@protobase/server 0.58.6 → 0.58.8

package/dist/assistant/query-runner/query-runner.d.ts

@@ -6,16 +6,21 @@ export type TableName = {
   schema?: string;
   name: string;
 };
+/** The tables the role must never read: these, and every table in `schemas`, whatever its name. */
+export type GuardedTables = {
+  tables: readonly TableName[];
+  schemas: readonly string[];
+};
 /**
  * The SQL that makes the role the assistant's read-only queries run as, and its runner, and grants it exactly the
  * resources' tables, never an auth table; `undefined` when the database is current.
  */
-export declare const queryRunnerMigration: (db: Db, models: readonly ResourceModel[], authTables: readonly TableName[]) => Promise<string | undefined>;
+export declare const queryRunnerMigration: (db: Db, models: readonly ResourceModel[], authTables: GuardedTables) => Promise<string | undefined>;
 /**
  * Refuses to go on while the runner of the assistant's read-only queries is missing or out of date, or runs as a role
  * that is not weaker than the app's: the app's role itself or one it is a member of, a superuser, a login role, or one
  * that can read an auth table, or while the role may call a security-definer function that runs as a role able to
  * read one. It checks the owner's privileges, not its name, so a database cloned under another name still passes. A resource added since the last migration is not checked: Postgres refuses to read its table until then.
  */
-export declare const checkQueryRunner: (db: Db, authTables: readonly TableName[]) => Promise<void>;
+export declare const checkQueryRunner: (db: Db, authTables: GuardedTables) => Promise<void>;
 //#endregion

package/dist/assistant/query-runner/query-runner.js

@@ -8,6 +8,8 @@ const quoted = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
 const regclassText = ({ schema, name }) => schema ? `${quoted(schema)}.${quoted(name)}` : quoted(name);
 const roleSql = sql.raw(queryRoleSql);
 const rowsOf = async (db, query) => (await query.execute(db)).rows;
+const guardedRelations = ({ tables, schemas }) => sql`select c.oid, c.relnamespace from pg_class c join pg_namespace n on n.oid = c.relnamespace
+    where c.oid in (select to_regclass(t.name) from unnest(${tables.map(regclassText)}::text[]) as t(name)) or n.nspname = any(${[...schemas]}::text[])`;
 const resolved = (db, tables) => rowsOf(db, sql`select n.nspname as schema, c.relname as name from unnest(${tables.map(regclassText)}::text[]) with ordinality as t(name, n)
       join pg_class c on c.oid = to_regclass(t.name) join pg_namespace n on n.oid = c.relnamespace order by t.n`);
 const readRunner = async (db) => {
@@ -27,7 +29,8 @@ const readQueryRunner = async (db, models, authTables) => {
 		role,
 		runner: await readRunner(db),
 		resources: await resolved(db, models.map((model) => model.table)),
-		authTables: await resolved(db, authTables),
+		authTables: await resolved(db, authTables.tables),
+		guardedSchemas: [...authTables.schemas],
 		granted: {
 			tables,
 			schemas: schemas.map((found) => found.schema)
@@ -39,10 +42,11 @@ const readQueryRunner = async (db, models, authTables) => {
 * resources' tables, never an auth table; `undefined` when the database is current.
 */
 const queryRunnerMigration = async (db, models, authTables) => {
-	const { role, runner, resources, authTables: auth, granted } = await readQueryRunner(db, models, authTables);
+	const { role, runner, resources, authTables: auth, guardedSchemas, granted } = await readQueryRunner(db, models, authTables);
 	const plan = plannedGrants({
 		resources,
 		authTables: auth,
+		guardedSchemas,
 		granted
 	});
 	return role.exists && runner?.source === runnerBody && runner.definer && runner.owner === role.name && !runner.executable && plan.grants.length === 0 && plan.revokes.length === 0 ? void 0 : queryRunnerSql(plan);
@@ -53,7 +57,7 @@ const leakingFunctions = (db, authTables) => rowsOf(db, sql`with runner as (sele
       from pg_proc p join pg_namespace n on n.oid = p.pronamespace, runner
       where p.prosecdef and p.prorettype <> 'trigger'::regtype and p.proowner <> runner.role
         and has_schema_privilege(runner.role, p.pronamespace, 'USAGE') and has_function_privilege(runner.role, p.oid, 'EXECUTE')
-        and exists (select from unnest(${authTables.map(regclassText)}::text[]) as t(name) join pg_class c on c.oid = to_regclass(t.name)
+        and exists (select from (${guardedRelations(authTables)}) c
           where has_schema_privilege(p.proowner, c.relnamespace, 'USAGE') and has_any_column_privilege(p.proowner, c.oid, 'SELECT'))
       order by 1`);
 /**
@@ -65,7 +69,7 @@ const leakingFunctions = (db, authTables) => rowsOf(db, sql`with runner as (sele
 const checkQueryRunner = async (db, authTables) => {
 	const [runner] = await rowsOf(db, sql`select p.prosrc as source, p.prosecdef as definer,
       (o.rolsuper or o.rolcanlogin or pg_has_role(p.proowner, current_user, 'MEMBER')) as strong,
-      exists (select from unnest(${authTables.map(regclassText)}::text[]) as t(name) join pg_class c on c.oid = to_regclass(t.name)
+      exists (select from (${guardedRelations(authTables)}) c
         where has_schema_privilege(p.proowner, c.relnamespace, 'USAGE') and has_any_column_privilege(p.proowner, c.oid, 'SELECT')) as reads_auth
       from pg_proc p join pg_roles o on o.oid = p.proowner where p.oid = to_regprocedure(${queryRunnerSignature})`);
 	if (!runner || !runner.definer || runner.source !== runnerBody) throw refusal("is missing");

