@protobase/server 0.47.1 → 0.49.0

package/dist/better-auth/auth-settings.js

@@ -0,0 +1,43 @@
+import { buildAuth } from "./create-auth.js";
+import { PostgresDialect } from "kysely";
+//#region src/better-auth/auth-settings.ts
+const organizationOptions = (organizations, hooks, app) => {
+	if (!organizations) return void 0;
+	const own = hooks.organizationHooks ?? {};
+	const betterAuthHooks = Object.fromEntries(Object.entries(own).map(([name, hook]) => [name, (input) => hook(input, app)]));
+	return {
+		...organizations === true ? {} : organizations,
+		...hooks.generateOrganizationId && { generateId: () => hooks.generateOrganizationId(app) },
+		...hooks.onOrganizationCreated && { onCreated: (input) => hooks.onOrganizationCreated(input, app) },
+		...hooks.beforeOrganizationDeleted && { beforeDelete: (organization) => hooks.beforeOrganizationDeleted(organization, app) },
+		...Object.keys(betterAuthHooks).length > 0 && { hooks: betterAuthHooks }
+	};
+};
+/** createAuth's options for the `auth` settings, the store in the app's own database. */
+const appAuthOptions = (settings, { pool, db, hooks = {}, mailer }) => {
+	const { schema = "auth", secret, generateUserId, mailer: mail, organizations, mcp, ...rest } = settings;
+	if (!secret) throw new Error("the auth secret is not set: give it the app's secret, PROTOBASE_SECRET, made with `openssl rand -base64 32`");
+	const app = { db };
+	const organizationsOptions = organizationOptions(organizations, hooks, app);
+	const userId = hooks.generateUserId ? () => hooks.generateUserId(app) : generateUserId;
+	const onUserCreated = hooks.onUserCreated && ((user, context) => hooks.onUserCreated(user, context, app));
+	return {
+		...rest,
+		database: {
+			dialect: new PostgresDialect({ pool }),
+			type: "postgres",
+			schemaName: schema,
+			transaction: true
+		},
+		secret,
+		...userId && { generateUserId: userId },
+		...onUserCreated && { onUserCreated },
+		...mail === false ? { mailer: false } : mailer && { mailer },
+		...organizationsOptions && { organizations: organizationsOptions },
+		...mcp && { mcp }
+	};
+};
+/** The app's Better Auth from its `auth` settings, built at serve time with only the plugins they turn on. */
+const buildAppAuth = (settings, input) => buildAuth(appAuthOptions(settings, input));
+//#endregion
+export { appAuthOptions, buildAppAuth };

package/dist/better-auth/auth-tables.d.ts

@@ -1,6 +1,6 @@
 import { AdminAuth } from "./create-auth.js";
 //#region src/better-auth/auth-tables.d.ts
-/** The admin store's tables with every plugin the project's auth has, which the assistant's queries must never read. */
+/** The admin store's tables, which the assistant's queries and the app's resources must never read: the user table and `storeTableNames`. */
 export declare const authStoreTables: (auth: AdminAuth) => {
   schema: string | undefined;
   name: string;

package/dist/better-auth/auth-tables.js

@@ -1,11 +1,13 @@
-import { getSchema } from "better-auth/db";
+import { storeNames } from "./store/store-names.js";
+import { storeTableNames } from "./store/table-names.js";
 //#region src/better-auth/auth-tables.ts
-/** The schema the admin store lives in; the search path decides when its options name none. */
-const storeSchema = ({ options: { database } }) => database && "schemaName" in database ? database.schemaName : void 0;
-/** The admin store's tables with every plugin the project's auth has, which the assistant's queries must never read. */
-const authStoreTables = (auth) => Object.keys(getSchema(auth.options)).map((name) => ({
-	schema: storeSchema(auth),
-	name
-}));
+/** The admin store's tables, which the assistant's queries and the app's resources must never read: the user table and `storeTableNames`. */
+const authStoreTables = (auth) => {
+	const { schema, users } = storeNames(auth);
+	return [users.modelName, ...storeTableNames].map((name) => ({
+		schema,
+		name
+	}));
+};
 //#endregion
-export { authStoreTables, storeSchema };
+export { authStoreTables };

