@protobase/server 0.5.0 → 0.6.0

package/dist/better-auth/auth-schema.d.ts

@@ -0,0 +1,14 @@
+import { AdminAuth } from "./create-auth.js";
+//#region src/better-auth/auth-schema.d.ts
+/**
+ * The SQL that brings the admin store up to what this version of Protobase and the project's Better Auth plugins need:
+ * new tables, columns and indexes, never a drop, each skipped where it exists. `undefined` when the store is current. A
+ * change Better Auth cannot make safely, such as a required column without a default on a table with rows, is an error.
+ */
+export declare const authSchemaMigration: (auth: AdminAuth) => Promise<string | undefined>;
+/**
+ * Refuses to go on while the admin store lacks a table or column Better Auth needs, since every sign-in would fail.
+ * The server never changes the schema itself: the project's migrations do, before the new version serves.
+ */
+export declare const checkAuthSchema: (auth: AdminAuth) => Promise<void>;
+//#endregion

package/dist/better-auth/auth-schema.js

@@ -0,0 +1,35 @@
+import { getMigrations } from "better-auth/db/migration";
+//#region src/better-auth/auth-schema.ts
+/** The command that writes the pending changes as a migration file of the project. */
+const authMigrationCommand = "protobase auth migration";
+/**
+* Better Auth's statements, each made to skip what exists already, so a migration written from an empty database also
+* applies to one an earlier Protobase set up in place.
+*/
+const skipExisting = (sql) => sql.split(";\n\n").map((statement) => statement.replace(/^create table (?!if not exists )/, "create table if not exists ").replace(/^create (unique )?index (?!if not exists )/, (_, unique) => `create ${unique ?? ""}index if not exists `).replace(/^(alter table .+? )add column (?!if not exists )/, "$1add column if not exists ")).join(";\n\n");
+/**
+* The SQL that brings the admin store up to what this version of Protobase and the project's Better Auth plugins need:
+* new tables, columns and indexes, never a drop, each skipped where it exists. `undefined` when the store is current. A
+* change Better Auth cannot make safely, such as a required column without a default on a table with rows, is an error.
+*/
+const authSchemaMigration = async (auth) => {
+	const { toBeCreated, toBeAdded, toBeAddedIndexes, compileMigrations } = await getMigrations(auth.options);
+	if (toBeCreated.length === 0 && toBeAdded.length === 0 && toBeAddedIndexes.length === 0) return void 0;
+	return skipExisting(await compileMigrations());
+};
+/** The tables and `table.column`s the admin store lacks; an index missing is not a reason to refuse requests. */
+const missingAuthSchema = async (auth) => {
+	const { toBeCreated, toBeAdded } = await getMigrations(auth.options, { throwOnUnsafe: false });
+	return [...toBeCreated.map(({ table }) => table), ...toBeAdded.flatMap(({ table, fields }) => Object.keys(fields).map((field) => `${table}.${field}`))];
+};
+/**
+* Refuses to go on while the admin store lacks a table or column Better Auth needs, since every sign-in would fail.
+* The server never changes the schema itself: the project's migrations do, before the new version serves.
+*/
+const checkAuthSchema = async (auth) => {
+	const missing = await missingAuthSchema(auth);
+	if (missing.length === 0) return;
+	throw new Error(`The auth schema is behind this version of Protobase (missing ${missing.join(", ")}). Write the change as a migration with \`${authMigrationCommand}\`, apply it with the project's migrations, then start again.`);
+};
+//#endregion
+export { authMigrationCommand, authSchemaMigration, checkAuthSchema, missingAuthSchema, skipExisting };

