@protobase/server 0.53.7 → 0.54.0

package/dist/better-auth/auth-settings.d.ts

@@ -74,6 +74,35 @@ export declare const appAuthOptions: (settings: AuthSettings, { pool, db, hooks,
 /** The app's Better Auth from its `auth` settings, built at serve time with only the plugins they turn on. */
 export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput) => Promise<import("better-auth").Auth<{
   user: {
+    deleteUser: {
+      enabled: boolean;
+      beforeDelete: (user: {
+        id: string;
+        email: string;
+      }) => Promise<void>;
+      afterDelete: (user: {
+        id: string;
+      }) => Promise<void>;
+    };
+    additionalFields?: {
+      metadata?: {
+        readonly type: "json";
+        readonly required: false;
+        readonly fieldName: string;
+      } | undefined;
+      lastOrganizationId?: {
+        readonly type: "string";
+        readonly required: false;
+        readonly input: false;
+        readonly fieldName: "last_organization_id";
+      } | undefined;
+      emailConfirmedAt: {
+        readonly type: "date";
+        readonly required: false;
+        readonly input: false;
+        readonly fieldName: "email_confirmed_at";
+      };
+    } | undefined;
     modelName: string;
     fields: {
       name: string;
@@ -84,7 +113,8 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
       updatedAt: string;
     };
   } | {
-    additionalFields: {
+    deleteUser?: undefined;
+    additionalFields?: {
       metadata?: {
         readonly type: "json";
         readonly required: false;
@@ -102,7 +132,7 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
         readonly input: false;
         readonly fieldName: "email_confirmed_at";
       };
-    };
+    } | undefined;
     modelName: string;
     fields: {
       name: string;
@@ -8751,6 +8781,7 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
   signInFirst: "password" | "emailCode";
   passwordReset: boolean;
   leakedPasswords: boolean;
+  accountDeletion: boolean;
   signUp: boolean;
   signUpRole: string | undefined;
   userMetadata: boolean;

package/dist/better-auth/create-auth.d.ts

@@ -135,6 +135,12 @@ export type CreateAuthOptions = {
    * the password's SHA-1 hash leave the server. While the list cannot be reached, setting a password fails. Default off.
    */
   leakedPasswords?: boolean;
+  /**
+   * Lets the signed-in person delete their own account from the account page, with their password or from a session
+   * that signed in within the last day; `false` turns it off, for apps whose accounts are managed by an organization's
+   * admins. Default on, as app stores require an app that makes accounts to delete them too.
+   */
+  accountDeletion?: boolean;
   /**
    * The identity provider the operator's staff sign in with to sign in as people of this app, for support. Defaults
    * to the one the platform passes in `PROTOBASE_OPERATOR_ISSUER`, `PROTOBASE_OPERATOR_CLIENT_ID` and
@@ -193,6 +199,35 @@ export type AuthPlugins = {
 export declare const loadAuthPlugins: (options: Pick<CreateAuthOptions, "sso" | "mcp">) => Promise<AuthPlugins>;
 export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlugins) => import("better-auth").Auth<{
   user: {
+    deleteUser: {
+      enabled: boolean;
+      beforeDelete: (user: {
+        id: string;
+        email: string;
+      }) => Promise<void>;
+      afterDelete: (user: {
+        id: string;
+      }) => Promise<void>;
+    };
+    additionalFields?: {
+      metadata?: {
+        readonly type: "json";
+        readonly required: false;
+        readonly fieldName: string;
+      } | undefined;
+      lastOrganizationId?: {
+        readonly type: "string";
+        readonly required: false;
+        readonly input: false;
+        readonly fieldName: "last_organization_id";
+      } | undefined;
+      emailConfirmedAt: {
+        readonly type: "date";
+        readonly required: false;
+        readonly input: false;
+        readonly fieldName: "email_confirmed_at";
+      };
+    } | undefined;
     modelName: string;
     fields: {
       name: string;
@@ -203,7 +238,8 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
       updatedAt: string;
     };
   } | {
-    additionalFields: {
+    deleteUser?: undefined;
+    additionalFields?: {
       metadata?: {
         readonly type: "json";
         readonly required: false;
@@ -221,7 +257,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         readonly input: false;
         readonly fieldName: "email_confirmed_at";
       };
-    };
+    } | undefined;
     modelName: string;
     fields: {
       name: string;
@@ -1364,7 +1400,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent? /** Public origin of the API, for example `https://admin.example.com`. Issuer and audience of the tokens; new passkeys are made for its host unless `passkeyDomain` names another. */ : string | null | undefined;
+              userAgent?: string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -1757,7 +1793,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
           email: string;
           emailVerified: boolean;
           name: string;
-          image?: string | null | undefined;
+          image? /** Runs after a user is created, by any route: `createUser`, an admin, or a social sign-up. Default none. */ : string | null | undefined;
         }) | import("better-auth/plugins").UserWithTwoFactor;
       }>;
       generateBackupCodes: import("better-call").StrictEndpoint<"/two-factor/generate-backup-codes", {
@@ -1952,9 +1988,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
           email: string;
           emailVerified: boolean;
           name: string;
-          image?
-          /** The app's name, from `PROTOBASE_APP_NAME` or `appName`; default `Protobase`. */
-          /** The app's name, from `PROTOBASE_APP_NAME` or `appName`; default `Protobase`. */ : string | null | undefined;
+          image?: string | null | undefined;
         };
       }>;
       generateTOTP: import("better-call").StrictEndpoint<string, {
@@ -5023,7 +5057,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         organization: {
           name?: string;
           slug?: string;
-          logo? /** Encrypt the OAuth access, refresh and ID tokens Better Auth stores for social sign-ins, with `secret`. Default off. */ : string | null;
+          logo?: string | null;
           metadata?: Record<string, any>;
           [key: string]: any;
         };
@@ -8881,6 +8915,8 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
   passwordReset: boolean;
   /** New passwords are checked against Have I Been Pwned's list of leaked ones (`leakedPasswords`). */
   leakedPasswords: boolean;
+  /** The signed-in person can delete their own account (`accountDeletion`). */
+  accountDeletion: boolean;
   /** Open sign-up is on and offered: the app asks for it, and can mail the codes. */
   signUp: boolean;
   /** The role of accounts made by open sign-up, while it is offered. */

