@protobase/server 0.48.0 → 0.49.1

package/dist/better-auth/auth-settings.js

@@ -0,0 +1,43 @@
+import { buildAuth } from "./create-auth.js";
+import { PostgresDialect } from "kysely";
+//#region src/better-auth/auth-settings.ts
+const organizationOptions = (organizations, hooks, app) => {
+	if (!organizations) return void 0;
+	const own = hooks.organizationHooks ?? {};
+	const betterAuthHooks = Object.fromEntries(Object.entries(own).map(([name, hook]) => [name, (input) => hook(input, app)]));
+	return {
+		...organizations === true ? {} : organizations,
+		...hooks.generateOrganizationId && { generateId: () => hooks.generateOrganizationId(app) },
+		...hooks.onOrganizationCreated && { onCreated: (input) => hooks.onOrganizationCreated(input, app) },
+		...hooks.beforeOrganizationDeleted && { beforeDelete: (organization) => hooks.beforeOrganizationDeleted(organization, app) },
+		...Object.keys(betterAuthHooks).length > 0 && { hooks: betterAuthHooks }
+	};
+};
+/** createAuth's options for the `auth` settings, the store in the app's own database. */
+const appAuthOptions = (settings, { pool, db, hooks = {}, mailer }) => {
+	const { schema = "auth", secret, generateUserId, mailer: mail, organizations, mcp, ...rest } = settings;
+	if (!secret) throw new Error("the auth secret is not set: give it the app's secret, PROTOBASE_SECRET, made with `openssl rand -base64 32`");
+	const app = { db };
+	const organizationsOptions = organizationOptions(organizations, hooks, app);
+	const userId = hooks.generateUserId ? () => hooks.generateUserId(app) : generateUserId;
+	const onUserCreated = hooks.onUserCreated && ((user, context) => hooks.onUserCreated(user, context, app));
+	return {
+		...rest,
+		database: {
+			dialect: new PostgresDialect({ pool }),
+			type: "postgres",
+			schemaName: schema,
+			transaction: true
+		},
+		secret,
+		...userId && { generateUserId: userId },
+		...onUserCreated && { onUserCreated },
+		...mail === false ? { mailer: false } : mailer && { mailer },
+		...organizationsOptions && { organizations: organizationsOptions },
+		...mcp && { mcp }
+	};
+};
+/** The app's Better Auth from its `auth` settings, built at serve time with only the plugins they turn on. */
+const buildAppAuth = (settings, input) => buildAuth(appAuthOptions(settings, input));
+//#endregion
+export { appAuthOptions, buildAppAuth };

package/dist/better-auth/authenticate-settings.d.ts

@@ -0,0 +1,15 @@
+import { TenantValue } from "../types.js";
+import { BetterAuthAuthenticator, BetterAuthAuthenticatorOptions } from "./authenticator.js";
+import { AdminAuth } from "./create-auth.js";
+//#region src/better-auth/authenticate-settings.d.ts
+/**
+ * `authenticate` in `protobase.config.ts`: how the API verifies the app's tokens, as data. Without it, the tokens of
+ * the app's own `auth`; `jwksUrl` and `issuer` verify those of an auth server elsewhere instead.
+ */
+export type AuthenticateSettings = Omit<BetterAuthAuthenticatorOptions, 'auth' | 'tenant'> & {
+  /** The one tenant everyone works in, for an app without organizations; never read from the token. */
+  tenant?: TenantValue;
+};
+/** The authenticator of the `authenticate` settings, over the app's Better Auth when it has one. */
+export declare const buildAuthenticator: (settings?: AuthenticateSettings, auth?: AdminAuth) => BetterAuthAuthenticator;
+//#endregion

package/dist/better-auth/authenticate-settings.js

@@ -0,0 +1,12 @@
+import { betterAuthAuthenticator } from "./authenticator.js";
+//#region src/better-auth/authenticate-settings.ts
+/** The authenticator of the `authenticate` settings, over the app's Better Auth when it has one. */
+const buildAuthenticator = (settings = {}, auth) => {
+	if (!auth && !settings.jwksUrl) throw new Error("No authenticator: give the config `auth`, or `authenticate.jwksUrl` and `issuer` for an auth server elsewhere; see https://docs.protobase.net/reference/auth/");
+	return betterAuthAuthenticator({
+		...settings,
+		...auth && { auth }
+	});
+};
+//#endregion
+export { buildAuthenticator };