package/dist/better-auth/create-auth.d.ts

@@ -2,6 +2,7 @@ import { SignInPolicy } from "./sign-in-policy.js";
 import { StaffSignIn } from "./staff-log.js";
 import { Mailer } from "../mail/smtp-mailer.js";
 import { OperatorProvider } from "./operator-provider.js";
+import { PlatformSignIn } from "./platform-sign-in.js";
 import { BetterAuthOptions } from "better-auth";
 //#region src/better-auth/create-auth.d.ts
 export type CreateAuthOptions = {
@@ -33,7 +34,7 @@ export type CreateAuthOptions = {
   /**
    * Sign-in providers for Better Auth, for example `{ github: { clientId, clientSecret } }`; the callback is
    * `{baseURL}/api/auth/callback/<provider>`. A provider also signs up people without an account, with the default role.
-   * Default none.
+   * One with the id of `signInProvider` takes its place. Default none.
    */
   socialProviders?: BetterAuthOptions['socialProviders'];
   /** Encrypt the OAuth access, refresh and ID tokens Better Auth stores for social sign-ins, with `secret`. Default off. */
@@ -47,6 +48,13 @@ export type CreateAuthOptions = {
    * whatever the environment says.
    */
   operator?: OperatorProvider | false;
+  /**
+   * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+   * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+   * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+   * environment says. Left out when `socialProviders` has a provider with the same id.
+   */
+  signInProvider?: PlatformSignIn | false;
 };
 type UserCreateHooks = NonNullable<NonNullable<NonNullable<BetterAuthOptions['databaseHooks']>['user']>['create']>;
 /** Better Auth's `databaseHooks.user.create.after`: the created user (with its `role`) and the request context, `null` outside a request. */
@@ -54,6 +62,12 @@ export type UserCreatedHook = NonNullable<UserCreateHooks['after']>;
 /** The configured roles with `admin` first; `admin` is added when missing. */
 export declare const normalizeRoles: (roles?: string[]) => string[];
 export declare const createAuth: (options: CreateAuthOptions) => import("better-auth").Auth<{
+  account: {
+    encryptOAuthTokens?: true | undefined;
+    accountLinking: {
+      allowDifferentEmails: true;
+    };
+  };
   plugins: [{
     id: "admin";
     version: string;
@@ -2458,7 +2472,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       RESOLVED_USER_INVALID: import("better-auth").RawError<"RESOLVED_USER_INVALID">;
     };
     options: import("@better-auth/passkey").PasskeyOptions | undefined;
-  }, ...{
+  }, ...({
     id: "email-otp";
     version: string;
     init(ctx: import("better-auth").AuthContext): {
@@ -2990,7 +3004,20 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       INVALID_OTP: import("better-auth").RawError<"INVALID_OTP">;
       TOO_MANY_ATTEMPTS: import("better-auth").RawError<"TOO_MANY_ATTEMPTS">;
     };
-  }[], {
+  } | {
+    id: "generic-oauth";
+    version: string;
+    init: (ctx: import("better-auth").AuthContext) => Promise<{
+      context: {
+        socialProviders: import("better-auth").OAuthProvider<object, Partial<import("better-auth").ProviderOptions<object>>>[];
+      };
+    }>;
+    options: import("better-auth/plugins").GenericOAuthOptions<string>;
+    $ERROR_CODES: {
+      INVALID_OAUTH_CONFIGURATION: import("better-auth").RawError<"INVALID_OAUTH_CONFIGURATION">;
+      TOKEN_URL_NOT_FOUND: import("better-auth").RawError<"TOKEN_URL_NOT_FOUND">;
+    };
+  })[], {
     id: "protobase-sign-in-policy";
     schema: {
       readonly signInPolicy: {
@@ -3016,6 +3043,11 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
             readonly required: true;
             readonly defaultValue: "allowed";
           };
+          readonly platformSignIn: {
+            readonly type: "string";
+            readonly required: true;
+            readonly defaultValue: "allowed";
+          };
           readonly createdAt: {
             readonly type: "date";
             readonly required: true;
@@ -3124,6 +3156,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       }, {
         savedBy?: string | undefined;
         savedAt?: string | undefined;
+        platformSignIn?: string | undefined;
         operator?: string | undefined;
         policy: SignInPolicy;
         effective: SignInPolicy;
@@ -3226,6 +3259,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       }, {
         savedBy?: string | undefined;
         savedAt?: string | undefined;
+        platformSignIn?: string | undefined;
         operator?: string | undefined;
         policy: SignInPolicy;
         effective: SignInPolicy;
@@ -3556,9 +3590,6 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       handler: () => void;
     };
   };
-  account?: {
-    encryptOAuthTokens: true;
-  } | undefined;
   socialProviders?: import("better-auth").SocialProviders | undefined;
   appName: string;
   database: any;
@@ -3585,6 +3616,10 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   passwordReset: boolean;
   socialProviders: string[];
   operator: string | undefined;
+  platformSignIn: {
+    provider: string;
+    name: string;
+  } | undefined;
 };
 export type AdminAuth = ReturnType<typeof createAuth>;
 //#endregion

