@protobase/server 0.58.5 → 0.58.7

package/dist/better-auth/auth-settings.d.ts

@@ -8819,6 +8819,10 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
     column: (name: UserColumn) => string;
     fieldNames: Record<string, string>;
     metadata: string | undefined;
+    keyTable: {
+      schema: string;
+      table: string;
+    } | undefined;
   };
   socialProviders: string[];
   appName: string;

package/dist/better-auth/auth-tables.d.ts

@@ -1,6 +1,10 @@
 import { AdminAuth } from "./create-auth.js";
 //#region src/better-auth/auth-tables.d.ts
-/** The admin store's tables, which the assistant's queries and the app's resources must never read: the user table and `storeTableNames`. */
+/**
+ * The admin store's tables, which the assistant's queries and the app's resources must never read: the user table and
+ * `storeTableNames`, and with `users.keyTable` the table under the user view too, such as Supabase's `auth.users`,
+ * whose password hashes the view leaves out but the table holds.
+ */
 export declare const authStoreTables: (auth: AdminAuth) => {
   schema: string | undefined;
   name: string;

package/dist/better-auth/auth-tables.js

@@ -1,13 +1,21 @@
 import { storeNames } from "./store/store-names.js";
 import { storeTableNames } from "./store/table-names.js";
 //#region src/better-auth/auth-tables.ts
-/** The admin store's tables, which the assistant's queries and the app's resources must never read: the user table and `storeTableNames`. */
+/**
+* The admin store's tables, which the assistant's queries and the app's resources must never read: the user table and
+* `storeTableNames`, and with `users.keyTable` the table under the user view too, such as Supabase's `auth.users`,
+* whose password hashes the view leaves out but the table holds.
+*/
 const authStoreTables = (auth) => {
 	const { schema, users } = storeNames(auth);
-	return [users.modelName, ...storeTableNames].map((name) => ({
+	const own = [users.modelName, ...storeTableNames].map((name) => ({
 		schema,
 		name
 	}));
+	return users.keyTable ? [...own, {
+		schema: users.keyTable.schema,
+		name: users.keyTable.table
+	}] : own;
 };
 //#endregion
 export { authStoreTables };

package/dist/better-auth/create-auth.d.ts

@@ -8958,6 +8958,10 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
     column: (name: UserColumn) => string;
     fieldNames: Record<string, string>;
     metadata: string | undefined;
+    keyTable: {
+      schema: string;
+      table: string;
+    } | undefined;
   };
   socialProviders: string[];
   /** The app's name it signs in and mails as: `PROTOBASE_APP_NAME`, else `appName`, else `Protobase`. */

package/dist/better-auth/store/drift.js

@@ -1,5 +1,18 @@
+import { storeNames } from "./store-names.js";
+import { storeDb } from "./store-db.js";
+import { sql } from "kysely";
+import { getSchema } from "better-auth/db";
 import { getMigrations } from "better-auth/db/migration";
 //#region src/better-auth/store/drift.ts
+/** Each column of Better Auth's user model the view lacks, or the view itself when there is none. */
+const userViewDrift = async (auth) => {
+	const { schema, users } = storeNames(auth);
+	const { rows } = await sql`select column_name as "column" from information_schema.columns
+    where table_schema = ${schema ?? sql`current_schema()`} and table_name = ${users.modelName}`.execute(storeDb(auth));
+	if (rows.length === 0) return [`lacks the view ${users.modelName}`];
+	const found = new Set(rows.map(({ column }) => column));
+	return ["id", ...Object.keys(getSchema(auth.options)[users.modelName]?.fields ?? {})].filter((column) => !found.has(column)).map((column) => `lacks the column ${users.modelName}.${column}`);
+};
 /**
 * What Better Auth, with the features the app turns on, finds the store lacks or has otherwise: tables, `table.column`s,
 * indexes and its other findings; none when the store matches. It compares the database's tables, so only
@@ -7,12 +20,14 @@ import { getMigrations } from "better-auth/db/migration";
 */
 const authSchemaDrift = async (auth) => {
 	const { toBeCreated, toBeAdded, toBeAddedIndexes, schemaProblems } = await getMigrations(auth.options, { throwOnUnsafe: false });
-	return [
-		...toBeCreated.map(({ table }) => `lacks the table ${table}`),
-		...toBeAdded.flatMap(({ table, fields }) => Object.keys(fields).map((field) => `lacks the column ${table}.${field}`)),
-		...toBeAddedIndexes.map(({ name }) => `lacks the index ${name}`),
+	const view = auth.userTable.keyTable ? auth.userTable.modelName : void 0;
+	const tables = [
+		...toBeCreated.filter(({ table }) => table !== view).map(({ table }) => `lacks the table ${table}`),
+		...toBeAdded.filter(({ table }) => table !== view).flatMap(({ table, fields }) => Object.keys(fields).map((field) => `lacks the column ${table}.${field}`)),
+		...toBeAddedIndexes.filter(({ table }) => table !== view).map(({ name }) => `lacks the index ${name}`),
 		...schemaProblems
 	];
+	return view ? [...tables, ...await userViewDrift(auth)] : tables;
 };
 //#endregion
 export { authSchemaDrift };