package/dist/better-auth/authenticate-settings.d.ts

@@ -0,0 +1,15 @@
+import { TenantValue } from "../types.js";
+import { BetterAuthAuthenticator, BetterAuthAuthenticatorOptions } from "./authenticator.js";
+import { AdminAuth } from "./create-auth.js";
+//#region src/better-auth/authenticate-settings.d.ts
+/**
+ * `authenticate` in `protobase.config.ts`: how the API verifies the app's tokens, as data. Without it, the tokens of
+ * the app's own `auth`; `jwksUrl` and `issuer` verify those of an auth server elsewhere instead.
+ */
+export type AuthenticateSettings = Omit<BetterAuthAuthenticatorOptions, 'auth' | 'tenant'> & {
+  /** The one tenant everyone works in, for an app without organizations; never read from the token. */
+  tenant?: TenantValue;
+};
+/** The authenticator of the `authenticate` settings, over the app's Better Auth when it has one. */
+export declare const buildAuthenticator: (settings?: AuthenticateSettings, auth?: AdminAuth) => BetterAuthAuthenticator;
+//#endregion

package/dist/better-auth/authenticate-settings.js

@@ -0,0 +1,12 @@
+import { betterAuthAuthenticator } from "./authenticator.js";
+//#region src/better-auth/authenticate-settings.ts
+/** The authenticator of the `authenticate` settings, over the app's Better Auth when it has one. */
+const buildAuthenticator = (settings = {}, auth) => {
+	if (!auth && !settings.jwksUrl) throw new Error("No authenticator: give the config `auth`, or `authenticate.jwksUrl` and `issuer` for an auth server elsewhere; see https://docs.protobase.net/reference/auth/");
+	return betterAuthAuthenticator({
+		...settings,
+		...auth && { auth }
+	});
+};
+//#endregion
+export { buildAuthenticator };

package/dist/better-auth/authenticator.d.ts

@@ -1,8 +1,8 @@
-import { AdminAuth } from "./create-auth.js";
 import { Authenticator, TenantValue } from "../types.js";
 import { JwtVerifyOptions } from "../auth/jwt.js";
 import { TrustedApp } from "./app-tokens.js";
 import { JwksCacheOptions } from "./jwks-cache.js";
+import { AdminAuth } from "./create-auth.js";
 //#region src/better-auth/authenticator.d.ts
 export type BetterAuthAuthenticatorOptions = {
   /** The Better Auth instance of this process: keys are read from it directly, no HTTP round trip. */