package/dist/better-auth/create-auth.js

@@ -2,6 +2,7 @@ import { readMailSettings } from "../mail/mail-settings.js";
 import { smtpMailer } from "../mail/smtp-mailer.js";
 import { readOperatorSettings, resolveOperator } from "./operator-provider.js";
 import { passwordResetOptions } from "./password-reset.js";
+import { platformSignInFor, platformSignInProvider, readPlatformSignIn, resolvePlatformSignIn } from "./platform-sign-in.js";
 import { signInPolicyPlugin } from "./policy-plugin.js";
 import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
@@ -9,10 +10,11 @@ import { twoFactorAfterPasswordOrCode } from "./two-factor-challenge.js";
 import { passkey } from "@better-auth/passkey";
 import { APIError } from "better-auth/api";
 import { betterAuth } from "better-auth";
-import { admin, emailOTP, jwt } from "better-auth/plugins";
+import { admin, emailOTP, genericOAuth, jwt } from "better-auth/plugins";
 import { adminAc, userAc } from "better-auth/plugins/admin/access";
 //#region src/better-auth/create-auth.ts
 const platformOperator = () => readOperatorSettings(globalThis.process?.env ?? {});
+const platformSignInSettings = () => readPlatformSignIn(globalThis.process?.env ?? {});
 const platformMailer = () => {
 	const settings = readMailSettings(globalThis.process?.env ?? {});
 	return settings && smtpMailer(settings);
@@ -33,9 +35,13 @@ const normalizeRoles = (roles = ["admin", "user"]) => {
 	return ["admin", ...new Set(roles.filter((role) => role !== "admin"))];
 };
 const adminImpersonationPaths = ["/admin/impersonate-user", "/admin/stop-impersonating"];
-/** The options `createAuth` gives Better Auth, with the roles, default role, mailer and operator provider already resolved. */
-const betterAuthOptions = (options, { roles, defaultRole, mailer, operator }) => {
+/**
+* The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
+* sign-in provider already resolved.
+*/
+const betterAuthOptions = (options, { roles, defaultRole, mailer, operator, platformSignIn }) => {
 	const secure = options.baseURL.startsWith("https://");
+	const signIn = platformSignInFor(platformSignIn, Object.keys(options.socialProviders ?? {}));
 	return {
 		appName: options.appName ?? "Protobase",
 		database: options.database,
@@ -54,7 +60,10 @@ const betterAuthOptions = (options, { roles, defaultRole, mailer, operator }) =>
 			...mailer && passwordResetOptions(mailer)
 		},
 		...options.socialProviders && { socialProviders: options.socialProviders },
-		...options.encryptOAuthTokens && { account: { encryptOAuthTokens: true } },
+		account: {
+			accountLinking: { allowDifferentEmails: true },
+			...options.encryptOAuthTokens && { encryptOAuthTokens: true }
+		},
 		plugins: [
 			admin({
 				defaultRole: defaultRole ?? "unassigned",
@@ -78,10 +87,15 @@ const betterAuthOptions = (options, { roles, defaultRole, mailer, operator }) =>
 			}),
 			passkey(),
 			...mailer ? [emailOTP(emailCodeOptions(mailer))] : [],
+			...signIn ? [genericOAuth({ config: [platformSignInProvider(signIn)] })] : [],
 			signInPolicyPlugin({
 				mail: Boolean(mailer),
 				socialProviders: Object.keys(options.socialProviders ?? {}),
-				...operator && { operator: operator.name }
+				...operator && { operator: operator.name },
+				...signIn && { platformSignIn: {
+					provider: signIn.provider,
+					name: signIn.name
+				} }
 			}),
 			staffSignInPlugin({
 				...operator && { operator },
@@ -134,20 +148,27 @@ const createAuth = (options) => {
 	const mailer = options.mailer === void 0 ? platformMailer() : options.mailer || void 0;
 	const provider = options.operator === void 0 ? platformOperator() : options.operator || void 0;
 	const operator = provider && resolveOperator(provider);
+	const signInSettings = options.signInProvider === void 0 ? platformSignInSettings() : options.signInProvider || void 0;
+	const socialProviders = Object.keys(options.socialProviders ?? {});
+	const platformSignIn = platformSignInFor(signInSettings && resolvePlatformSignIn(signInSettings), socialProviders);
 	const auth = betterAuth(betterAuthOptions(options, {
 		roles,
 		defaultRole,
 		mailer,
-		operator
+		operator,
+		platformSignIn
 	}));
-	const socialProviders = Object.keys(options.socialProviders ?? {});
 	return Object.assign(auth, {
 		roles,
 		defaultRole,
 		mail: Boolean(mailer),
 		passwordReset: Boolean(mailer),
 		socialProviders,
-		operator: operator?.name
+		operator: operator?.name,
+		platformSignIn: platformSignIn && {
+			provider: platformSignIn.provider,
+			name: platformSignIn.name
+		}
 	});
 };
 //#endregion

package/dist/better-auth/platform-sign-in.d.ts

@@ -0,0 +1,30 @@
+import "better-auth/plugins";
+//#region src/better-auth/platform-sign-in.d.ts
+/**
+ * A sign-in provider the platform adds to the app, for people who already have an account: any OpenID Connect
+ * provider, with this app registered as a confidential client whose redirect URI is
+ * `{baseURL}/api/auth/callback/{provider}`. It never creates accounts.
+ */
+export type PlatformSignIn = {
+  /** The provider's issuer URL; its settings are read from `{issuer}/.well-known/openid-configuration`. */
+  issuer: string;
+  clientId: string;
+  clientSecret: string;
+  /**
+   * The id of the provider: the button, the callback path, and the namespace of the linked accounts. Default `oidc`.
+   * Use `github` only when the provider's `sub` is the GitHub user id, so its accounts are those of Better Auth's own
+   * GitHub provider.
+   */
+  provider?: string;
+  /** Shown on the sign-in page as "Continue with {name}". Default `GitHub` for the `github` provider, `SSO` otherwise. */
+  name?: string;
+  /** Scopes asked for besides `openid email profile`. */
+  scopes?: string[];
+};
+/**
+ * The provider the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID` and
+ * `PROTOBASE_SIGN_IN_CLIENT_SECRET` (with `PROTOBASE_SIGN_IN_PROVIDER` and `PROTOBASE_SIGN_IN_NAME` optional);
+ * `undefined` when none of the three is set. Some but not all of them stops the server at startup.
+ */
+export declare const readPlatformSignIn: (env: Record<string, string | undefined>) => PlatformSignIn | undefined;
+//#endregion