package/dist/better-auth/store/migrations/001-core.js

@@ -11,9 +11,10 @@ const core = {
 		"verification",
 		"jwks"
 	],
-	statements: ({ table, user, userColumn: column, metadata, id, idRef }) => [
-		ddl`create table if not exists ${user} (id ${id} primary key)`,
-		ddl`alter table ${user}
+	statements: ({ table, user, userDdl, userColumn: column, metadata, id, idRef }) => [
+		...userDdl([
+			ddl`create table if not exists ${user} (id ${id} primary key)`,
+			ddl`alter table ${user}
   add column if not exists ${column("name")} text not null,
   add column if not exists ${column("email")} text not null unique,
   add column if not exists ${column("email_verified")} boolean not null,
@@ -26,7 +27,8 @@ const core = {
   add column if not exists ${column("ban_expires")} timestamptz,
   add column if not exists ${column("last_role")} text,
   add column if not exists ${column("email_confirmed_at")} timestamptz`,
-		...metadata ? [ddl`alter table ${user} add column if not exists ${metadata} jsonb`] : [],
+			...metadata ? [ddl`alter table ${user} add column if not exists ${metadata} jsonb`] : []
+		]),
 		ddl`create table ${table("session")} (
   id ${id} primary key,
   expires_at timestamptz not null,

package/dist/better-auth/store/migrations/002-two-factor.js

@@ -6,8 +6,8 @@ const twoFactor = {
 	name: "two_factor",
 	title: "The authenticator secrets and backup codes of two-step sign-in",
 	tables: ["two_factor"],
-	statements: ({ table, user, userColumn: column, id, idRef }) => [
-		ddl`alter table ${user} add column if not exists ${column("two_factor_enabled")} boolean`,
+	statements: ({ table, user, userDdl, userColumn: column, id, idRef }) => [
+		...userDdl([ddl`alter table ${user} add column if not exists ${column("two_factor_enabled")} boolean`]),
 		ddl`create table ${table("two_factor")} (
   id ${id} primary key,
   secret text not null,

package/dist/better-auth/store/migrations/006-organizations.js

@@ -10,8 +10,8 @@ const organizations = {
 		"member",
 		"invitation"
 	],
-	statements: ({ table, user, userColumn: column, id, idRef }) => [
-		ddl`alter table ${user} add column if not exists ${column("last_organization_id")} text`,
+	statements: ({ table, user, userDdl, userColumn: column, id, idRef }) => [
+		...userDdl([ddl`alter table ${user} add column if not exists ${column("last_organization_id")} text`]),
 		ddl`alter table ${table("session")} add column active_organization_id text`,
 		ddl`create table ${table("organization")} (
   id ${id} primary key,

package/dist/better-auth/store/migrations/migration.js

@@ -4,7 +4,8 @@ import { sql } from "kysely";
 /** The `ddl` parts of the app's names. */
 const migrationNames = (names) => ({
 	table: (name) => storeTable(names, name),
-	user: storeTable(names, names.users.modelName),
+	user: names.users.keyTable ? sql.id(names.users.keyTable.schema, names.users.keyTable.table) : storeTable(names, names.users.modelName),
+	userDdl: (statements) => names.users.keyTable ? [] : statements,
 	userColumn: names.users.column,
 	metadata: names.users.metadata,
 	id: sql.raw(names.uuidIds ? "uuid default pg_catalog.gen_random_uuid()" : "text"),

