes with the record. This returns its value for one record, with the same access as a get, and publishes an audit event first.",
+			description: "A sensitive field never comes with the record. This returns its value for one record, or makes the value of a computed reveal, with the same access as a get, and publishes an audit event first. A field that needs a recent strong sign-in is a 403 `strong-sign-in-required` until the caller confirms it's them with a passkey or a second step.",
 			parameters: [param("key")],
 			requestBody: {
 				required: true,
@@ -356,7 +356,8 @@ const resourcePaths = (access) => {
 						}
 					})
 				},
-				...keyErrors
+				...keyErrors,
+				403: error("Forbidden")
 			}
 		} } },
 		...aiActions.length > 0 && { [`/${entry.name}/{key}:generate`]: { post: {

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.46.8";
+var version = "0.46.9";
 //#endregion
 export { version };

package/dist/resource-source.d.ts

@@ -1,7 +1,7 @@
 import { SubscriptionDefinition } from "./webhooks/subscription.js";
 import "./index.js";
 import { PageDefinition } from "@protobase/layout";
-import { AccessSource, BottomBarSource, EventMatch, FileProcessor, UserMenuSource, ViewModel } from "@protobase/schema";
+import { AccessSource, BottomBarSource, ComputedReveal, EventMatch, FileProcessor, UserMenuSource, ViewModel } from "@protobase/schema";
 import { z } from "zod";
 //#region src/resource-source.d.ts
 type FieldSource = {
@@ -24,6 +24,8 @@ export type ResourceSource = AccessSource & {
     message: string;
   }> | undefined)[];
   recordSchema(): z.ZodType;
+  /** Its values revealed like sensitive fields but computed when asked (`.reveals()`), by name. */
+  readonly computedReveals?: Readonly<Record<string, ComputedReveal<any>>>;
   /** The code predicates of its events, by event name. */
   eventMatches?(): Record<string, EventMatch<any>>;
 };