package/dist/better-auth/platform-sign-in.js

@@ -0,0 +1,88 @@
+import { decodeJwt } from "jose";
+//#region src/better-auth/platform-sign-in.ts
+const signInIssuerVariable = "PROTOBASE_SIGN_IN_ISSUER";
+const signInClientIdVariable = "PROTOBASE_SIGN_IN_CLIENT_ID";
+const signInClientSecretVariable = "PROTOBASE_SIGN_IN_CLIENT_SECRET";
+const signInProviderVariable = "PROTOBASE_SIGN_IN_PROVIDER";
+const signInNameVariable = "PROTOBASE_SIGN_IN_NAME";
+/**
+* The provider the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID` and
+* `PROTOBASE_SIGN_IN_CLIENT_SECRET` (with `PROTOBASE_SIGN_IN_PROVIDER` and `PROTOBASE_SIGN_IN_NAME` optional);
+* `undefined` when none of the three is set. Some but not all of them stops the server at startup.
+*/
+const readPlatformSignIn = (env) => {
+	const required = [
+		signInIssuerVariable,
+		signInClientIdVariable,
+		signInClientSecretVariable
+	];
+	const [issuer, clientId, clientSecret] = required.map((name) => env[name]?.trim() || void 0);
+	if (!issuer && !clientId && !clientSecret) return void 0;
+	if (!issuer || !clientId || !clientSecret) throw new Error(`${required.join(", ")} go together: set all three for the platform sign-in provider, or none`);
+	const provider = env[signInProviderVariable]?.trim();
+	const name = env[signInNameVariable]?.trim();
+	return {
+		issuer,
+		clientId,
+		clientSecret,
+		...provider && { provider },
+		...name && { name }
+	};
+};
+const providerId = /^[a-z][a-z0-9-]*$/;
+/** The provider with its defaults filled in; an issuer that is not a URL or a malformed id is an error. */
+const resolvePlatformSignIn = (signIn) => {
+	if (!URL.canParse(signIn.issuer)) throw new Error(`The platform sign-in provider's issuer must be a URL, not "${signIn.issuer}"`);
+	const provider = signIn.provider ?? "oidc";
+	if (!providerId.test(provider)) throw new Error(`Invalid sign-in provider id "${provider}": use lowercase letters, digits or "-"`);
+	return {
+		...signIn,
+		provider,
+		name: signIn.name ?? (provider === "github" ? "GitHub" : "SSO"),
+		scopes: signIn.scopes ?? []
+	};
+};
+/** The platform provider, unless the app configures a provider of its own with the same id, which then wins. */
+const platformSignInFor = (signIn, socialProviders) => signIn && !socialProviders.includes(signIn.provider) ? signIn : void 0;
+/**
+* The person as an ID token Better Auth already verified (the provider's keys, this client and the nonce) says, once
+* its issuer is the configured one; `null` without an ID token, so nothing comes from an unverified source.
+*/
+const idTokenUser = (idToken, issuer) => {
+	if (!idToken) return null;
+	const claims = decodeJwt(idToken);
+	if (claims.iss !== issuer || typeof claims.sub !== "string" || !claims.sub || typeof claims.email !== "string") return null;
+	return {
+		id: claims.sub,
+		sub: claims.sub,
+		email: claims.email,
+		emailVerified: claims.email_verified === true,
+		name: typeof claims.name === "string" && claims.name ? claims.name : claims.email.split("@")[0],
+		...typeof claims.picture === "string" && { image: claims.picture }
+	};
+};
+/**
+* The provider for Better Auth's generic OAuth plugin: discovery, PKCE, the client secret in a Basic header, an ID
+* token that must verify against the provider's keys, and no sign-up. A provider whose settings cannot be read at
+* startup is left out until the next start.
+*/
+const platformSignInProvider = (signIn) => ({
+	providerId: signIn.provider,
+	name: signIn.name,
+	clientId: signIn.clientId,
+	clientSecret: signIn.clientSecret,
+	discoveryUrl: `${signIn.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`,
+	scopes: [
+		"openid",
+		"email",
+		"profile",
+		...signIn.scopes
+	],
+	pkce: true,
+	requireIdTokenVerification: true,
+	authentication: "basic",
+	disableSignUp: true,
+	getUserInfo: async (tokens) => idTokenUser(tokens.idToken, signIn.issuer)
+});
+//#endregion
+export { idTokenUser, platformSignInFor, platformSignInProvider, readPlatformSignIn, resolvePlatformSignIn, signInClientIdVariable, signInClientSecretVariable, signInIssuerVariable, signInNameVariable, signInProviderVariable };