package/dist/better-auth/create-auth.d.ts

@@ -1,19 +1,22 @@
 import { UserColumn, UserTableOptions } from "./user-table.js";
 import { Mailer } from "../mail/smtp-mailer.js";
 import { SignInPolicy } from "./sign-in-policy.js";
-import { OperatorProvider } from "./operator-provider.js";
-import { PlatformSignIn } from "./platform-sign-in.js";
-import { RoleDefinitions, RolesInput } from "./organizations/role-definitions.js";
-import { OrganizationRole } from "./organizations/store.js";
-import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/options.js";
 import { StaffSignIn } from "./staff-log.js";
-import "../index.js";
+import { RoleDefinitions, RolesInput } from "./organizations/role-definitions.js";
 import { ConnectedApp } from "./mcp/connected-apps.js";
 import { ReplacingContext } from "./end-replaced-session.js";
+import { VersionedSecret } from "./secret-versions.js";
 import { UserDeletionListener } from "./user-deletion.js";
-import "./auth-base-path.js";
+import { OrganizationRole } from "./organizations/store.js";
+import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/options.js";
 import { McpAuthOptions } from "./mcp/mcp-plugins.js";
+import { OperatorProvider } from "./operator-provider.js";
+import { PlatformSignIn } from "./platform-sign-in.js";
+import "../index.js";
+import "./auth-base-path.js";
+import { mcpAuthPlugins } from "./mcp/mcp-auth-plugins.js";
 import { SsoOptions } from "./saml-sign-in.js";
+import { samlPlugin } from "./saml-plugin.js";
 import { signUpPaths } from "./sign-up/sign-up-plugin.js";
 import { PasswordHash } from "./password-hashes.js";
 import { BetterAuthOptions } from "better-auth";
@@ -46,6 +49,15 @@ export type CreateAuthOptions = {
   appName?: string;
   /** Signs cookies and encrypts the JWT private keys. Generate with `openssl rand -base64 32`. */
   secret: string;
+  /**
+   * The secrets the app had before `secret`, newest first, such as `PROTOBASE_PREVIOUS_SECRETS`: what they encrypted
+   * still decrypts, so the signing keys keep signing after the secret changes. Default none.
+   */
+  previousSecrets?: string[];
+  /** Days a token signing key signs before a new one takes over; default 30. */
+  signingKeyDays?: number;
+  /** Days a replaced signing key still verifies the tokens it signed; default 7, at least 1. */
+  signingKeyGraceDays?: number;
   /** Extra origins that may call the auth endpoints, such as the exact host of a dev tunnel. `baseURL` and `origins` are always trusted. */
   trustedOrigins?: string[];
   /**
@@ -169,7 +181,17 @@ export type UserCreatedHook = NonNullable<UserCreateHooks['after']>;
  */
 /** The configured roles with `admin` first; `admin` is added when missing. */
 export declare const normalizeRoles: (roles?: RolesInput) => string[];
-export declare const createAuth: (options: CreateAuthOptions) => import("better-auth").Auth<{
+/**
+ * The plugins only some apps use, which `loadAuthPlugins` imports when the options turn them on: the SSO plugin of
+ * `sso.saml` and the OAuth provider of `mcp`.
+ */
+export type AuthPlugins = {
+  samlPlugin?: typeof samlPlugin;
+  mcpAuthPlugins?: typeof mcpAuthPlugins;
+};
+/** The optional plugins `options` turns on, imported: an app without SAML or MCP loads neither. */
+export declare const loadAuthPlugins: (options: Pick<CreateAuthOptions, "sso" | "mcp">) => Promise<AuthPlugins>;
+export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlugins) => import("better-auth").Auth<{
   user: {
     modelName: string;
     fields: {
@@ -473,9 +495,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?
-              /** Sign-in attempts allowed per minute and client, default 5; also the sign-up requests allowed. */
-              /** Sign-in attempts allowed per minute and client, default 5; also the sign-up requests allowed. */ : string | null | undefined;
+              userAgent?: string | null | undefined;
             };
           };
         }>>[];
@@ -1190,6 +1210,8 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         };
       };
       jwks: {
+        rotationInterval: number;
+        gracePeriod: number;
         keyPairConfigs: {
           readonly alg: "ES256";
         }[];
@@ -1452,6 +1474,21 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         };
       };
     };
+  } | {
+    id: "protobase-signing-keys";
+    endpoints: {
+      ensureSigningKey: import("better-call").StrictEndpoint<string, {
+        method: "POST";
+      }, {
+        ok: boolean;
+      }>;
+    };
+    hooks: {
+      before: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     hooks: {
       after: {
@@ -8777,6 +8814,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   };
   basePath: string;
   secret: string;
+  secrets: VersionedSecret[];
   trustedOrigins: string[] | ((request?: Request) => string[]);
   emailAndPassword: {
     onPasswordReset?: ((data: {
@@ -8868,4 +8906,6 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   } | undefined;
 };
 export type AdminAuth = ReturnType<typeof createAuth>;
+/** `createAuth` with the optional plugins its options turn on loaded first (see `loadAuthPlugins`). */
+export declare const buildAuth: (options: CreateAuthOptions) => Promise<AdminAuth>;
 //#endregion