package/dist/assistant/query-runner/runner-plan.js

@@ -3,11 +3,11 @@ const same = (a, b) => a.schema === b.schema && a.name === b.name;
 const unique = (items, equal) => items.filter((item, index) => items.findIndex((other) => equal(item, other)) === index);
 /**
 * What the query role must be given and what taken back so that it reads exactly the resources' tables, never an auth
-* table, with usage on the schemas those are in. `resources` and `authTables` are the tables that exist, `granted`
-* what the role holds now.
+* table nor any table of a guarded schema, with usage on the schemas those are in. `resources` and `authTables` are the
+* tables that exist, `granted` what the role holds now.
 */
-const plannedGrants = ({ resources, authTables, granted }) => {
-	const tables = unique(resources.filter((table) => !authTables.some((auth) => same(table, auth))), same);
+const plannedGrants = ({ resources, authTables, guardedSchemas, granted }) => {
+	const tables = unique(resources.filter((table) => !guardedSchemas.includes(table.schema) && !authTables.some((auth) => same(table, auth))), same);
 	const schemas = [...new Set(tables.map((table) => table.schema))];
 	return {
 		grants: [...schemas.filter((schema) => !granted.schemas.includes(schema)).map((schema) => ({

package/dist/better-auth/auth-settings.d.ts

@@ -8819,6 +8819,11 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
     column: (name: UserColumn) => string;
     fieldNames: Record<string, string>;
     metadata: string | undefined;
+    keyTable: {
+      schema: string;
+      table: string;
+    } | undefined;
+    guardedSchemas: string[];
   };
   socialProviders: string[];
   appName: string;

package/dist/better-auth/auth-tables.d.ts

@@ -1,8 +1,19 @@
 import { AdminAuth } from "./create-auth.js";
 //#region src/better-auth/auth-tables.d.ts
-/** The admin store's tables, which the assistant's queries and the app's resources must never read: the user table and `storeTableNames`. */
-export declare const authStoreTables: (auth: AdminAuth) => {
-  schema: string | undefined;
+/** A table as config names it: the search path decides when it names no schema. */
+export type TableName = {
+  schema?: string;
   name: string;
-}[];
+};
+/** The tables the assistant's queries and the app's resources must never read: these, and every table in `schemas`. */
+export type AuthStoreTables = {
+  tables: TableName[];
+  schemas: string[];
+};
+/**
+ * The admin store's tables, which the assistant's queries and the app's resources must never read: the user table and
+ * `storeTableNames`, with `users.keyTable` the table under the user view too, such as Supabase's `auth.users`, whose
+ * password hashes the view leaves out but the table holds, and every table of `users.guardedSchemas`.
+ */
+export declare const authStoreTables: (auth: AdminAuth) => AuthStoreTables;
 //#endregion

