@protobase/server 0.58.7 → 0.58.8

package/dist/assistant/query-runner/query-runner.d.ts

@@ -6,16 +6,21 @@ export type TableName = {
   schema?: string;
   name: string;
 };
+/** The tables the role must never read: these, and every table in `schemas`, whatever its name. */
+export type GuardedTables = {
+  tables: readonly TableName[];
+  schemas: readonly string[];
+};
 /**
  * The SQL that makes the role the assistant's read-only queries run as, and its runner, and grants it exactly the
  * resources' tables, never an auth table; `undefined` when the database is current.
  */
-export declare const queryRunnerMigration: (db: Db, models: readonly ResourceModel[], authTables: readonly TableName[]) => Promise<string | undefined>;
+export declare const queryRunnerMigration: (db: Db, models: readonly ResourceModel[], authTables: GuardedTables) => Promise<string | undefined>;
 /**
  * Refuses to go on while the runner of the assistant's read-only queries is missing or out of date, or runs as a role
  * that is not weaker than the app's: the app's role itself or one it is a member of, a superuser, a login role, or one
  * that can read an auth table, or while the role may call a security-definer function that runs as a role able to
  * read one. It checks the owner's privileges, not its name, so a database cloned under another name still passes. A resource added since the last migration is not checked: Postgres refuses to read its table until then.
  */
-export declare const checkQueryRunner: (db: Db, authTables: readonly TableName[]) => Promise<void>;
+export declare const checkQueryRunner: (db: Db, authTables: GuardedTables) => Promise<void>;
 //#endregion

package/dist/assistant/query-runner/query-runner.js

@@ -8,6 +8,8 @@ const quoted = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
 const regclassText = ({ schema, name }) => schema ? `${quoted(schema)}.${quoted(name)}` : quoted(name);
 const roleSql = sql.raw(queryRoleSql);
 const rowsOf = async (db, query) => (await query.execute(db)).rows;
+const guardedRelations = ({ tables, schemas }) => sql`select c.oid, c.relnamespace from pg_class c join pg_namespace n on n.oid = c.relnamespace
+    where c.oid in (select to_regclass(t.name) from unnest(${tables.map(regclassText)}::text[]) as t(name)) or n.nspname = any(${[...schemas]}::text[])`;
 const resolved = (db, tables) => rowsOf(db, sql`select n.nspname as schema, c.relname as name from unnest(${tables.map(regclassText)}::text[]) with ordinality as t(name, n)
       join pg_class c on c.oid = to_regclass(t.name) join pg_namespace n on n.oid = c.relnamespace order by t.n`);
 const readRunner = async (db) => {
@@ -27,7 +29,8 @@ const readQueryRunner = async (db, models, authTables) => {
 		role,
 		runner: await readRunner(db),
 		resources: await resolved(db, models.map((model) => model.table)),
-		authTables: await resolved(db, authTables),
+		authTables: await resolved(db, authTables.tables),
+		guardedSchemas: [...authTables.schemas],
 		granted: {
 			tables,
 			schemas: schemas.map((found) => found.schema)
@@ -39,10 +42,11 @@ const readQueryRunner = async (db, models, authTables) => {
 * resources' tables, never an auth table; `undefined` when the database is current.
 */
 const queryRunnerMigration = async (db, models, authTables) => {
-	const { role, runner, resources, authTables: auth, granted } = await readQueryRunner(db, models, authTables);
+	const { role, runner, resources, authTables: auth, guardedSchemas, granted } = await readQueryRunner(db, models, authTables);
 	const plan = plannedGrants({
 		resources,
 		authTables: auth,
+		guardedSchemas,
 		granted
 	});
 	return role.exists && runner?.source === runnerBody && runner.definer && runner.owner === role.name && !runner.executable && plan.grants.length === 0 && plan.revokes.length === 0 ? void 0 : queryRunnerSql(plan);
@@ -53,7 +57,7 @@ const leakingFunctions = (db, authTables) => rowsOf(db, sql`with runner as (sele
       from pg_proc p join pg_namespace n on n.oid = p.pronamespace, runner
       where p.prosecdef and p.prorettype <> 'trigger'::regtype and p.proowner <> runner.role
         and has_schema_privilege(runner.role, p.pronamespace, 'USAGE') and has_function_privilege(runner.role, p.oid, 'EXECUTE')
-        and exists (select from unnest(${authTables.map(regclassText)}::text[]) as t(name) join pg_class c on c.oid = to_regclass(t.name)
+        and exists (select from (${guardedRelations(authTables)}) c
           where has_schema_privilege(p.proowner, c.relnamespace, 'USAGE') and has_any_column_privilege(p.proowner, c.oid, 'SELECT'))
       order by 1`);
 /**
@@ -65,7 +69,7 @@ const leakingFunctions = (db, authTables) => rowsOf(db, sql`with runner as (sele
 const checkQueryRunner = async (db, authTables) => {
 	const [runner] = await rowsOf(db, sql`select p.prosrc as source, p.prosecdef as definer,
       (o.rolsuper or o.rolcanlogin or pg_has_role(p.proowner, current_user, 'MEMBER')) as strong,
-      exists (select from unnest(${authTables.map(regclassText)}::text[]) as t(name) join pg_class c on c.oid = to_regclass(t.name)
+      exists (select from (${guardedRelations(authTables)}) c
         where has_schema_privilege(p.proowner, c.relnamespace, 'USAGE') and has_any_column_privilege(p.proowner, c.oid, 'SELECT')) as reads_auth
       from pg_proc p join pg_roles o on o.oid = p.proowner where p.oid = to_regprocedure(${queryRunnerSignature})`);
 	if (!runner || !runner.definer || runner.source !== runnerBody) throw refusal("is missing");