package/dist/better-auth/create-auth.js

@@ -20,27 +20,29 @@ import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
 import { leakedPasswordsPlugin } from "./leaked-passwords.js";
 import { userDeletion } from "./user-deletion.js";
 import { revokeMcpGrants } from "./mcp/revoke-grants.js";
-import { coreNames, pluginNames } from "./snake-case-names.js";
+import { mcpUnusedPaths, resolveMcp } from "./mcp/mcp-plugins.js";
 import { lastOrganizationField, sessionOrganizationHooks } from "./organizations/session-organization.js";
-import { tokenClaims } from "./token-claims.js";
-import { mcpAuthPlugins, mcpUnusedPaths, resolveMcp } from "./mcp/mcp-plugins.js";
 import { organizationPlugin } from "./organizations/organization-plugin.js";
 import { protobaseOrganizationPlugin } from "./organizations/protobase-plugin.js";
 import { resolveOrganizations } from "./organizations/options.js";
 import { passkeyHosts, readPasskeyDomain, resolvePasskeyDomain } from "./passkey-domain.js";
+import { coreNames, pluginNames } from "./snake-case-names.js";
 import { passkeyPlugin } from "./passkey-plugin.js";
 import { passwordResetOptions } from "./password-reset.js";
 import { rolesPlugin } from "./roles/roles-plugin.js";
+import { versionedSecrets } from "./secret-versions.js";
+import { signingKeyRotation, signingKeys } from "./signing-keys.js";
 import { platformSignInFor, platformSignInProvider, readPlatformSignIn, resolvePlatformSignIn } from "./platform-sign-in.js";
 import { appSignInPolicy } from "./app-sign-in-policy.js";
 import { assertNoEndpointKeyClashes } from "./endpoint-key-clashes.js";
-import { emailInDomains, resolveSamlProviders, samlDisabledPaths, samlGuardPlugin, samlPlugin } from "./saml-sign-in.js";
+import { emailInDomains, resolveSamlProviders, samlDisabledPaths, samlGuardPlugin } from "./saml-sign-in.js";
 import { noAccountMailPlugin } from "./no-account-mail.js";
 import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
 import { confirmedOnCreate, confirmedOnUpdate, emailConfirmedField } from "./email-confirmed.js";
 import { rehashPasswordsPlugin, verifyAcceptedHash } from "./password-hashes.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
 import { strongSignInsPlugin } from "./strong-sign-ins.js";
+import { tokenClaims } from "./token-claims.js";
 import { twoFactorAfterPasswordOrCode } from "./two-factor-challenge.js";
 import { metadataField, userFieldsNamed, userModel, userTable, withUserColumns } from "./user-table.js";
 import { usersPlugin } from "./users/users-plugin.js";
@@ -70,6 +72,15 @@ const tokenLifetime = "15m";
 /** The configured roles with `admin` first; `admin` is added when missing. */
 const normalizeRoles = (roles) => roleDefinitions(roles).names;
 const adminImpersonationPaths = ["/admin/impersonate-user", "/admin/stop-impersonating"];
+/** The optional plugins `options` turns on, imported: an app without SAML or MCP loads neither. */
+const loadAuthPlugins = async (options) => ({
+	...(options.sso?.saml.length ?? 0) > 0 && { samlPlugin: (await import("./saml-plugin.js")).samlPlugin },
+	...options.mcp && { mcpAuthPlugins: (await import("./mcp/mcp-auth-plugins.js")).mcpAuthPlugins }
+});
+const loaded = (plugin, option) => {
+	if (!plugin) throw new Error(`${option} needs its plugin loaded: build auth with buildAuth, which loads it`);
+	return plugin;
+};
 const newUserId = (generate) => generate === "uuid" ? crypto.randomUUID() : generate();
 const noContext = () => Promise.reject(/* @__PURE__ */ new Error("The auth context is read only once createAuth has made the instance"));
 const organizationPaths = ["/organization/set-active", "/organization/accept-invitation"];
@@ -77,7 +88,7 @@ const organizationPaths = ["/organization/set-active", "/organization/accept-inv
 * The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
 * sign-in provider already resolved.
 */
-const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, appName = defaultAppName, mailer, signUpRole, operator, platformSignIn, saml = [], organizations, mcp, context = noContext, signInPolicy = defaultSignInPolicy, mobile, deletion }) => {