package/dist/better-auth/create-auth.js

@@ -19,8 +19,9 @@ import { setPasswordPath, setPasswordPlugin } from "./set-password.js";
 import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
 import { leakedPasswordsPlugin } from "./leaked-passwords.js";
 import { lockedAccountsPlugin, readLockedAccounts } from "./locked-accounts.js";
-import { userDeletion } from "./user-deletion.js";
 import { revokeMcpGrants } from "./mcp/revoke-grants.js";
+import { selfDeletionCallbackPath, selfDeletionOptions, selfDeletionPath } from "./self-deletion.js";
+import { userDeletion } from "./user-deletion.js";
 import { mcpUnusedPaths, resolveMcp } from "./mcp/mcp-plugins.js";
 import { lastOrganizationField, sessionOrganizationHooks } from "./organizations/session-organization.js";
 import { organizationPlugin } from "./organizations/organization-plugin.js";
@@ -149,6 +150,13 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 		...organizations && userFieldsNamed(lastOrganizationField, users),
 		...metadataField(users)
 	};
+	const accountDeletion = options.accountDeletion !== false;
+	const deleteUser = accountDeletion ? { deleteUser: selfDeletionOptions({
+		lockedAccounts,
+		mcp: Boolean(mcp),
+		adapter: async () => (await context()).adapter,
+		...deletion && { deletion }
+	}) } : {};
 	return {
 		appName,
 		database: options.database,
@@ -167,10 +175,11 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			...mail && passwordResetOptions(mail, mcp ? { onPasswordReset: async ({ user }) => revokeMcpGrants((await context()).adapter, user.id) } : {})
 		},
 		...options.socialProviders && { socialProviders: options.socialProviders },
-		user: Object.keys(userFields).length > 0 ? {
+		user: {
 			...userModel(users),
-			additionalFields: userFields
-		} : userModel(users),
+			...Object.keys(userFields).length > 0 && { additionalFields: userFields },
+			...deleteUser
+		},
 		session: coreNames.session,
 		verification: coreNames.verification,
 		account: {
@@ -252,6 +261,8 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			}) : []
 		].map((plugin) => withUserColumns(plugin, users)),
 		disabledPaths: [
+			selfDeletionCallbackPath,
+			...accountDeletion ? [] : [selfDeletionPath],
 			...unusedEmailCodePaths,
 			...adminImpersonationPaths,
 			...organizations ? organizationPaths : [],
@@ -385,7 +396,7 @@ const createAuth = (options, plugins = {}) => {
 		signInPolicy,
 		...organizations && { organizations },
 		...mcp && { mcp },
-		...(organizations || mcp) && { context }
+		context
 	});
 	assertNoEndpointKeyClashes(authOptions.plugins);
 	const auth = betterAuth(authOptions);
@@ -424,6 +435,8 @@ const createAuth = (options, plugins = {}) => {
 		passwordReset: Boolean(mailer),
 		/** New passwords are checked against Have I Been Pwned's list of leaked ones (`leakedPasswords`). */
 		leakedPasswords: Boolean(options.leakedPasswords),
+		/** The signed-in person can delete their own account (`accountDeletion`). */
+		accountDeletion: options.accountDeletion !== false,
 		/** Open sign-up is on and offered: the app asks for it, and can mail the codes. */
 		signUp: Boolean(signUpRole && mailer),
 		/** The role of accounts made by open sign-up, while it is offered. */