package/dist/better-auth/policy-plugin.js

@@ -36,8 +36,9 @@ const refuse = (status, refusal) => new APIError(status, refusal);
 * applies it to Better Auth's own endpoints. A method the policy turns off answers `403 SIGN_IN_METHOD_FORBIDDEN`;
 * someone without what it requires gets a session, so they can set it up, but no API token (`403 SIGN_IN_SETUP_REQUIRED`).
 */
-const signInPolicyPlugin = ({ mail, socialProviders, operator }) => {
+const signInPolicyPlugin = ({ mail, socialProviders, operator, platformSignIn }) => {
 	const currentPolicy = async (context) => effectiveSignInPolicy((await readSignInPolicy(context.adapter)).policy, { mail });
+	const providersUnder = (policy) => [...socialProviders, ...platformSignIn && policy.platformSignIn === "allowed" ? [platformSignIn.provider] : []];
 	const policyAdmin = adminOnly("Only an admin can change how people sign in.");
 	const policyAnswer = async (context) => {
 		const stored = await readSignInPolicy(context.adapter);
@@ -47,6 +48,7 @@ const signInPolicyPlugin = ({ mail, socialProviders, operator }) => {
 			effective: effectiveSignInPolicy(stored.policy, { mail }),
 			mail,
 			...operator && { operator },
+			...platformSignIn && { platformSignIn: platformSignIn.name },
 			...stored.savedAt && { savedAt: stored.savedAt },
 			...savedBy && { savedBy }
 		};
@@ -72,9 +74,10 @@ const signInPolicyPlugin = ({ mail, socialProviders, operator }) => {
 					message: "Choose one of the offered rules for every sign-in method."
 				});
 				const user = ctx.context.session.user;
+				const admin = await accountMethods(ctx.context, user, providersUnder(effectiveSignInPolicy(policy, { mail })));
 				const problem = signInPolicyProblem(policy, {
 					mail,
-					admin: await accountMethods(ctx.context, user, socialProviders)
+					admin
 				});
 				if (problem) throw refuse("BAD_REQUEST", {
 					code: "SIGN_IN_POLICY_REFUSED",
@@ -92,7 +95,7 @@ const signInPolicyPlugin = ({ mail, socialProviders, operator }) => {
 				use: [sessionMiddleware]
 			}, async (ctx) => {
 				const policy = await currentPolicy(ctx.context);
-				const { socialSignIn: _, ...account } = await accountMethods(ctx.context, ctx.context.session.user, socialProviders);
+				const { socialSignIn: _, ...account } = await accountMethods(ctx.context, ctx.context.session.user, providersUnder(policy));
 				return ctx.json({
 					policy,
 					mail,
@@ -112,14 +115,16 @@ const signInPolicyPlugin = ({ mail, socialProviders, operator }) => {
 				const policy = await currentPolicy(ctx.context);
 				const refusal = policyRefusal(policy, {
 					path,
-					body: ctx.body
+					body: ctx.body,
+					params: ctx.params,
+					...platformSignIn && { platformProvider: platformSignIn.provider }
 				});
 				if (refusal) throw refuse("FORBIDDEN", refusal);
 				if (path === "/sign-in/email-otp") return vouchForCreatedAccount(ctx.context, ctx.body.email);
 				if (!(path === "/token" && (policy.twoFactor === "required" || policy.passkey === "required") || path === "/passkey/delete-passkey" && policy.passkey === "required")) return;
 				const session = await getSessionFromCtx(ctx);
 				if (!session || isStaffSession(session.session)) return;
-				const account = await accountMethods(ctx.context, session.user, socialProviders);
+				const account = await accountMethods(ctx.context, session.user, providersUnder(policy));
 				if (path === "/token" && missingRequiredMethods(policy, account).length > 0) throw refuse("FORBIDDEN", setupRequired);
 				if (path === "/passkey/delete-passkey" && account.passkeys <= 1) throw refuse("FORBIDDEN", lastPasskeyRequired);
 			})

package/dist/better-auth/policy-store.js

@@ -24,6 +24,11 @@ const signInPolicySchema = { [signInPolicyModel]: { fields: {
 		required: true,
 		defaultValue: "allowed"
 	},
+	platformSignIn: {
+		type: "string",
+		required: true,
+		defaultValue: "allowed"
+	},
 	createdAt: {
 		type: "date",
 		required: true

package/dist/better-auth/sign-in-enforcement.js

@@ -13,6 +13,8 @@ const passkeyPaths = [
 	"/passkey/verify-registration"
 ];
 const staffSignInPath = "/staff/sign-in";
+const providerPaths = ["/sign-in/social", "/link-social"];
+const callbackPath = "/callback/:id";
 const accountPaths = [
 	"/email-otp/send-verification-otp",
 	"/passkey/delete-passkey",
@@ -26,23 +28,29 @@ const isPoliced = (path) => path !== void 0 && ([
 	...emailCodePaths,
 	...passkeyPaths,
 	...accountPaths,
+	...providerPaths,
+	callbackPath,
 	"/staff/sign-in"
 ].includes(path) || path.startsWith("/reset-password/"));
-const methodOf = (path, body) => {
+const providerOf = ({ path, body, params }) => providerPaths.includes(path) ? body?.provider : path === callbackPath ? params?.id : void 0;
+const methodOf = (request) => {
+	const { path, body } = request;
 	if (passwordPaths.includes(path) || path.startsWith("/reset-password/")) return "password";
 	if (emailCodePaths.includes(path)) return "emailCode";
 	if (path === "/email-otp/send-verification-otp" && body?.type === "sign-in") return "emailCode";
 	if (passkeyPaths.includes(path)) return "passkey";
 	if (path === "/two-factor/enable") return "twoFactor";
 	if (path === "/staff/sign-in") return "staffAccess";
+	if (request.platformProvider !== void 0 && providerOf(request) === request.platformProvider) return "platformSignIn";
 };
 /**
 * Why the policy refuses a request to Better Auth at `path`, or `undefined` when it lets it through: a method the
 * policy turns off, or turning off two-factor authentication while the policy requires it. Removing the last passkey
 * while passkeys are required depends on the account, so the plugin checks that itself.
 */
-const policyRefusal = (policy, { path, body }) => {
-	const method = methodOf(path, body);
+const policyRefusal = (policy, request) => {
+	const { path } = request;
+	const method = methodOf(request);
 	if (method && policy[method] === "forbidden") return {
 		code: "SIGN_IN_METHOD_FORBIDDEN",
 		message: signInPolicyMethods[method].forbidden