+const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, appName = defaultAppName, mailer, signUpRole, operator, platformSignIn, saml = [], organizations, mcp, context = noContext, signInPolicy = defaultSignInPolicy, mobile, deletion, ...plugins }) => {
 	const secure = options.baseURL.startsWith("https://");
 	const signIn = platformSignInFor(platformSignIn, Object.keys(options.socialProviders ?? {}));
 	const hosts = passkeyHosts([options.baseURL, ...origins]);
@@ -101,7 +112,10 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 	};
 	const jwtOptions = {
 		schema: pluginNames.jwt,
-		jwks: { keyPairConfigs: [goTrueKeyPair] },
+		jwks: {
+			keyPairConfigs: [goTrueKeyPair],
+			...signingKeyRotation(options)
+		},
 		jwt: {
 			expirationTime: tokenLifetime,
 			issuer: options.baseURL,
@@ -121,6 +135,8 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 		},
 		disableSettingJwtHeader: true
 	};
+	const keys = signingKeys(jwtOptions);
+	const { secrets, legacySecret } = versionedSecrets(options.secret, options.previousSecrets);
 	const trusted = [
 		options.baseURL,
 		...origins,
@@ -137,7 +153,8 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 		logger: authLogger,
 		baseURL: multiHostBaseURL(options.baseURL, origins),
 		basePath: authBasePath,
-		secret: options.secret,
+		secret: legacySecret,
+		secrets,
 		trustedOrigins: mobile ? (request) => [...trusted, ...mobile.trusted(request)] : trusted,
 		emailAndPassword: {
 			enabled: true,
@@ -166,6 +183,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				roles: Object.fromEntries(roles.map((role) => [role, role === "admin" ? adminAc : userAc]))
 			}),
 			jwt(jwtOptions),
+			keys.plugin,
 			twoFactorAfterPasswordOrCode({
 				schema: pluginNames.twoFactor,
 				allowPasswordless: true,
@@ -185,13 +203,14 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				defaultPolicy: signInPolicy
 			})] : [],
 			...signIn ? [genericOAuth({ config: [platformSignInProvider(signIn)] })] : [],
-			...saml.length > 0 ? [samlPlugin(saml, options.baseURL), samlGuardPlugin(samlIds)] : [],
+			...saml.length > 0 ? [loaded(plugins.samlPlugin, "sso.saml")(saml, options.baseURL), samlGuardPlugin(samlIds)] : [],
 			signInPolicyPlugin(policy),
 			setPasswordPlugin(),
 			...options.leakedPasswords ? [leakedPasswordsPlugin()] : [],
 			goTrueSessionsPlugin({
 				issuer: goTrueIssuer(options.baseURL),
 				jwt: jwtOptions,
+				signingKey: keys.ensure,
 				policy
 			}),
 			staffSignInPlugin({
@@ -220,7 +239,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				...organizations && { organizations }
 			}),
 			...passwordHashes.length > 0 ? [rehashPasswordsPlugin(passwordHashes)] : [],
-			...mcp ? mcpAuthPlugins({
+			...mcp ? loaded(plugins.mcpAuthPlugins, "mcp")({
 				mcp,
 				organizations: Boolean(organizations),
 				mail: Boolean(mailer),
@@ -318,7 +337,7 @@ const checkSignUpRole = (role, roles) => {
 	if (!roles.includes(role)) throw new Error(`signUp.role "${role}" is not one of the roles: ${roles.join(", ")}`);
 	return role;
 };
-const createAuth = (options) => {
+const createAuth = (options, plugins = {}) => {
 	if (options.signUp && options.organizations) throw new Error("signUp is not available with organizations: their people join by invitation");
 	const definitions = roleDefinitions(options.roles, { organizations: options.organizations !== void 0 });
 	const roles = definitions.names;
@@ -344,6 +363,7 @@ const createAuth = (options) => {
 	const mobile = mobileRequests();
 	const deletion = userDeletion();
 	const authOptions = betterAuthOptions(options, {
+		...plugins,
 		mobile,
 		deletion,
 		origins,
@@ -428,5 +448,7 @@ const createAuth = (options) => {
 		}
 	});
 };
+/** `createAuth` with the optional plugins its options turn on loaded first (see `loadAuthPlugins`). */
+const buildAuth = async (options) => createAuth(options, await loadAuthPlugins(options));
 //#endregion
-export { authBasePath, betterAuthOptions, createAuth, normalizeRoles };
+export { authBasePath, betterAuthOptions, buildAuth, createAuth, loadAuthPlugins, normalizeRoles };