package/dist/better-auth/last-admin-guard.js

@@ -29,6 +29,13 @@ const adminChange = (path, body) => {
 		...banned !== void 0 && { banned }
 	};
 };
+/** Refuses, with `400 LAST_ADMIN`, a change that would leave no active admin. */
+const refuseLastAdmin = () => {
+	throw new APIError("BAD_REQUEST", {
+		code: "LAST_ADMIN",
+		message: "This is the last admin: make someone else an admin first."
+	});
+};
 const guardedPaths = [
 	"/admin/set-role",
 	"/admin/ban-user",
@@ -51,12 +58,9 @@ const lastAdminGuardPlugin = () => ({
 					"banned"
 				]
 			});
-			if (wouldLeaveNoAdmin(users, change)) throw new APIError("BAD_REQUEST", {
-				code: "LAST_ADMIN",
-				message: "This is the last admin: make someone else an admin first."
-			});
+			if (wouldLeaveNoAdmin(users, change)) refuseLastAdmin();
 		})
 	}] }
 });
 //#endregion
-export { adminChange, lastAdminGuardPlugin };
+export { adminChange, lastAdminGuardPlugin, refuseLastAdmin };

package/dist/better-auth/locked-accounts.js

@@ -22,7 +22,8 @@ const lockedFields = {
 		"updatedAt"
 	].includes(field)
 };
-const refuse = () => {
+/** Refuses, with `403 ACCOUNT_LOCKED`, a change to or the deletion of a locked account. */
+const refuseLockedAccount = () => {
 	throw new APIError("FORBIDDEN", {
 		code: "ACCOUNT_LOCKED",
 		message: "This account is locked: its address, password, passkeys, two-factor authentication and linked accounts stay as they are, and it cannot be deleted."
@@ -55,10 +56,10 @@ const lockAccounts = (adapter, emails) => {
 	};
 	const checkUpdate = async (model, where, fields) => {
 		const locked = lockedFields[model];
-		if (locked && fields.some(locked) && await matchesLocked(model, where)) refuse();
+		if (locked && fields.some(locked) && await matchesLocked(model, where)) refuseLockedAccount();
 	};
 	const checkDelete = async (model, where) => {
-		if (lockedFields[model] && await matchesLocked(model, where)) refuse();
+		if (lockedFields[model] && await matchesLocked(model, where)) refuseLockedAccount();
 	};
 	const checkCreate = async (model, data) => {
 		if (model === "user" || !lockedFields[model]) return;
@@ -70,7 +71,7 @@ const lockAccounts = (adapter, emails) => {
 				value: data.userId
 			}]
 		}) === 0) return;
-		refuse();
+		refuseLockedAccount();
 	};
 	return {
 		...adapter,
@@ -120,4 +121,4 @@ const lockedAccountsPlugin = (emails) => ({
 	}
 });
 //#endregion
-export { lockAccounts, lockedAccountsPlugin, lockedAccountsVariable, readLockedAccounts };
+export { lockAccounts, lockedAccountsPlugin, lockedAccountsVariable, readLockedAccounts, refuseLockedAccount };

package/dist/better-auth/self-deletion.js

@@ -0,0 +1,40 @@
+import { wouldLeaveNoAdmin } from "./last-admin.js";
+import { refuseLastAdmin } from "./last-admin-guard.js";
+import { refuseLockedAccount } from "./locked-accounts.js";
+import { revokeMcpGrants } from "./mcp/revoke-grants.js";
+//#region src/better-auth/self-deletion.ts
+/** The paths of Better Auth's own deletion of the signed-in person's account, and of its emailed confirmation, which Protobase does not send. */
+const selfDeletionPath = "/delete-user";
+const selfDeletionCallbackPath = "/delete-user/callback";
+/**
+* Better Auth's `user.deleteUser`: the signed-in person deletes their own account, with their password or from a
+* session that signed in within the last day. Once Better Auth has checked that, a locked account and the last active
+* admin are refused, the `userDeletion` listeners and the MCP grants go, and Better Auth deletes the user with their
+* sessions and accounts; the listeners run once more after.
+*/
+const selfDeletionOptions = ({ lockedAccounts, deletion, mcp, adapter }) => ({
+	enabled: true,
+	beforeDelete: async (user) => {
+		if (lockedAccounts.includes(user.email.toLowerCase())) refuseLockedAccount();
+		const store = await adapter();
+		const users = await store.findMany({
+			model: "user",
+			select: [
+				"id",
+				"role",
+				"banned"
+			]
+		});
+		if (wouldLeaveNoAdmin(users, {
+			userId: user.id,
+			removed: true
+		})) refuseLastAdmin();
+		await deletion?.run(user.id);
+		if (mcp) await revokeMcpGrants(store, user.id);
+	},
+	afterDelete: async (user) => {
+		await deletion?.run(user.id);
+	}
+});
+//#endregion
+export { selfDeletionCallbackPath, selfDeletionOptions, selfDeletionPath };