package/dist/better-auth/sign-in-policy.d.ts

@@ -7,7 +7,8 @@ export type StaffAccessRule = 'allowed' | 'notify' | 'forbidden';
  * The app's sign-in policy. `password`, `emailCode` and `passkey` are ways to sign in; `twoFactor` is the second step
  * after a password or an emailed code. Only a passkey and two-factor authentication can be required: they are set up
  * once per person, so "required" sends everyone without one to set it up. `staffAccess` is whether the operator's
- * staff may sign in as people, for support.
+ * staff may sign in as people, for support. `platformSignIn` is whether people may sign in through the provider the
+ * platform adds (see `PlatformSignIn`), which the app's developer did not choose.
  */
 export type SignInPolicy = {
   password: 'allowed' | 'forbidden';
@@ -15,6 +16,7 @@ export type SignInPolicy = {
   passkey: SignInRule;
   twoFactor: SignInRule;
   staffAccess: StaffAccessRule;
+  platformSignIn: 'allowed' | 'forbidden';
 };
 /** Each method with the rules it takes, its name, and what the server answers when the policy turns it off. */
 export declare const signInPolicyMethods: {
@@ -43,6 +45,11 @@ export declare const signInPolicyMethods: {
     readonly rules: readonly ["allowed", "notify", "forbidden"];
     readonly forbidden: "Staff sign-in is turned off for this app.";
   };
+  readonly platformSignIn: {
+    readonly label: "Sign-in through the platform";
+    readonly rules: readonly ["allowed", "forbidden"];
+    readonly forbidden: "Signing in through the platform is turned off for this app.";
+  };
 };
 /** Everything allowed and nothing required: the policy of an app whose admins never saved one. */
 export declare const defaultSignInPolicy: SignInPolicy;

package/dist/better-auth/sign-in-policy.js

@@ -37,6 +37,11 @@ const signInPolicyMethods = {
 			"forbidden"
 		],
 		forbidden: "Staff sign-in is turned off for this app."
+	},
+	platformSignIn: {
+		label: "Sign-in through the platform",
+		rules: ["allowed", "forbidden"],
+		forbidden: "Signing in through the platform is turned off for this app."
 	}
 };
 /** Everything allowed and nothing required: the policy of an app whose admins never saved one. */
@@ -45,7 +50,8 @@ const defaultSignInPolicy = {
 	emailCode: "allowed",
 	passkey: "allowed",
 	twoFactor: "allowed",
-	staffAccess: "allowed"
+	staffAccess: "allowed",
+	platformSignIn: "allowed"
 };
 const methodNames = Object.keys(signInPolicyMethods);
 /** A policy from a request body or a stored row; `undefined` when a method is missing or has a rule it does not take. */
@@ -57,13 +63,21 @@ const parseSignInPolicy = (input) => {
 /**
 * The policy as it applies. Emailed codes need mail; without mail, password sign-in is on whatever the policy says, so
 * an app whose mail settings went missing does not lock out everyone who had only emailed codes left. Staff sign-in
-* that emails the person is off without mail, since nobody would be told.
+* that emails the person is off without mail, since nobody would be told. Sign-in through the platform is off while
+* passkeys or two-factor authentication are required: it skips the app's second step, and the provider's own cannot
+* be checked.
 */
-const effectiveSignInPolicy = (policy, { mail }) => mail ? policy : {
-	...policy,
-	password: "allowed",
-	emailCode: "forbidden",
-	...policy.staffAccess === "notify" && { staffAccess: "forbidden" }
+const effectiveSignInPolicy = (policy, { mail }) => {
+	const strict = policy.passkey === "required" || policy.twoFactor === "required";
+	return {
+		...policy,
+		...!mail && {
+			password: "allowed",
+			emailCode: "forbidden"
+		},
+		...!mail && policy.staffAccess === "notify" && { staffAccess: "forbidden" },
+		...strict && { platformSignIn: "forbidden" }
+	};
 };
 /** The required methods `account` has not set up yet, in the order a setup page asks for them. */
 const missingRequiredMethods = (policy, account) => [...policy.twoFactor === "required" && !account.twoFactor ? ["twoFactor"] : [], ...policy.passkey === "required" && account.passkeys === 0 ? ["passkey"] : []];

package/dist/better-auth/staff-plugin.js

@@ -9,7 +9,7 @@ import { deleteSessionCookie } from "better-auth/cookies";
 * Staff of the operator sign in as a person of this app, for support (see `staffSignInEndpoints`). A staff session
 * shows who started it and why, can be stopped, and cannot change the person's sign-in or the sign-in policy. Every
 * staff sign-in is logged for the app's admins. The plugin is there without an operator provider too, so its table
-* exists from the first `auth:migrate`.
+* exists from the first auth migration.
 */
 const staffSignInPlugin = ({ operator, mailer }) => ({
 	id: "protobase-staff-sign-in",