package/dist/better-auth/create-auth.d.ts

@@ -1,21 +1,23 @@
+import { UserColumn, UserTableOptions } from "./user-table.js";
+import { Mailer } from "../mail/smtp-mailer.js";
+import { SignInPolicy } from "./sign-in-policy.js";
 import { StaffSignIn } from "./staff-log.js";
 import { RoleDefinitions, RolesInput } from "./organizations/role-definitions.js";
 import { ConnectedApp } from "./mcp/connected-apps.js";
 import { ReplacingContext } from "./end-replaced-session.js";
 import { UserDeletionListener } from "./user-deletion.js";
-import "./auth-base-path.js";
-import { Mailer } from "../mail/smtp-mailer.js";
-import { OperatorProvider } from "./operator-provider.js";
 import { OrganizationRole } from "./organizations/store.js";
-import { SignInPolicy } from "./sign-in-policy.js";
-import { McpAuthOptions } from "./mcp/mcp-plugins.js";
 import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/options.js";
+import { McpAuthOptions } from "./mcp/mcp-plugins.js";
+import { OperatorProvider } from "./operator-provider.js";
 import { PlatformSignIn } from "./platform-sign-in.js";
+import "../index.js";
+import "./auth-base-path.js";
+import { mcpAuthPlugins } from "./mcp/mcp-auth-plugins.js";
 import { SsoOptions } from "./saml-sign-in.js";
+import { samlPlugin } from "./saml-plugin.js";
 import { signUpPaths } from "./sign-up/sign-up-plugin.js";
 import { PasswordHash } from "./password-hashes.js";
-import { UserTableOptions } from "./user-table.js";
-import "../index.js";
 import { BetterAuthOptions } from "better-auth";
 import { JwtOptions } from "better-auth/plugins";
 //#region src/better-auth/create-auth.d.ts
@@ -169,7 +171,17 @@ export type UserCreatedHook = NonNullable<UserCreateHooks['after']>;
  */
 /** The configured roles with `admin` first; `admin` is added when missing. */
 export declare const normalizeRoles: (roles?: RolesInput) => string[];
-export declare const createAuth: (options: CreateAuthOptions) => import("better-auth").Auth<{
+/**
+ * The plugins only some apps use, which `loadAuthPlugins` imports when the options turn them on: the SSO plugin of
+ * `sso.saml` and the OAuth provider of `mcp`.
+ */
+export type AuthPlugins = {
+  samlPlugin?: typeof samlPlugin;
+  mcpAuthPlugins?: typeof mcpAuthPlugins;
+};
+/** The optional plugins `options` turns on, imported: an app without SAML or MCP loads neither. */
+export declare const loadAuthPlugins: (options: Pick<CreateAuthOptions, "sso" | "mcp">) => Promise<AuthPlugins>;
+export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlugins) => import("better-auth").Auth<{
   user: {
     modelName: string;
     fields: {
@@ -473,9 +485,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?
-              /** Sign-in attempts allowed per minute and client, default 5; also the sign-up requests allowed. */
-              /** Sign-in attempts allowed per minute and client, default 5; also the sign-up requests allowed. */ : string | null | undefined;
+              userAgent?: string | null | undefined;
             };
           };
         }>>[];
@@ -8752,9 +8762,6 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     };
   };
   advanced: {
-    database?: {
-      generateId: "uuid";
-    } | undefined;
     useSecureCookies: boolean;
     cookiePrefix: string;
     defaultCookieAttributes: {
@@ -8764,6 +8771,10 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     backgroundTasks: {
       handler: () => void;
     };
+    database: {
+      generateId?: "uuid" | undefined;
+      validateSchema: false;
+    };
   };
   socialProviders?: import("better-auth").SocialProviders | undefined;
   appName: string;
@@ -8839,6 +8850,13 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   signUpRole: string | undefined;
   /** The app keeps each user's metadata, in the column `users.metadata` names. */
   userMetadata: boolean;
+  /** The user table's name and columns, as `users` names them, for the store's migrations. */
+  userTable: {
+    modelName: string;
+    column: (name: UserColumn) => string;
+    fieldNames: Record<string, string>;
+    metadata: string | undefined;
+  };
   socialProviders: string[];
   /** The app's name it signs in and mails as: `PROTOBASE_APP_NAME`, else `appName`, else `Protobase`. */
   appName: string;
@@ -8860,4 +8878,6 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   } | undefined;
 };
 export type AdminAuth = ReturnType<typeof createAuth>;
+/** `createAuth` with the optional plugins its options turn on loaded first (see `loadAuthPlugins`). */
+export declare const buildAuth: (options: CreateAuthOptions) => Promise<AdminAuth>;
 //#endregion