package/dist/reveal-service.js

@@ -1,4 +1,4 @@
-import { badRequest, notFound } from "./problem.js";
+import { HttpProblem, badRequest, notFound } from "./problem.js";
 import { tenantScope } from "./tenant.js";
 import { requestAccess, requireOperation } from "./request-access.js";
 import { readTransaction } from "./transactions.js";
@@ -16,15 +16,76 @@ const revealedValue = (deps, model, field, record) => {
 		field: field.name
 	});
 };
+/** The refusal of a reveal that needs a strong sign-in more recent than the caller's, which the app answers by asking them to confirm it's them. */
+const strongSignInRequired = (minutes) => new HttpProblem(403, "strong-sign-in-required", "Forbidden", `Confirm it's you with a passkey or a second step: this needs one in the last ${minutes} minutes.`, { minutes });
+const requireStrongSignIn = async (session, minutes, now = /* @__PURE__ */ new Date()) => {
+	const at = session.signIn && !session.signIn.staff && !session.client ? await session.signIn.strongAt?.() : void 0;
+	if (at && now.getTime() - at.getTime() <= minutes * 6e4) return;
+	throw strongSignInRequired(minutes);
+};
+const computedRevealFor = async (access, name) => {
+	const reveals = access.entry.source.computedReveals ?? {};
+	const reveal = Object.hasOwn(reveals, name) ? reveals[name] : void 0;
+	if (!reveal?.read) return reveal;
+	const { session } = access;
+	return await reveal.read({
+		user: {
+			id: session.user.id,
+			roles: session.user.roles
+		},
+		operation: "read",
+		model: access.full,
+		...session.organization && { organization: session.organization }
+	}) === true ? reveal : void 0;
+};
+const publishReveal = async (deps, entry, session, request, field) => {
+	const tenant = tenantScope(entry, session)?.tenantValue;
+	await deps.audit.publish({
+		type: "field.revealed",
+		at: (/* @__PURE__ */ new Date()).toISOString(),
+		actor: {
+			id: session.user.id,
+			roles: [...session.user.roles]
+		},
+		...tenant !== void 0 && { tenant },
+		resource: entry.name,
+		recordKey: encodeKey(request.key),
+		field,
+		origin: request.origin
+	});
+};
+const revealComputed = async (access, reveal, request, name) => {
+	const { deps, entry, session } = access;
+	const fields = Object.values(access.model.fields);
+	const found = await readTransaction(deps.db, deps.statementTimeoutMs, (trx) => fetchReadable(trx, access, request.key, "hide", { fields }));
+	if (!found) throw notFound(`No ${entry.name} with this key`);
+	if (reveal.strongSignIn) await requireStrongSignIn(session, reveal.strongSignIn.minutes ?? 15);
+	const record = Object.fromEntries(fields.map((field) => [field.name, found.record[field.name] ?? null]));
+	const value = await reveal.value(record, {
+		user: {
+			id: session.user.id,
+			roles: session.user.roles
+		},
+		...session.organization && { organization: session.organization }
+	});
+	await publishReveal(deps, entry, session, request, name);
+	return {
+		field: name,
+		value: value ?? null
+	};
+};
 /**
-* The value of one sensitive field of one record, for a caller who may read the record and the field: the same tenant,
-* row filter and record-level rule as a get. The reveal is published to the audit queue before the value is returned;
-* when publishing fails, so does the reveal.
+* The value of one sensitive field of one record, or of one of its computed reveals (`.reveals()`), for a caller who may
+* read the record and the field: the same tenant, row filter and record-level rule as a get. A field or reveal that
+* needs a recent strong sign-in is refused without one (`strongSignInRequired`). The reveal is published to the audit
+* queue before the value is returned; when publishing fails, so does the reveal.
 */
 const revealField = async (deps, entry, session, request) => {
 	const access = await requestAccess(deps, entry, session);
 	requireOperation(access, "read");
 	const name = typeof request.field === "string" ? request.field : "";
+	const computed = await computedRevealFor(access, name);
+	if (computed) return revealComputed(access, computed, request, name);
 	const field = Object.hasOwn(access.readable.fields, name) ? access.readable.fields[name] : void 0;
 	if (!field) throw badRequest("invalid-parameter", `Unknown field "${name}"`);
 	if (!field.sensitive) throw badRequest("invalid-parameter", `"${name}" is not sensitive; it comes with the record`);
@@ -33,25 +94,13 @@ const revealField = async (deps, entry, session, request) => {
 	const keyFields = [...full.primaryKey, ...tenantField].map((part) => full.fields[part]);
 	const found = await readTransaction(deps.db, deps.statementTimeoutMs, (trx) => fetchReadable(trx, access, request.key, "hide", { fields: [...keyFields, full.fields[name]] }));
 	if (!found) throw notFound(`No ${entry.name} with this key`);
+	if (field.strongSignIn) await requireStrongSignIn(session, field.strongSignIn.minutes);
 	const value = revealedValue(deps, access.full, full.fields[name], found.record);
-	const tenant = tenantScope(entry, session)?.tenantValue;
-	await deps.audit.publish({
-		type: "field.revealed",
-		at: (/* @__PURE__ */ new Date()).toISOString(),
-		actor: {
-			id: session.user.id,
-			roles: [...session.user.roles]
-		},
-		...tenant !== void 0 && { tenant },
-		resource: entry.name,
-		recordKey: encodeKey(request.key),
-		field: name,
-		origin: request.origin
-	});
+	await publishReveal(deps, entry, session, request, name);
 	return {
 		field: name,
 		value
 	};
 };
 //#endregion
-export { revealField };
+export { revealField, strongSignInRequired };

package/dist/types.d.ts

@@ -38,11 +38,13 @@ export type Session = {
   /**
    * The user's own sign-in this request comes with: its session id, when it has one, and whether staff started it as
    * the user. An authenticator sets it only when it knows; without it, what only the user may do, such as registering
-   * their devices for notifications, is refused.
+   * their devices for notifications, is refused. `strongAt` reads when the sign-in last proved a passkey or a second
+   * step, `undefined` when it never did; without it, a reveal that needs a recent strong sign-in is refused.
    */
   signIn?: {
     session?: string;
     staff: boolean;
+    strongAt?: () => Promise<Date | undefined>;
   };
 };
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.46.8",
+  "version": "0.46.9",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.46.8",
-    "@protobase/query": "0.46.8",
-    "@protobase/schema": "0.46.8",
+    "@protobase/layout": "0.46.9",
+    "@protobase/query": "0.46.9",
+    "@protobase/schema": "0.46.9",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",