package/dist/better-auth/auth-tables.js

@@ -1,13 +1,24 @@
 import { storeNames } from "./store/store-names.js";
 import { storeTableNames } from "./store/table-names.js";
 //#region src/better-auth/auth-tables.ts
-/** The admin store's tables, which the assistant's queries and the app's resources must never read: the user table and `storeTableNames`. */
+/**
+* The admin store's tables, which the assistant's queries and the app's resources must never read: the user table and
+* `storeTableNames`, with `users.keyTable` the table under the user view too, such as Supabase's `auth.users`, whose
+* password hashes the view leaves out but the table holds, and every table of `users.guardedSchemas`.
+*/
 const authStoreTables = (auth) => {
 	const { schema, users } = storeNames(auth);
-	return [users.modelName, ...storeTableNames].map((name) => ({
+	const own = [users.modelName, ...storeTableNames].map((name) => ({
 		schema,
 		name
 	}));
+	return {
+		tables: users.keyTable ? [...own, {
+			schema: users.keyTable.schema,
+			name: users.keyTable.table
+		}] : own,
+		schemas: users.guardedSchemas
+	};
 };
 //#endregion
 export { authStoreTables };

package/dist/better-auth/create-auth.d.ts

@@ -8958,6 +8958,11 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
     column: (name: UserColumn) => string;
     fieldNames: Record<string, string>;
     metadata: string | undefined;
+    keyTable: {
+      schema: string;
+      table: string;
+    } | undefined;
+    guardedSchemas: string[];
   };
   socialProviders: string[];
   /** The app's name it signs in and mails as: `PROTOBASE_APP_NAME`, else `appName`, else `Protobase`. */

package/dist/better-auth/store/drift.js

@@ -1,5 +1,18 @@
+import { storeNames } from "./store-names.js";
+import { storeDb } from "./store-db.js";
+import { sql } from "kysely";
+import { getSchema } from "better-auth/db";
 import { getMigrations } from "better-auth/db/migration";
 //#region src/better-auth/store/drift.ts
+/** Each column of Better Auth's user model the view lacks, or the view itself when there is none. */
+const userViewDrift = async (auth) => {
+	const { schema, users } = storeNames(auth);
+	const { rows } = await sql`select column_name as "column" from information_schema.columns
+    where table_schema = ${schema ?? sql`current_schema()`} and table_name = ${users.modelName}`.execute(storeDb(auth));
+	if (rows.length === 0) return [`lacks the view ${users.modelName}`];
+	const found = new Set(rows.map(({ column }) => column));
+	return ["id", ...Object.keys(getSchema(auth.options)[users.modelName]?.fields ?? {})].filter((column) => !found.has(column)).map((column) => `lacks the column ${users.modelName}.${column}`);
+};
 /**
 * What Better Auth, with the features the app turns on, finds the store lacks or has otherwise: tables, `table.column`s,
 * indexes and its other findings; none when the store matches. It compares the database's tables, so only
@@ -7,12 +20,14 @@ import { getMigrations } from "better-auth/db/migration";
 */
 const authSchemaDrift = async (auth) => {
 	const { toBeCreated, toBeAdded, toBeAddedIndexes, schemaProblems } = await getMigrations(auth.options, { throwOnUnsafe: false });
-	return [
-		...toBeCreated.map(({ table }) => `lacks the table ${table}`),
-		...toBeAdded.flatMap(({ table, fields }) => Object.keys(fields).map((field) => `lacks the column ${table}.${field}`)),
-		...toBeAddedIndexes.map(({ name }) => `lacks the index ${name}`),
+	const view = auth.userTable.keyTable ? auth.userTable.modelName : void 0;
+	const tables = [
+		...toBeCreated.filter(({ table }) => table !== view).map(({ table }) => `lacks the table ${table}`),
+		...toBeAdded.filter(({ table }) => table !== view).flatMap(({ table, fields }) => Object.keys(fields).map((field) => `lacks the column ${table}.${field}`)),
+		...toBeAddedIndexes.filter(({ table }) => table !== view).map(({ name }) => `lacks the index ${name}`),
 		...schemaProblems
 	];
+	return view ? [...tables, ...await userViewDrift(auth)] : tables;
 };
 //#endregion
 export { authSchemaDrift };