package/dist/better-auth/create-auth.js

@@ -20,27 +20,27 @@ import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
 import { leakedPasswordsPlugin } from "./leaked-passwords.js";
 import { userDeletion } from "./user-deletion.js";
 import { revokeMcpGrants } from "./mcp/revoke-grants.js";
-import { coreNames, pluginNames } from "./snake-case-names.js";
+import { mcpUnusedPaths, resolveMcp } from "./mcp/mcp-plugins.js";
 import { lastOrganizationField, sessionOrganizationHooks } from "./organizations/session-organization.js";
-import { tokenClaims } from "./token-claims.js";
-import { mcpAuthPlugins, mcpUnusedPaths, resolveMcp } from "./mcp/mcp-plugins.js";
 import { organizationPlugin } from "./organizations/organization-plugin.js";
 import { protobaseOrganizationPlugin } from "./organizations/protobase-plugin.js";
 import { resolveOrganizations } from "./organizations/options.js";
 import { passkeyHosts, readPasskeyDomain, resolvePasskeyDomain } from "./passkey-domain.js";
+import { coreNames, pluginNames } from "./snake-case-names.js";
 import { passkeyPlugin } from "./passkey-plugin.js";
 import { passwordResetOptions } from "./password-reset.js";
 import { rolesPlugin } from "./roles/roles-plugin.js";
 import { platformSignInFor, platformSignInProvider, readPlatformSignIn, resolvePlatformSignIn } from "./platform-sign-in.js";
 import { appSignInPolicy } from "./app-sign-in-policy.js";
 import { assertNoEndpointKeyClashes } from "./endpoint-key-clashes.js";
-import { emailInDomains, resolveSamlProviders, samlDisabledPaths, samlGuardPlugin, samlPlugin } from "./saml-sign-in.js";
+import { emailInDomains, resolveSamlProviders, samlDisabledPaths, samlGuardPlugin } from "./saml-sign-in.js";
 import { noAccountMailPlugin } from "./no-account-mail.js";
 import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
 import { confirmedOnCreate, confirmedOnUpdate, emailConfirmedField } from "./email-confirmed.js";
 import { rehashPasswordsPlugin, verifyAcceptedHash } from "./password-hashes.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
 import { strongSignInsPlugin } from "./strong-sign-ins.js";
+import { tokenClaims } from "./token-claims.js";
 import { twoFactorAfterPasswordOrCode } from "./two-factor-challenge.js";
 import { metadataField, userFieldsNamed, userModel, userTable, withUserColumns } from "./user-table.js";
 import { usersPlugin } from "./users/users-plugin.js";
@@ -70,6 +70,15 @@ const tokenLifetime = "15m";
 /** The configured roles with `admin` first; `admin` is added when missing. */
 const normalizeRoles = (roles) => roleDefinitions(roles).names;
 const adminImpersonationPaths = ["/admin/impersonate-user", "/admin/stop-impersonating"];
+/** The optional plugins `options` turns on, imported: an app without SAML or MCP loads neither. */
+const loadAuthPlugins = async (options) => ({
+	...(options.sso?.saml.length ?? 0) > 0 && { samlPlugin: (await import("./saml-plugin.js")).samlPlugin },
+	...options.mcp && { mcpAuthPlugins: (await import("./mcp/mcp-auth-plugins.js")).mcpAuthPlugins }
+});
+const loaded = (plugin, option) => {
+	if (!plugin) throw new Error(`${option} needs its plugin loaded: build auth with buildAuth, which loads it`);
+	return plugin;
+};
 const newUserId = (generate) => generate === "uuid" ? crypto.randomUUID() : generate();
 const noContext = () => Promise.reject(/* @__PURE__ */ new Error("The auth context is read only once createAuth has made the instance"));
 const organizationPaths = ["/organization/set-active", "/organization/accept-invitation"];
@@ -77,7 +86,7 @@ const organizationPaths = ["/organization/set-active", "/organization/accept-inv
 * The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
 * sign-in provider already resolved.