package/dist/better-auth/status-route.js

@@ -7,24 +7,30 @@ import { Hono } from "hono";
 * `GET {authBase}/status`: `needsAdmin` while the admin store has no user, so a login page can say how to create one;
 * `signInMethods`, the ways to sign in the sign-in policy leaves on (`password`, `emailCode`, `passkey`), so it offers
 * only those; `passwordReset` when reset mail can be sent and passwords are on, so it offers "Forgot password?" only
-* then; the ids of the configured `socialProviders`, so it offers "Continue with GitHub" when `github` is one; and
-* `staffSignIn`, the operator provider's name, when staff can sign in as people.
+* then; the ids of the `socialProviders` people can sign in with, so it offers "Continue with GitHub" when `github` is
+* one; `platformSignIn`, the id and name of the platform's provider when it is one of them; and `staffSignIn`, the
+* operator provider's name, when staff can sign in as people.
 */
 const statusRoute = (auth) => {
 	const app = new Hono();
 	app.get("/status", async (c) => {
-		const policy = effectiveSignInPolicy((await readSignInPolicy((await auth.$context).adapter)).policy, { mail: auth.mail });
+		const context = await auth.$context;
+		const policy = effectiveSignInPolicy((await readSignInPolicy(context.adapter)).policy, { mail: auth.mail });
 		const signInMethods = [
 			...policy.password === "allowed" ? ["password"] : [],
 			...policy.emailCode === "allowed" ? ["emailCode"] : [],
 			...policy.passkey !== "forbidden" ? ["passkey"] : []
 		];
 		const staffSignIn = auth.operator && policy.staffAccess !== "forbidden" ? auth.operator : void 0;
+		const platform = auth.platformSignIn;
+		const platformSignIn = platform && policy.platformSignIn === "allowed" && context.socialProviders.some((provider) => provider.id === platform.provider) ? platform : void 0;
+		const socialProviders = [...auth.socialProviders, ...platformSignIn ? [platformSignIn.provider] : []];
 		return c.json({
 			needsAdmin: !await hasUsers(auth),
 			signInMethods,
 			passwordReset: auth.passwordReset && policy.password === "allowed",
-			socialProviders: auth.socialProviders,
+			socialProviders,
+			...platformSignIn && { platformSignIn },
 			...staffSignIn && { staffSignIn }
 		});
 	});

package/dist/better-auth/users.d.ts

@@ -3,11 +3,17 @@ import { parseRoles } from "./parse-roles.js";
 //#region src/better-auth/users.d.ts
 /** The roles this auth instance allows, `admin` first. */
 export declare const roleChoices: (auth: AdminAuth) => string[];
+/** An account at a sign-in provider, as Better Auth keys it: `{ providerId: 'github', accountId: '<GitHub user id>' }`. */
+export type LinkedAccount = {
+  providerId: string;
+  accountId: string;
+};
 export type NewUser = {
   email: string;
   password: string;
   name?: string;
   role?: string;
+  accounts?: LinkedAccount[];
 };
 export type StoredUser = {
   id: string;
@@ -21,7 +27,8 @@ export declare const hasUsers: (auth: AdminAuth) => Promise<boolean>;
 /**
  * Creates a user directly in the admin store. Host side only (no HTTP route creates accounts while the store is empty):
  * the first user is always an `admin`, later ones get `role` (default `user`). The address counts as verified, so the
- * user can also sign in with an emailed code.
+ * user can also sign in with an emailed code. `accounts` link the user to sign-in providers up front, so a provider
+ * signs them in by its own id whatever address it reports; one that signs in another user already is refused.
  */
 export declare const createUser: (auth: AdminAuth, input: NewUser) => Promise<{
   id: string;

package/dist/better-auth/users.js

@@ -10,22 +10,37 @@ const checkRoles = (auth, role) => {
 };
 /** Whether the admin store has any user yet. */
 const hasUsers = async (auth) => (await auth.$context).adapter.count({ model: "user" }).then((count) => count > 0);
+const checkAccounts = async (auth, accounts) => {
+	const { internalAdapter } = await auth.$context;
+	for (const account of accounts) {
+		if (!account.providerId || !account.accountId || account.providerId === "credential") throw new Error(`Cannot link an account "${account.providerId}:${account.accountId}"`);
+		if (await internalAdapter.findAccountByKey(account)) throw new Error(`The ${account.providerId} account ${account.accountId} signs in another user already`);
+	}
+};
 /**
 * Creates a user directly in the admin store. Host side only (no HTTP route creates accounts while the store is empty):
 * the first user is always an `admin`, later ones get `role` (default `user`). The address counts as verified, so the
-* user can also sign in with an emailed code.
+* user can also sign in with an emailed code. `accounts` link the user to sign-in providers up front, so a provider
+* signs them in by its own id whatever address it reports; one that signs in another user already is refused.
 */
 const createUser = async (auth, input) => {
 	const first = !await hasUsers(auth);
 	const requested = input.role ?? auth.defaultRole;
 	if (!first && requested === void 0) throw new Error(`A role is required: choose one of ${auth.roles.join(", ")}`);
 	const role = first ? "admin" : checkRoles(auth, requested).join(",");
+	const accounts = input.accounts ?? [];
+	await checkAccounts(auth, accounts);
 	const { user } = await auth.api.createUser({ body: {
 		email: input.email,
 		password: input.password,
 		name: input.name ?? input.email.split("@")[0],
 		role
 	} });
+	const { internalAdapter } = await auth.$context;
+	for (const account of accounts) await internalAdapter.linkAccount({
+		userId: user.id,
+		...account
+	});
 	return {
 		id: user.id,
 		email: user.email,