package/dist/better-auth/user-table.d.ts

@@ -28,5 +28,14 @@ export type UserTableOptions = {
   columns?: Partial<Record<UserColumn, string>>;
   /** A JSON column that holds each user's metadata, such as `raw_user_meta_data`; none by default. */
   metadata?: string;
+  /**
+   * The table that holds the user ids, when `table` is a view over another system's user table, such as
+   * `{ schema: 'auth', table: 'users' }` under a view over Supabase's `auth.users`: the store's migrations then make
+   * nothing of the user table, which the app's own migration makes, and every foreign key points at this table.
+   */
+  keyTable?: {
+    schema: string;
+    table: string;
+  };
 };
 //#endregion

package/dist/better-auth/user-table.js

@@ -17,7 +17,7 @@ const userFields = {
 	last_organization_id: "lastOrganizationId"
 };
 /** The user table's names, from `auth.users` option; unknown columns are an error. */
-const userTable = ({ table = "user", columns = {}, metadata } = {}) => {
+const userTable = ({ table = "user", columns = {}, metadata, keyTable } = {}) => {
 	const unknown = Object.keys(columns).find((name) => !(name in userFields));
 	if (unknown !== void 0) throw new Error(`users.columns names "${unknown}", which is not a column of the user table: ${Object.keys(userFields).join(", ")}`);
 	const column = (name) => columns[name] ?? name;
@@ -25,7 +25,8 @@ const userTable = ({ table = "user", columns = {}, metadata } = {}) => {
 		modelName: table,
 		column,
 		fieldNames: Object.fromEntries(Object.entries(userFields).map(([name, field]) => [field, column(name)])),
-		metadata
+		metadata,
+		keyTable
 	};
 };
 /** Better Auth's `user` option: the table and its core columns. */

package/dist/calls/call-member.d.ts

@@ -0,0 +1,14 @@
+import { CallRemoteTrack, CallTrackSource } from "@protobase/schema/internal";
+//#region src/calls/call-member.d.ts
+/** One member admitted to one call, with what they may send and hear. */
+export type CallMember = {
+  /** The call, as the app names it: members with the same call meet. */
+  call: string;
+  /** Who joins, unique in the call, such as the user's id: the media server knows them by nothing else. */
+  member: string;
+  /** Whether the member may send media, or only these sources; nothing when `false`. */
+  publish: boolean | CallTrackSource[];
+  /** Which of the other members' tracks the member hears; every one by default. */
+  hears?: (track: CallRemoteTrack) => boolean;
+};
+//#endregion

package/dist/calls/calls-access.d.ts

@@ -0,0 +1,13 @@
+import { SocketEvents } from "../functions/function-socket.js";
+import { CallMember } from "./call-member.js";
+//#region src/calls/calls-access.d.ts
+/** What a function admits members to calls with. */
+export type CallsAccess = {
+  /**
+   * The member's media session in the call, as the events of the socket the function accepts for them: return
+   * `acceptWebSocket(await calls.join(member))` once the function decided the caller may join. The browser's
+   * `joinCall` from `@protobase/client/calls` speaks to it. Rejects when the app has no `calls` configured.
+   */
+  join: (member: CallMember) => Promise<SocketEvents>;
+};
+//#endregion