package/dist/better-auth/status-route.js

@@ -9,7 +9,7 @@ import { Hono } from "hono";
 * `GET {authBase}/status`: `needsAdmin` while the admin store has no user, so a login page can say how to create one;
 * `signInMethods`, the ways to sign in the sign-in policy leaves on (`password`, `emailCode`, `passkey`), so it offers
 * only those; `passwordReset` when reset mail can be sent and passwords are on, so it offers "Forgot password?" only
-* then; `signInFirst: 'emailCode'` when the app has the sign-in page lead with an emailed code and the policy leaves both it and passwords on; `changeEmail` when mail can be sent, so the account page offers to change the address with an emailed code; `signUp` when the app has open sign-up, so it offers "Create an account"; the ids of the `socialProviders` people can sign in with, so it offers "Continue with GitHub" when `github` is
+* then; `signInFirst: 'emailCode'` when the app has the sign-in page lead with an emailed code and the policy leaves both it and passwords on; `changeEmail` when mail can be sent, so the account page offers to change the address with an emailed code; `accountDeletion` when people may delete their own account, so the account page offers it; `signUp` when the app has open sign-up, so it offers "Create an account"; the ids of the `socialProviders` people can sign in with, so it offers "Continue with GitHub" when `github` is
 * one; `platformSignIn`, the id and name of the platform's provider when it is one of them; `samlProviders`, the id and name of each SAML provider, when the app has any; `staffSignIn`, the
 * operator provider's name, when staff can sign in as people; `passkeyDomains`, when people have passkeys for more than
 * one of the app's hosts, the RP IDs a passkey sign-in can ask for, the passkey domain first; with organizations, who may create them and the roles
@@ -39,6 +39,7 @@ const statusRoute = (auth, { anonymous = false, plugins = [], locale } = {}) =>
 			passwordReset: auth.passwordReset && policy.password === "allowed",
 			...auth.signInFirst === "emailCode" && signInMethods.includes("emailCode") && signInMethods.includes("password") && { signInFirst: "emailCode" },
 			...auth.mail && { changeEmail: true },
+			...auth.accountDeletion && { accountDeletion: true },
 			...auth.signUp && { signUp: true },
 			socialProviders,
 			...platformSignIn && { platformSignIn },

package/dist/better-auth/user-deletion.js

@@ -4,9 +4,10 @@ import { createAuthMiddleware, getSessionFromCtx, isAPIError } from "better-auth
 //#region src/better-auth/user-deletion.ts
 const removePath = "/admin/remove-user";
 /**
-* What runs when a user is deleted, by an admin (`/admin/remove-user`) or by `deleteUser` (the CLI): each listener
-* before anything is deleted, so one that throws stops the deletion with the user, their sessions and accounts in
-* place, and once more after the user is gone, for what was added in between.
+* What runs when a user is deleted, by an admin (`/admin/remove-user`), by `deleteUser` (the CLI) or by themselves
+* (`/delete-user`, see `selfDeletionOptions`): each listener before anything is deleted, so one that throws stops the
+* deletion with the user, their sessions and accounts in place, and once more after the user is gone, for what was
+* added in between.
 */
 const userDeletion = () => {
 	const listeners = /* @__PURE__ */ new Map();

package/dist/check-views.js

@@ -34,7 +34,7 @@ const sensitiveErrors = (view, model) => {
 		["the sidebar", layoutItems(view.layout).flatMap((item) => item.kind === "sidebar" ? item.fields : [])],
 		["a map", layoutItems(view.layout).flatMap((item) => item.kind === "map" ? [item.latitude, item.longitude] : [])],
 		["a gallery", layoutItems(view.layout).flatMap((item) => item.kind === "gallery" && item.image !== void 0 ? [item.image] : [])],
-		["the recent records", view.nav?.recent ? [view.nav.recent.status] : []],
+		["the recent records", view.nav?.recent?.status === void 0 ? [] : [view.nav.recent.status]],
 		["an action", view.actions.flatMap((action) => [...actionFields(action.run), ...actionWhenFields(action.when)])]
 	].flatMap(([place, names]) => [...new Set(names.filter(sensitive))].map((name) => `sensitive field "${name}" cannot be in ${place}`));
 };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.53.7";
+var version = "0.54.0";
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.53.7",
+  "version": "0.54.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -40,9 +40,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.53.7",
-    "@protobase/query": "0.53.7",
-    "@protobase/schema": "0.53.7",
+    "@protobase/layout": "0.54.0",
+    "@protobase/query": "0.54.0",
+    "@protobase/schema": "0.54.0",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",