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { StaffSignIn } from "./better-auth/staff-log.js";
 import { OperatorProvider, readOperatorSettings } from "./better-auth/operator-provider.js";
+import { PlatformSignIn, readPlatformSignIn } from "./better-auth/platform-sign-in.js";
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, createAuth, normalizeRoles } from "./better-auth/create-auth.js";
 import { ResourceSource, configExports } from "./resource-source.js";
 import { ChatMessage, ChatTextPart, Completion, CompletionOptions, ModelError, ModelSettings, ReasoningDetail, ReasoningEffort, ToolCall, ToolSpec, streamChatCompletion } from "./assistant/chat-completions.js";
@@ -20,8 +21,9 @@ import { JwtOptions, jwtAuthenticator } from "./auth/jwt.js";
 import { HttpProblem, badRequest, forbidden, notFound, unauthorized } from "./problem.js";
 import { BetterAuthAuthenticatorOptions, betterAuthAuthenticator } from "./better-auth/authenticator.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
-import { NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
+import { LinkedAccount, NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { IssueTokenOptions, issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
+import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
 import { AssistantBackend, assistantProtocolRoutes } from "./assistant/protocol-routes.js";
 import { fileConversationStore } from "./assistant/file-conversation-store.js";
 import { withCacheBreakpoints } from "./assistant/cache-breakpoints.js";
@@ -29,4 +31,4 @@ import { TurnOptions, runTurn } from "./assistant/turn.js";
 import { WidgetOptions, maxWidgetPropsBytes, widget } from "./assistant/widget.js";
 import { QueryOptions, QueryResult, runReadOnlyQuery, runReadWriteQuery } from "./assistant/run-query.js";
 import { readOnlyQueryTool, readWriteQueryTool } from "./assistant/query-tools.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type ChatMessage, type ChatTextPart, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CreateAdminInput, type CreateAuthOptions, HttpProblem, type IssueTokenOptions, type JwtOptions, ModelError, type ModelSettings, type NewUser, type OperatorProvider, type PipelineHook, type ProjectConfig, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type ResourceSource, type RuntimeOptions, type ScanGuardMode, type Session, type SignInPolicy, type SignInRule, type StaffAccessRule, type StaffSignIn, type StoredUser, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WidgetOptions, type WriteEvent, type WriteOperation, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, badRequest, betterAuthAuthenticator, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createUser, defaultSignInPolicy, defineConfig, defineTool, deleteUser, fileConversationStore, forbidden, hasUsers, issueToken, jwtAuthenticator, listUsers, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, normalizeRoles, notFound, parseRoles, readOnlyQueryTool, readOperatorSettings, readWriteQueryTool, requestApproval, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setUserBanned, setUserRole, signInPolicyMethods, streamChatCompletion, unauthorized, widget, withCacheBreakpoints };
+export { type Admin, type AdminAuth, type AdminOptions, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type ChatMessage, type ChatTextPart, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CreateAdminInput, type CreateAuthOptions, HttpProblem, type IssueTokenOptions, type JwtOptions, type LinkedAccount, ModelError, type ModelSettings, type NewUser, type OperatorProvider, type PipelineHook, type PlatformSignIn, type ProjectConfig, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type ResourceSource, type RuntimeOptions, type ScanGuardMode, type Session, type SignInPolicy, type SignInRule, type StaffAccessRule, type StaffSignIn, type StoredUser, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WidgetOptions, type WriteEvent, type WriteOperation, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, checkAuthSchema, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createUser, defaultSignInPolicy, defineConfig, defineTool, deleteUser, fileConversationStore, forbidden, hasUsers, issueToken, jwtAuthenticator, listUsers, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, normalizeRoles, notFound, parseRoles, readOnlyQueryTool, readOperatorSettings, readPlatformSignIn, readWriteQueryTool, requestApproval, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setUserBanned, setUserRole, signInPolicyMethods, streamChatCompletion, unauthorized, widget, withCacheBreakpoints };

package/dist/index.js

@@ -12,6 +12,7 @@ import { ModelError, streamChatCompletion } from "./assistant/chat-completions.j
 import { runTurn } from "./assistant/turn.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { readOperatorSettings } from "./better-auth/operator-provider.js";
+import { readPlatformSignIn } from "./better-auth/platform-sign-in.js";
 import { defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
 import { createAuth, normalizeRoles } from "./better-auth/create-auth.js";
@@ -23,5 +24,6 @@ import { defineConfig, mergeConfig } from "./project-config.js";
 import { jwtAuthenticator } from "./auth/jwt.js";
 import { betterAuthAuthenticator } from "./better-auth/authenticator.js";
 import { issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
+import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
 import { maxWidgetPropsBytes, widget } from "./assistant/widget.js";
-export { HttpProblem, ModelError, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, badRequest, betterAuthAuthenticator, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createUser, defaultSignInPolicy, defineConfig, defineTool, deleteUser, fileConversationStore, forbidden, hasUsers, issueToken, jwtAuthenticator, listUsers, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, normalizeRoles, notFound, parseRoles, readOnlyQueryTool, readOperatorSettings, readWriteQueryTool, requestApproval, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setUserBanned, setUserRole, signInPolicyMethods, streamChatCompletion, unauthorized, widget, withCacheBreakpoints };
+export { HttpProblem, ModelError, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, checkAuthSchema, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createUser, defaultSignInPolicy, defineConfig, defineTool, deleteUser, fileConversationStore, forbidden, hasUsers, issueToken, jwtAuthenticator, listUsers, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, normalizeRoles, notFound, parseRoles, readOnlyQueryTool, readOperatorSettings, readPlatformSignIn, readWriteQueryTool, requestApproval, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setUserBanned, setUserRole, signInPolicyMethods, streamChatCompletion, unauthorized, widget, withCacheBreakpoints };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,9 +30,9 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.5.0",
-    "@protobase/query": "0.5.0",
-    "@protobase/schema": "0.5.0",
+    "@protobase/layout": "0.6.0",
+    "@protobase/query": "0.6.0",
+    "@protobase/schema": "0.6.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@simplewebauthn/server": "^13.3.1",
     "better-auth": "^1.7.7",