 */
-const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, appName = defaultAppName, mailer, signUpRole, operator, platformSignIn, saml = [], organizations, mcp, context = noContext, signInPolicy = defaultSignInPolicy, mobile, deletion }) => {
+const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, appName = defaultAppName, mailer, signUpRole, operator, platformSignIn, saml = [], organizations, mcp, context = noContext, signInPolicy = defaultSignInPolicy, mobile, deletion, ...plugins }) => {
 	const secure = options.baseURL.startsWith("https://");
 	const signIn = platformSignInFor(platformSignIn, Object.keys(options.socialProviders ?? {}));
 	const hosts = passkeyHosts([options.baseURL, ...origins]);
@@ -185,7 +194,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				defaultPolicy: signInPolicy
 			})] : [],
 			...signIn ? [genericOAuth({ config: [platformSignInProvider(signIn)] })] : [],
-			...saml.length > 0 ? [samlPlugin(saml, options.baseURL), samlGuardPlugin(samlIds)] : [],
+			...saml.length > 0 ? [loaded(plugins.samlPlugin, "sso.saml")(saml, options.baseURL), samlGuardPlugin(samlIds)] : [],
 			signInPolicyPlugin(policy),
 			setPasswordPlugin(),
 			...options.leakedPasswords ? [leakedPasswordsPlugin()] : [],
@@ -220,7 +229,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				...organizations && { organizations }
 			}),
 			...passwordHashes.length > 0 ? [rehashPasswordsPlugin(passwordHashes)] : [],
-			...mcp ? mcpAuthPlugins({
+			...mcp ? loaded(plugins.mcpAuthPlugins, "mcp")({
 				mcp,
 				organizations: Boolean(organizations),
 				mail: Boolean(mailer),
@@ -306,7 +315,10 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				secure
 			},
 			backgroundTasks: { handler: () => {} },
-			...options.generateUserId === "uuid" && { database: { generateId: "uuid" } }
+			database: {
+				validateSchema: false,
+				...options.generateUserId === "uuid" && { generateId: "uuid" }
+			}
 		}
 	};
 };
@@ -315,7 +327,7 @@ const checkSignUpRole = (role, roles) => {
 	if (!roles.includes(role)) throw new Error(`signUp.role "${role}" is not one of the roles: ${roles.join(", ")}`);
 	return role;
 };
-const createAuth = (options) => {
+const createAuth = (options, plugins = {}) => {
 	if (options.signUp && options.organizations) throw new Error("signUp is not available with organizations: their people join by invitation");
 	const definitions = roleDefinitions(options.roles, { organizations: options.organizations !== void 0 });
 	const roles = definitions.names;
@@ -341,6 +353,7 @@ const createAuth = (options) => {
 	const mobile = mobileRequests();
 	const deletion = userDeletion();
 	const authOptions = betterAuthOptions(options, {
+		...plugins,
 		mobile,
 		deletion,
 		origins,
@@ -402,6 +415,8 @@ const createAuth = (options) => {
 		signUpRole: mailer ? signUpRole : void 0,
 		/** The app keeps each user's metadata, in the column `users.metadata` names. */
 		userMetadata: Boolean(options.users?.metadata),
+		/** The user table's name and columns, as `users` names them, for the store's migrations. */
+		userTable: userTable(options.users),
 		socialProviders,
 		/** The app's name it signs in and mails as: `PROTOBASE_APP_NAME`, else `appName`, else `Protobase`. */
 		appName: appName ?? "Protobase",
@@ -423,5 +438,7 @@ const createAuth = (options) => {
 		}
 	});
 };
+/** `createAuth` with the optional plugins its options turn on loaded first (see `loadAuthPlugins`). */
+const buildAuth = async (options) => createAuth(options, await loadAuthPlugins(options));
 //#endregion
-export { authBasePath, betterAuthOptions, createAuth, normalizeRoles };
+export { authBasePath, betterAuthOptions, buildAuth, createAuth, loadAuthPlugins, normalizeRoles };