package/dist/calls/calls-access.js

@@ -0,0 +1,25 @@
+//#region src/calls/calls-access.ts
+const checkMember = ({ call, member }) => {
+	if (typeof call !== "string" || call.length === 0) throw new TypeError("calls.join needs the call, a non-empty string");
+	if (typeof member !== "string" || member.length === 0) throw new TypeError("calls.join needs the member, a non-empty string");
+};
+const loadBackend = async (settings) => {
+	if (settings.kind === "livekit") return (await import("./livekit/livekit-session.js")).liveKitBackend(settings);
+	return (await import("./peer/peer-backend.js")).peerBackend(settings);
+};
+/**
+* Calls as a function sees them: each member's socket goes through the relay to the configured plugin, made once, at
+* the first join, so an app without calls loads none of their code.
+*/
+const callsAccess = (options) => {
+	let backend;
+	return { join: async (member) => {
+		if (!options) throw new Error("This app has no calls: configure calls: { backend } in protobase.config.ts");
+		checkMember(member);
+		backend ??= loadBackend(options.backend);
+		const [{ memberRelay }, plugin] = await Promise.all([import("./member-relay.js"), backend]);
+		return memberRelay(plugin, member);
+	} };
+};
+//#endregion
+export { callsAccess };

package/dist/calls/calls-options.d.ts

@@ -0,0 +1,33 @@
+//#region src/calls/calls-options.d.ts
+/** A LiveKit server, self-hosted or LiveKit Cloud, that carries the calls' media. */
+export type LiveKitBackend = {
+  kind: 'livekit';
+  /** Its address, such as `wss://livekit.example.com` or `ws://127.0.0.1:7880`. */
+  url: string;
+  /** The API key and secret Protobase signs each member's LiveKit token with. */
+  apiKey: string;
+  apiSecret: string;
+};
+/** An ICE server the members' browsers reach each other through, such as a STUN or TURN server. */
+export type CallIceServer = {
+  urls: string[];
+  username?: string;
+  credential?: string;
+};
+/**
+ * No media server: each member's browser sends its media to every other member's, and Protobase passes their offers,
+ * answers and candidates between them. For small calls; members meet only on the same process.
+ */
+export type PeerBackend = {
+  kind: 'peer';
+  iceServers?: CallIceServer[];
+};
+/** The media plugin a call's members send and receive their media through. */
+export type CallBackend = LiveKitBackend | PeerBackend;
+/** Calls: the media plugin behind them. Without `calls`, an app loads none of the calls code. */
+export type CallsOptions = {
+  backend: CallBackend;
+};
+/** The options, or an error naming what is wrong with them: the backend's kind and each of its settings. */
+export declare const checkCallsOptions: (options: CallsOptions) => CallsOptions;
+//#endregion

package/dist/calls/calls-options.js

@@ -0,0 +1,21 @@
+//#region src/calls/calls-options.ts
+const nonEmpty = (value) => typeof value === "string" && value.length > 0;
+/** The options, or an error naming what is wrong with them: the backend's kind and each of its settings. */
+const checkCallsOptions = (options) => {
+	const backend = options?.backend;
+	if (backend?.kind === "peer") {
+		const servers = backend.iceServers;
+		if (servers !== void 0 && (!Array.isArray(servers) || servers.some((server) => !Array.isArray(server?.urls) || !server.urls.every(nonEmpty)))) throw new Error("calls.backend.iceServers must be a list of { urls: string[], username?, credential? }");
+		return options;
+	}
+	if (backend?.kind !== "livekit") throw new Error(`calls.backend.kind must be 'livekit' or 'peer', not ${JSON.stringify(backend?.kind)}`);
+	for (const key of [
+		"url",
+		"apiKey",
+		"apiSecret"
+	]) if (!nonEmpty(backend[key])) throw new Error(`calls.backend.${key} must be a non-empty string, such as from an environment variable`);
+	if (!/^(wss?|https?):\/\//.test(backend.url)) throw new Error(`calls.backend.url must start with wss://, ws://, https:// or http://, not ${backend.url}`);
+	return options;
+};
+//#endregion
+export { checkCallsOptions };