package/dist/assistant/query-runner/runner-plan.js

@@ -3,11 +3,11 @@ const same = (a, b) => a.schema === b.schema && a.name === b.name;
 const unique = (items, equal) => items.filter((item, index) => items.findIndex((other) => equal(item, other)) === index);
 /**
 * What the query role must be given and what taken back so that it reads exactly the resources' tables, never an auth
-* table, with usage on the schemas those are in. `resources` and `authTables` are the tables that exist, `granted`
-* what the role holds now.
+* table nor any table of a guarded schema, with usage on the schemas those are in. `resources` and `authTables` are the
+* tables that exist, `granted` what the role holds now.
 */
-const plannedGrants = ({ resources, authTables, granted }) => {
-	const tables = unique(resources.filter((table) => !authTables.some((auth) => same(table, auth))), same);
+const plannedGrants = ({ resources, authTables, guardedSchemas, granted }) => {
+	const tables = unique(resources.filter((table) => !guardedSchemas.includes(table.schema) && !authTables.some((auth) => same(table, auth))), same);
 	const schemas = [...new Set(tables.map((table) => table.schema))];
 	return {
 		grants: [...schemas.filter((schema) => !granted.schemas.includes(schema)).map((schema) => ({

package/dist/better-auth/auth-settings.d.ts

@@ -8823,6 +8823,7 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
       schema: string;
       table: string;
     } | undefined;
+    guardedSchemas: string[];
   };
   socialProviders: string[];
   appName: string;

package/dist/better-auth/auth-tables.d.ts

@@ -1,12 +1,19 @@
 import { AdminAuth } from "./create-auth.js";
 //#region src/better-auth/auth-tables.d.ts
+/** A table as config names it: the search path decides when it names no schema. */
+export type TableName = {
+  schema?: string;
+  name: string;
+};
+/** The tables the assistant's queries and the app's resources must never read: these, and every table in `schemas`. */
+export type AuthStoreTables = {
+  tables: TableName[];
+  schemas: string[];
+};
 /**
  * The admin store's tables, which the assistant's queries and the app's resources must never read: the user table and
- * `storeTableNames`, and with `users.keyTable` the table under the user view too, such as Supabase's `auth.users`,
- * whose password hashes the view leaves out but the table holds.
+ * `storeTableNames`, with `users.keyTable` the table under the user view too, such as Supabase's `auth.users`, whose
+ * password hashes the view leaves out but the table holds, and every table of `users.guardedSchemas`.
  */
-export declare const authStoreTables: (auth: AdminAuth) => {
-  schema: string | undefined;
-  name: string;
-}[];
+export declare const authStoreTables: (auth: AdminAuth) => AuthStoreTables;
 //#endregion

package/dist/better-auth/auth-tables.js

@@ -3,8 +3,8 @@ import { storeTableNames } from "./store/table-names.js";
 //#region src/better-auth/auth-tables.ts
 /**
 * The admin store's tables, which the assistant's queries and the app's resources must never read: the user table and
-* `storeTableNames`, and with `users.keyTable` the table under the user view too, such as Supabase's `auth.users`,
-* whose password hashes the view leaves out but the table holds.
+* `storeTableNames`, with `users.keyTable` the table under the user view too, such as Supabase's `auth.users`, whose
+* password hashes the view leaves out but the table holds, and every table of `users.guardedSchemas`.
 */
 const authStoreTables = (auth) => {
 	const { schema, users } = storeNames(auth);
@@ -12,10 +12,13 @@ const authStoreTables = (auth) => {
 		schema,
 		name
 	}));
-	return users.keyTable ? [...own, {
-		schema: users.keyTable.schema,
-		name: users.keyTable.table
-	}] : own;
+	return {
+		tables: users.keyTable ? [...own, {
+			schema: users.keyTable.schema,
+			name: users.keyTable.table
+		}] : own,
+		schemas: users.guardedSchemas
+	};
 };
 //#endregion
 export { authStoreTables };

