@protobase/server 0.53.6 → 0.53.7

package/dist/better-auth/auth-settings.d.ts

@@ -160,6 +160,13 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-locked-accounts";
+    init: (ctx: import("better-auth").AuthContext) => {
+      context: {
+        adapter: import("better-auth").DBAdapter;
+      };
+    };
   } | {
     id: "admin";
     version: string;
@@ -970,8 +977,8 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
           $Infer: {
             body: {
               permissions: {
-                readonly user?: ("create" | "list" | "set-role" | "ban" | "impersonate" | "delete" | "set-password" | "set-email" | "get" | "update" | "impersonate-admins")[] | undefined;
-                readonly session?: ("list" | "delete" | "revoke")[] | undefined;
+                readonly user?: ("create" | "update" | "delete" | "list" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "get" | "impersonate-admins")[] | undefined;
+                readonly session?: ("delete" | "list" | "revoke")[] | undefined;
               };
             } & {
               userId?: string | undefined;

package/dist/better-auth/create-auth.d.ts

@@ -279,6 +279,13 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-locked-accounts";
+    init: (ctx: import("better-auth").AuthContext) => {
+      context: {
+        adapter: import("better-auth").DBAdapter;
+      };
+    };
   } | {
     id: "admin";
     version: string;
@@ -1089,8 +1096,8 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
           $Infer: {
             body: {
               permissions: {
-                readonly user?: ("create" | "list" | "set-role" | "ban" | "impersonate" | "delete" | "set-password" | "set-email" | "get" | "update" | "impersonate-admins")[] | undefined;
-                readonly session?: ("list" | "delete" | "revoke")[] | undefined;
+                readonly user?: ("create" | "update" | "delete" | "list" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "get" | "impersonate-admins")[] | undefined;
+                readonly session?: ("delete" | "list" | "revoke")[] | undefined;
               };
             } & {
               userId?: string | undefined;
@@ -1357,7 +1364,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
+              userAgent? /** Public origin of the API, for example `https://admin.example.com`. Issuer and audience of the tokens; new passkeys are made for its host unless `passkeyDomain` names another. */ : string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -1945,7 +1952,9 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
           email: string;
           emailVerified: boolean;
           name: string;
-          image?: string | null | undefined;
+          image?
+          /** The app's name, from `PROTOBASE_APP_NAME` or `appName`; default `Protobase`. */
+          /** The app's name, from `PROTOBASE_APP_NAME` or `appName`; default `Protobase`. */ : string | null | undefined;
         };
       }>;
       generateTOTP: import("better-call").StrictEndpoint<string, {
@@ -5014,7 +5023,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         organization: {
           name?: string;
           slug?: string;
-          logo?: string | null;
+          logo? /** Encrypt the OAuth access, refresh and ID tokens Better Auth stores for social sign-ins, with `secret`. Default off. */ : string | null;
           metadata?: Record<string, any>;
           [key: string]: any;
         };

package/dist/better-auth/create-auth.js

@@ -18,6 +18,7 @@ import { lastAdminGuardPlugin } from "./last-admin-guard.js";
 import { setPasswordPath, setPasswordPlugin } from "./set-password.js";
 import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
 import { leakedPasswordsPlugin } from "./leaked-passwords.js";
+import { lockedAccountsPlugin, readLockedAccounts } from "./locked-accounts.js";
 import { userDeletion } from "./user-deletion.js";
 import { revokeMcpGrants } from "./mcp/revoke-grants.js";
 import { mcpUnusedPaths, resolveMcp } from "./mcp/mcp-plugins.js";
@@ -62,6 +63,7 @@ const platformOperator = () => readOperatorSettings(globalThis.process?.env ?? {
 const platformSignInSettings = () => readPlatformSignIn(globalThis.process?.env ?? {});
 const platformOrigins = () => readOrigins(globalThis.process?.env ?? {});
 const platformPasskeyDomain = () => readPasskeyDomain(globalThis.process?.env ?? {});
+const platformLockedAccounts = () => readLockedAccounts(globalThis.process?.env ?? {});
 const tokenLifetime = "15m";
 /**
 * Better Auth for a single-tenant admin: sign-in with a password, an emailed code or a passkey, two-factor
@@ -88,7 +90,7 @@ const organizationPaths = ["/organization/set-active", "/organization/accept-inv
 * The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
 * sign-in provider already resolved.
 */
-const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, appName = defaultAppName, mailer, signUpRole, operator, platformSignIn, saml = [], organizations, mcp, context = noContext, signInPolicy = defaultSignInPolicy, mobile, deletion, ...plugins }) => {
+const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, appName = defaultAppName, mailer, signUpRole, operator, platformSignIn, saml = [], organizations, mcp, context = noContext, signInPolicy = defaultSignInPolicy, mobile, deletion, lockedAccounts = [], ...plugins }) => {
 	const secure = options.baseURL.startsWith("https://");
 	const signIn = platformSignInFor(platformSignIn, Object.keys(options.socialProviders ?? {}));
 	const hosts = passkeyHosts([options.baseURL, ...origins]);
@@ -177,6 +179,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			...options.encryptOAuthTokens && { encryptOAuthTokens: true }
 		},
 		plugins: [
+			...lockedAccounts.length > 0 ? [lockedAccountsPlugin(lockedAccounts)] : [],
 			admin({
 				schema: pluginNames.admin,
 				defaultRole: defaultRole ?? "unassigned",
@@ -362,10 +365,12 @@ const createAuth = (options, plugins = {}) => {
 	const context = () => instance?.$context ?? Promise.reject(/* @__PURE__ */ new Error("The auth instance is not made yet"));
 	const mobile = mobileRequests();
 	const deletion = userDeletion();
+	const lockedAccounts = platformLockedAccounts();
 	const authOptions = betterAuthOptions(options, {
 		...plugins,
 		mobile,
 		deletion,
+		lockedAccounts,
 		origins,
 		passkeyDomain,
 		roles,