package/dist/better-auth/store/migrations/001-core.js

@@ -11,9 +11,10 @@ const core = {
 		"verification",
 		"jwks"
 	],
-	statements: ({ table, user, userColumn: column, metadata, id, idRef }) => [
-		ddl`create table if not exists ${user} (id ${id} primary key)`,
-		ddl`alter table ${user}
+	statements: ({ table, user, userDdl, userColumn: column, metadata, id, idRef }) => [
+		...userDdl([
+			ddl`create table if not exists ${user} (id ${id} primary key)`,
+			ddl`alter table ${user}
   add column if not exists ${column("name")} text not null,
   add column if not exists ${column("email")} text not null unique,
   add column if not exists ${column("email_verified")} boolean not null,
@@ -26,7 +27,8 @@ const core = {
   add column if not exists ${column("ban_expires")} timestamptz,
   add column if not exists ${column("last_role")} text,
   add column if not exists ${column("email_confirmed_at")} timestamptz`,
-		...metadata ? [ddl`alter table ${user} add column if not exists ${metadata} jsonb`] : [],
+			...metadata ? [ddl`alter table ${user} add column if not exists ${metadata} jsonb`] : []
+		]),
 		ddl`create table ${table("session")} (
   id ${id} primary key,
   expires_at timestamptz not null,

package/dist/better-auth/store/migrations/002-two-factor.js

@@ -6,8 +6,8 @@ const twoFactor = {
 	name: "two_factor",
 	title: "The authenticator secrets and backup codes of two-step sign-in",
 	tables: ["two_factor"],
-	statements: ({ table, user, userColumn: column, id, idRef }) => [
-		ddl`alter table ${user} add column if not exists ${column("two_factor_enabled")} boolean`,
+	statements: ({ table, user, userDdl, userColumn: column, id, idRef }) => [
+		...userDdl([ddl`alter table ${user} add column if not exists ${column("two_factor_enabled")} boolean`]),
 		ddl`create table ${table("two_factor")} (
   id ${id} primary key,
   secret text not null,

package/dist/better-auth/store/migrations/006-organizations.js

@@ -10,8 +10,8 @@ const organizations = {
 		"member",
 		"invitation"
 	],
-	statements: ({ table, user, userColumn: column, id, idRef }) => [
-		ddl`alter table ${user} add column if not exists ${column("last_organization_id")} text`,
+	statements: ({ table, user, userDdl, userColumn: column, id, idRef }) => [
+		...userDdl([ddl`alter table ${user} add column if not exists ${column("last_organization_id")} text`]),
 		ddl`alter table ${table("session")} add column active_organization_id text`,
 		ddl`create table ${table("organization")} (
   id ${id} primary key,

package/dist/better-auth/store/migrations/migration.js

@@ -4,7 +4,8 @@ import { sql } from "kysely";
 /** The `ddl` parts of the app's names. */
 const migrationNames = (names) => ({
 	table: (name) => storeTable(names, name),
-	user: storeTable(names, names.users.modelName),
+	user: names.users.keyTable ? sql.id(names.users.keyTable.schema, names.users.keyTable.table) : storeTable(names, names.users.modelName),
+	userDdl: (statements) => names.users.keyTable ? [] : statements,
 	userColumn: names.users.column,
 	metadata: names.users.metadata,
 	id: sql.raw(names.uuidIds ? "uuid default pg_catalog.gen_random_uuid()" : "text"),

package/dist/better-auth/store/resources-outside.d.ts

@@ -2,6 +2,9 @@ import { AdminAuth } from "../create-auth.js";
 import { ResourceModel } from "@protobase/schema";
 import { Kysely } from "kysely";
 //#region src/better-auth/store/resources-outside.d.ts
-/** Refuses a resource over a table of the admin store: the user table, a feature's table or the record of migrations. */
+/**
+ * Refuses a resource over a table of the admin store: the user table, a feature's table or the record of migrations,
+ * or any table of a guarded schema (`users.guardedSchemas`), by the schema the catalogue finds the table in.
+ */
 export declare const checkResourcesOutsideAuthStore: (db: Kysely<any>, models: readonly ResourceModel[], auth: AdminAuth) => Promise<void>;
 //#endregion