package/dist/better-auth/create-auth.d.ts

@@ -8962,6 +8962,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
       schema: string;
       table: string;
     } | undefined;
+    guardedSchemas: string[];
   };
   socialProviders: string[];
   /** The app's name it signs in and mails as: `PROTOBASE_APP_NAME`, else `appName`, else `Protobase`. */

package/dist/better-auth/store/resources-outside.d.ts

@@ -2,6 +2,9 @@ import { AdminAuth } from "../create-auth.js";
 import { ResourceModel } from "@protobase/schema";
 import { Kysely } from "kysely";
 //#region src/better-auth/store/resources-outside.d.ts
-/** Refuses a resource over a table of the admin store: the user table, a feature's table or the record of migrations. */
+/**
+ * Refuses a resource over a table of the admin store: the user table, a feature's table or the record of migrations,
+ * or any table of a guarded schema (`users.guardedSchemas`), by the schema the catalogue finds the table in.
+ */
 export declare const checkResourcesOutsideAuthStore: (db: Kysely<any>, models: readonly ResourceModel[], auth: AdminAuth) => Promise<void>;
 //#endregion

package/dist/better-auth/store/resources-outside.js

@@ -6,12 +6,17 @@ const quoted = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
 const resolve = async (db, tables) => (await sql`select t.n::int as n, ns.nspname as schema, c.relname as name, current_database() as database
       from unnest(${tables.map(({ schema, name }) => schema ? `${quoted(schema)}.${quoted(name)}` : quoted(name))}::text[]) with ordinality as t(name, n)
       join pg_class c on c.oid = to_regclass(t.name) join pg_namespace ns on ns.oid = c.relnamespace order by t.n`.execute(db)).rows;
-/** Refuses a resource over a table of the admin store: the user table, a feature's table or the record of migrations. */
+/**
+* Refuses a resource over a table of the admin store: the user table, a feature's table or the record of migrations,
+* or any table of a guarded schema (`users.guardedSchemas`), by the schema the catalogue finds the table in.
+*/
 const checkResourcesOutsideAuthStore = async (db, models, auth) => {
 	if (models.length === 0) return;
-	const store = await resolve(storeDb(auth), authStoreTables(auth));
+	const { tables, schemas } = authStoreTables(auth);
+	const store = await resolve(storeDb(auth), tables);
 	const same = (a, b) => a.database === b.database && a.schema === b.schema && a.name === b.name;
-	const over = (await resolve(db, models.map((model) => model.table))).filter((table) => store.some((own) => same(own, table)));
+	const guarded = (table) => schemas.includes(table.schema) || store.some((own) => same(own, table));
+	const over = (await resolve(db, models.map((model) => model.table))).filter(guarded);
 	if (over.length === 0) return;
 	const named = over.map((table) => `${models[table.n - 1].name} (${table.schema}.${table.name})`).join(", ");
 	throw new Error(`Resources over the auth store's tables, which hold password hashes, sessions and tokens: ${named}. Remove them from the config; the auth store is read through Better Auth alone.`);

package/dist/better-auth/user-table.d.ts

@@ -37,5 +37,11 @@ export type UserTableOptions = {
     schema: string;
     table: string;
   };
+  /**
+   * Schemas the other system that made the user table keeps its sign-in data in, such as `['auth']` for Supabase Auth's
+   * identities, sessions, refresh tokens and two-factor secrets: every table in them, today's or one added later,
+   * counts among the store's tables. Name only a schema that holds none of the app's own tables.
+   */
+  guardedSchemas?: string[];
 };
 //#endregion

package/dist/better-auth/user-table.js

@@ -17,7 +17,7 @@ const userFields = {
 	last_organization_id: "lastOrganizationId"
 };
 /** The user table's names, from `auth.users` option; unknown columns are an error. */
-const userTable = ({ table = "user", columns = {}, metadata, keyTable } = {}) => {
+const userTable = ({ table = "user", columns = {}, metadata, keyTable, guardedSchemas = [] } = {}) => {
 	const unknown = Object.keys(columns).find((name) => !(name in userFields));
 	if (unknown !== void 0) throw new Error(`users.columns names "${unknown}", which is not a column of the user table: ${Object.keys(userFields).join(", ")}`);
 	const column = (name) => columns[name] ?? name;
@@ -26,7 +26,8 @@ const userTable = ({ table = "user", columns = {}, metadata, keyTable } = {}) =>
 		column,
 		fieldNames: Object.fromEntries(Object.entries(userFields).map(([name, field]) => [field, column(name)])),
 		metadata,
-		keyTable
+		keyTable,
+		guardedSchemas
 	};
 };
 /** Better Auth's `user` option: the table and its core columns. */

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.58.7";
+var version = "0.58.8";
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.58.7",
+  "version": "0.58.8",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -42,9 +42,9 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.58.7",
-    "@protobase/query": "0.58.7",
-    "@protobase/schema": "0.58.7",
+    "@protobase/layout": "0.58.8",
+    "@protobase/query": "0.58.8",
+    "@protobase/schema": "0.58.8",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",