@protobase/server 0.6.0 → 0.8.0

package/dist/assistant/conversations.d.ts

@@ -1,5 +1,5 @@
-import { ChatMessage } from "./chat-completions.js";
 import { Session } from "../types.js";
+import { ChatMessage } from "./chat-completions.js";
 import { ConversationStore } from "./conversation-store.js";
 import { AssistantEvent, AssistantState } from "@protobase/schema";
 //#region src/assistant/conversations.d.ts

package/dist/assistant/tools.d.ts

@@ -1,7 +1,7 @@
 import { Session } from "../types.js";
+import { ToolRecords } from "./records.js";
 import { Conversation } from "./conversations.js";
 import { ApprovalAnswer, ApprovalRequest } from "./approval.js";
-import { ToolRecords } from "./records.js";
 import { AssistantPart } from "@protobase/schema";
 //#region src/assistant/tools.d.ts
 export type ToolContext = {

package/dist/assistant/turn.d.ts

@@ -1,7 +1,7 @@
-import { ModelSettings, ReasoningEffort } from "./chat-completions.js";
 import { Session } from "../types.js";
-import { Conversation } from "./conversations.js";
 import { ToolRecords } from "./records.js";
+import { ModelSettings, ReasoningEffort } from "./chat-completions.js";
+import { Conversation } from "./conversations.js";
 import { AssistantTool } from "./tools.js";
 //#region src/assistant/turn.d.ts
 export type TurnOptions = {

package/dist/audit/origin.js

@@ -0,0 +1,12 @@
+//#region src/audit/origin.ts
+/** Where a request came from, for an audit event: its user agent and the proxies' `X-Forwarded-For`, when sent. */
+const auditOrigin = (headers) => {
+	const userAgent = headers.get("user-agent");
+	const forwardedFor = headers.get("x-forwarded-for");
+	return {
+		...userAgent !== null && { userAgent },
+		...forwardedFor !== null && { forwardedFor }
+	};
+};
+//#endregion
+export { auditOrigin };

package/dist/auth/jwt.d.ts

@@ -9,6 +9,8 @@ export type JwtOptions = {
   audience?: string;
   /** Claim holding the roles, an array, or a string separated by spaces or commas. Default `roles`. */
   rolesClaim?: string;
+  /** A second claim whose roles are added to those of `rolesClaim`, such as an organization membership's. */
+  extraRolesClaim?: string;
   /** Claim holding the tenant. Default `tenant`. */
   tenantClaim?: string;
   /** Accepted signature algorithms. Default: asymmetric ones only, so a token can never be "verified" with a public key used as an HMAC secret. */

package/dist/auth/jwt.js

@@ -25,21 +25,23 @@ const jwtAuthenticator = (options) => {
 	return async (request) => {
 		const [scheme, token] = (request.headers.get("authorization") ?? "").split(" ");
 		if (scheme?.toLowerCase() !== "bearer" || !token) throw unauthorized("Send a bearer token in the Authorization header");
-		const { sub, [tenantClaim]: tenant, [rolesClaim]: roles } = (await jwtVerify(token, keys, {
+		const verified = await jwtVerify(token, keys, {
 			algorithms: options.algorithms ?? asymmetric,
 			...options.issuer && { issuer: options.issuer },
 			...options.audience && { audience: options.audience }
 		}).catch((error) => {
 			if (error instanceof errors.JOSEError) throw unauthorized("The bearer token is invalid or expired");
 			throw error;
-		})).payload;
+		});
+		const { sub, [tenantClaim]: tenant, [rolesClaim]: roles } = verified.payload;
+		const extraRoles = options.extraRolesClaim === void 0 ? [] : rolesOf(verified.payload[options.extraRolesClaim]);
 		if (!sub) throw unauthorized("The bearer token has no subject");
 		const claimed = typeof tenant === "string" || typeof tenant === "number" ? tenant : void 0;
 		const tenantValue = options.tenant === void 0 ? claimed : typeof options.tenant === "function" ? await options.tenant() : options.tenant;
 		return {
 			user: {
 				id: sub,
-				roles: rolesOf(roles)
+				roles: [.../* @__PURE__ */ new Set([...rolesOf(roles), ...extraRoles])]
 			},
 			...tenantValue !== void 0 && { tenant: tenantValue }
 		};