package/dist/better-auth/locked-accounts.js

@@ -0,0 +1,123 @@
+import { APIError } from "better-auth/api";
+//#region src/better-auth/locked-accounts.ts
+const lockedAccountsVariable = "PROTOBASE_LOCKED_ACCOUNTS";
+/** The addresses the platform passes in `PROTOBASE_LOCKED_ACCOUNTS`, comma separated, in lower case; none when it is unset. */
+const readLockedAccounts = (env) => [...new Set((env["PROTOBASE_LOCKED_ACCOUNTS"] ?? "").split(",").map((email) => email.trim().toLowerCase()).filter(Boolean))];
+const lockedFields = {
+	user: (field) => [
+		"email",
+		"emailVerified",
+		"twoFactorEnabled"
+	].includes(field),
+	account: (field) => [
+		"userId",
+		"providerId",
+		"accountId",
+		"password"
+	].includes(field),
+	passkey: (field) => !["counter", "updatedAt"].includes(field),
+	twoFactor: (field) => ![
+		"failedVerificationCount",
+		"lockedUntil",
+		"updatedAt"
+	].includes(field)
+};
+const refuse = () => {
+	throw new APIError("FORBIDDEN", {
+		code: "ACCOUNT_LOCKED",
+		message: "This account is locked: its address, password, passkeys, two-factor authentication and linked accounts stay as they are, and it cannot be deleted."
+	});
+};
+/**
+* The adapter with the accounts of `emails` locked: their user's address, password, passkeys, two-factor
+* authentication and linked accounts stay as they are, and the user is not deleted, whatever endpoint or host call
+* writes. A locked account's first account row, made with its user, is the one write of those it allows.
+*/
+const lockAccounts = (adapter, emails) => {
+	const lockedIds = async () => new Set((await adapter.findMany({
+		model: "user",
+		where: [{
+			field: "email",
+			operator: "in",
+			value: emails
+		}],
+		select: ["id"]
+	})).map((user) => user.id));
+	const matchesLocked = async (model, where) => {
+		const ids = await lockedIds();
+		if (ids.size === 0) return false;
+		const owner = model === "user" ? "id" : "userId";
+		return (await adapter.findMany({
+			model,
+			where,
+			select: [owner]
+		})).some((row) => ids.has(row[owner]));
+	};
+	const checkUpdate = async (model, where, fields) => {
+		const locked = lockedFields[model];
+		if (locked && fields.some(locked) && await matchesLocked(model, where)) refuse();
+	};
+	const checkDelete = async (model, where) => {
+		if (lockedFields[model] && await matchesLocked(model, where)) refuse();
+	};
+	const checkCreate = async (model, data) => {
+		if (model === "user" || !lockedFields[model]) return;
+		if (!(await lockedIds()).has(data.userId)) return;
+		if (model === "account" && await adapter.count({
+			model: "account",
+			where: [{
+				field: "userId",
+				value: data.userId
+			}]
+		}) === 0) return;
+		refuse();
+	};
+	return {
+		...adapter,
+		create: async (data) => {
+			await checkCreate(data.model, data.data);
+			return adapter.create(data);
+		},
+		update: async (data) => {
+			await checkUpdate(data.model, data.where, Object.keys(data.update));
+			return adapter.update(data);
+		},
+		updateMany: async (data) => {
+			await checkUpdate(data.model, data.where, Object.keys(data.update));
+			return adapter.updateMany(data);
+		},
+		incrementOne: async (data) => {
+			await checkUpdate(data.model, data.where, [...Object.keys(data.increment), ...Object.keys(data.set ?? {})]);
+			return adapter.incrementOne(data);
+		},
+		delete: async (data) => {
+			await checkDelete(data.model, data.where);
+			return adapter.delete(data);
+		},
+		deleteMany: async (data) => {
+			await checkDelete(data.model, data.where);
+			return adapter.deleteMany(data);
+		},
+		consumeOne: async (data) => {
+			await checkDelete(data.model, data.where);
+			return adapter.consumeOne(data);
+		}
+	};
+};
+/**
+* Locks the accounts of `emails` (see `lockAccounts`) by guarding the auth store's adapter, which Better Auth's own
+* writes, its plugins' (passkeys and two-factor authentication write the store directly, past the database hooks)
+* and the host calls all go through, also in a transaction.
+*/
+const lockedAccountsPlugin = (emails) => ({
+	id: "protobase-locked-accounts",
+	init: (ctx) => {
+		const adapter = ctx.adapter;
+		return { context: { adapter: {
+			...lockAccounts(adapter, emails),
+			transaction: (callback) => adapter.transaction((trx) => callback(lockAccounts(trx, emails)))
+		} } };
+	}
+});
+//#endregion
+export { lockAccounts, lockedAccountsPlugin, lockedAccountsVariable, readLockedAccounts };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.53.6";
+var version = "0.53.7";
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.53.6",
+  "version": "0.53.7",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -40,9 +40,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.53.6",
-    "@protobase/query": "0.53.6",
-    "@protobase/schema": "0.53.6",
+    "@protobase/layout": "0.53.7",
+    "@protobase/query": "0.53.7",
+    "@protobase/schema": "0.53.7",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",