package/dist/calls/client-message.js

@@ -0,0 +1,106 @@
+import { z } from "zod";
+//#region src/calls/client-message.ts
+const id = z.string().min(1).max(256);
+const sdp = z.string().min(1).max(262144);
+const kind = z.enum(["audio", "video"]);
+const size = z.number().int().min(0).max(16384);
+const layer = z.strictObject({
+	quality: z.enum([
+		"low",
+		"medium",
+		"high"
+	]),
+	width: size,
+	height: size,
+	bitrate: z.number().int().min(0).max(1e8)
+});
+const source = z.enum([
+	"camera",
+	"microphone",
+	"screen",
+	"screen-audio"
+]);
+const track = z.strictObject({
+	cid: id,
+	kind,
+	source,
+	width: size.optional(),
+	height: size.optional(),
+	layers: z.array(layer).max(3).optional()
+});
+const candidate = z.strictObject({
+	candidate: z.string().max(4096),
+	sdpMid: z.string().max(64).nullable().optional(),
+	sdpMLineIndex: z.number().int().min(0).max(1024).nullable().optional(),
+	usernameFragment: z.string().max(256).nullable().optional()
+});
+const description = z.strictObject({
+	type: z.enum(["offer", "answer"]),
+	sdp
+});
+const message = z.discriminatedUnion("type", [
+	z.strictObject({ type: z.literal("join") }),
+	z.strictObject({
+		type: z.literal("resume"),
+		participant: id,
+		offer: sdp.optional(),
+		answer: sdp.optional(),
+		tracks: z.array(z.strictObject({
+			cid: id,
+			sid: id,
+			kind,
+			source
+		})).max(16)
+	}),
+	z.strictObject({
+		type: z.literal("publish"),
+		tracks: z.array(track).min(1).max(4)
+	}),
+	z.strictObject({
+		type: z.literal("offer"),
+		sdp,
+		id: z.number().int().min(0)
+	}),
+	z.strictObject({
+		type: z.literal("candidate"),
+		candidate
+	}),
+	z.strictObject({
+		type: z.literal("unpublish"),
+		sid: id
+	}),
+	z.strictObject({
+		type: z.literal("mute"),
+		sid: id,
+		muted: z.boolean()
+	}),
+	z.strictObject({
+		type: z.literal("signal"),
+		to: id,
+		description: description.optional(),
+		candidate: candidate.optional()
+	}),
+	z.strictObject({
+		type: z.literal("view"),
+		sids: z.array(id).min(1).max(256),
+		width: size,
+		height: size,
+		hidden: z.boolean().optional()
+	}),
+	z.strictObject({ type: z.literal("leave") })
+]);
+/** A browser's message, or `undefined` when it is no message of the call protocol. */
+const parseClientMessage = (data) => {
+	if (typeof data !== "string") return void 0;
+	let json;
+	try {
+		json = JSON.parse(data);
+	} catch (error) {
+		if (error instanceof SyntaxError) return void 0;
+		throw error;
+	}
+	const parsed = message.safeParse(json);
+	return parsed.success ? parsed.data : void 0;
+};
+//#endregion
+export { parseClientMessage };

package/dist/calls/livekit/join-url.js

@@ -0,0 +1,33 @@
+import { ClientInfo, ClientInfo_SDK, ConnectionSettings, JoinRequest, WrappedJoinRequest, WrappedJoinRequest_Compression } from "@livekit/protocol";
+/** The bridge as LiveKit's client info names it. */
+const clientInfo = () => new ClientInfo({
+	sdk: ClientInfo_SDK.UNKNOWN,
+	protocol: 17,
+	version: "protobase-calls-1"
+});
+/**
+* The single peer connection signal endpoint (`/rtc/v1`) with the member's token and join request. The request is
+* standard base64 with `+` and `/` replaced and the `=` padding kept, which LiveKit's decoder needs.
+*/
+const joinUrl = (base, token, { resume }) => {
+	const join = new JoinRequest({
+		clientInfo: clientInfo(),
+		connectionSettings: new ConnectionSettings({
+			autoSubscribe: false,
+			adaptiveStream: false
+		}),
+		reconnect: resume !== void 0,
+		participantSid: resume?.participant ?? ""
+	});
+	const wrapped = new WrappedJoinRequest({
+		compression: WrappedJoinRequest_Compression.NONE,
+		joinRequest: join.toBinary()
+	});
+	const encoded = Buffer.from(wrapped.toBinary()).toString("base64").replaceAll("+", "-").replaceAll("/", "_");
+	const url = new URL("rtc/v1", `${base.replace(/\/+$/, "")}/`);
+	url.searchParams.set("access_token", token);
+	url.searchParams.set("join_request", encoded);
+	return url.href;
+};
+//#endregion
+export { joinUrl };