package/dist/better-auth/store/resources-outside.js

@@ -6,12 +6,17 @@ const quoted = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
 const resolve = async (db, tables) => (await sql`select t.n::int as n, ns.nspname as schema, c.relname as name, current_database() as database
       from unnest(${tables.map(({ schema, name }) => schema ? `${quoted(schema)}.${quoted(name)}` : quoted(name))}::text[]) with ordinality as t(name, n)
       join pg_class c on c.oid = to_regclass(t.name) join pg_namespace ns on ns.oid = c.relnamespace order by t.n`.execute(db)).rows;
-/** Refuses a resource over a table of the admin store: the user table, a feature's table or the record of migrations. */
+/**
+* Refuses a resource over a table of the admin store: the user table, a feature's table or the record of migrations,
+* or any table of a guarded schema (`users.guardedSchemas`), by the schema the catalogue finds the table in.
+*/
 const checkResourcesOutsideAuthStore = async (db, models, auth) => {
 	if (models.length === 0) return;
-	const store = await resolve(storeDb(auth), authStoreTables(auth));
+	const { tables, schemas } = authStoreTables(auth);
+	const store = await resolve(storeDb(auth), tables);
 	const same = (a, b) => a.database === b.database && a.schema === b.schema && a.name === b.name;
-	const over = (await resolve(db, models.map((model) => model.table))).filter((table) => store.some((own) => same(own, table)));
+	const guarded = (table) => schemas.includes(table.schema) || store.some((own) => same(own, table));
+	const over = (await resolve(db, models.map((model) => model.table))).filter(guarded);
 	if (over.length === 0) return;
 	const named = over.map((table) => `${models[table.n - 1].name} (${table.schema}.${table.name})`).join(", ");
 	throw new Error(`Resources over the auth store's tables, which hold password hashes, sessions and tokens: ${named}. Remove them from the config; the auth store is read through Better Auth alone.`);

package/dist/better-auth/user-table.d.ts

@@ -28,5 +28,20 @@ export type UserTableOptions = {
   columns?: Partial<Record<UserColumn, string>>;
   /** A JSON column that holds each user's metadata, such as `raw_user_meta_data`; none by default. */
   metadata?: string;
+  /**
+   * The table that holds the user ids, when `table` is a view over another system's user table, such as
+   * `{ schema: 'auth', table: 'users' }` under a view over Supabase's `auth.users`: the store's migrations then make
+   * nothing of the user table, which the app's own migration makes, and every foreign key points at this table.
+   */
+  keyTable?: {
+    schema: string;
+    table: string;
+  };
+  /**
+   * Schemas the other system that made the user table keeps its sign-in data in, such as `['auth']` for Supabase Auth's
+   * identities, sessions, refresh tokens and two-factor secrets: every table in them, today's or one added later,
+   * counts among the store's tables. Name only a schema that holds none of the app's own tables.
+   */
+  guardedSchemas?: string[];
 };
 //#endregion

package/dist/better-auth/user-table.js

@@ -17,7 +17,7 @@ const userFields = {
 	last_organization_id: "lastOrganizationId"
 };
 /** The user table's names, from `auth.users` option; unknown columns are an error. */
-const userTable = ({ table = "user", columns = {}, metadata } = {}) => {
+const userTable = ({ table = "user", columns = {}, metadata, keyTable, guardedSchemas = [] } = {}) => {
 	const unknown = Object.keys(columns).find((name) => !(name in userFields));
 	if (unknown !== void 0) throw new Error(`users.columns names "${unknown}", which is not a column of the user table: ${Object.keys(userFields).join(", ")}`);
 	const column = (name) => columns[name] ?? name;
@@ -25,7 +25,9 @@ const userTable = ({ table = "user", columns = {}, metadata } = {}) => {
 		modelName: table,
 		column,
 		fieldNames: Object.fromEntries(Object.entries(userFields).map(([name, field]) => [field, column(name)])),
-		metadata
+		metadata,
+		keyTable,
+		guardedSchemas
 	};
 };
 /** Better Auth's `user` option: the table and its core columns. */

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.58.6";
+var version = "0.58.8";
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.58.6",
+  "version": "0.58.8",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -42,9 +42,9 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.58.6",
-    "@protobase/query": "0.58.6",
-    "@protobase/schema": "0.58.6",
+    "@protobase/layout": "0.58.8",
+    "@protobase/query": "0.58.8",
+    "@protobase/schema": "0.58.8",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",