package/dist/batch/reorder.js

@@ -71,7 +71,7 @@ const reorderIn = async (trx, deps, access, input) => {
 	const results = [];
 	for (const [i, key] of input.keys.entries()) {
 		const plan = plans.get(i);
-		results.push(shown(access, plan ? await applyUpdate(trx, deps, access, key, plan) : current[i]));
+		results.push(await shown(access, plan ? await applyUpdate(trx, deps, access, key, plan) : current[i]));
 	}
 	return results;
 };

package/dist/better-auth/auth-schema.d.ts

@@ -2,13 +2,15 @@ import { AdminAuth } from "./create-auth.js";
 //#region src/better-auth/auth-schema.d.ts
 /**
  * The SQL that brings the admin store up to what this version of Protobase and the project's Better Auth plugins need:
+ * for a store with the camelCase names of Protobase 0.6, their rename to snake_case (`snakeCaseMigration`); otherwise
  * new tables, columns and indexes, never a drop, each skipped where it exists. `undefined` when the store is current. A
  * change Better Auth cannot make safely, such as a required column without a default on a table with rows, is an error.
  */
 export declare const authSchemaMigration: (auth: AdminAuth) => Promise<string | undefined>;
 /**
- * Refuses to go on while the admin store lacks a table or column Better Auth needs, since every sign-in would fail.
- * The server never changes the schema itself: the project's migrations do, before the new version serves.
+ * Refuses to go on while the admin store lacks a table or column Better Auth needs, or still has the camelCase names
+ * of Protobase 0.6, since every sign-in would fail. The server never changes the schema itself: the project's
+ * migrations do, before the new version serves.
  */
 export declare const checkAuthSchema: (auth: AdminAuth) => Promise<void>;
 //#endregion

package/dist/better-auth/auth-schema.js

@@ -1,3 +1,4 @@
+import { snakeCaseMigration } from "./snake-case-migration.js";
 import { getMigrations } from "better-auth/db/migration";
 //#region src/better-auth/auth-schema.ts
 /** The command that writes the pending changes as a migration file of the project. */
@@ -8,28 +9,37 @@ const authMigrationCommand = "protobase auth migration";
 */
 const skipExisting = (sql) => sql.split(";\n\n").map((statement) => statement.replace(/^create table (?!if not exists )/, "create table if not exists ").replace(/^create (unique )?index (?!if not exists )/, (_, unique) => `create ${unique ?? ""}index if not exists `).replace(/^(alter table .+? )add column (?!if not exists )/, "$1add column if not exists ")).join(";\n\n");
 /**
+* Better Auth adds `email_verified` to a `user` table that exists only when the table still has the camelCase names
+* of Protobase 0.6, whose `emailVerified` it does not know: such a store is renamed, never given new columns beside
+* the old ones.
+*/
+const hasCamelCaseNames = ({ toBeAdded }) => toBeAdded.some(({ table, fields }) => table === "user" && "email_verified" in fields);
+const storeSchema = ({ options: { database } }) => database && "schemaName" in database ? database.schemaName : void 0;
+/**
 * The SQL that brings the admin store up to what this version of Protobase and the project's Better Auth plugins need:
+* for a store with the camelCase names of Protobase 0.6, their rename to snake_case (`snakeCaseMigration`); otherwise
 * new tables, columns and indexes, never a drop, each skipped where it exists. `undefined` when the store is current. A
 * change Better Auth cannot make safely, such as a required column without a default on a table with rows, is an error.
 */
 const authSchemaMigration = async (auth) => {
+	if (hasCamelCaseNames(await getMigrations(auth.options, { throwOnUnsafe: false }))) return snakeCaseMigration(storeSchema(auth));
 	const { toBeCreated, toBeAdded, toBeAddedIndexes, compileMigrations } = await getMigrations(auth.options);
 	if (toBeCreated.length === 0 && toBeAdded.length === 0 && toBeAddedIndexes.length === 0) return void 0;
 	return skipExisting(await compileMigrations());
 };
 /** The tables and `table.column`s the admin store lacks; an index missing is not a reason to refuse requests. */
-const missingAuthSchema = async (auth) => {
-	const { toBeCreated, toBeAdded } = await getMigrations(auth.options, { throwOnUnsafe: false });
-	return [...toBeCreated.map(({ table }) => table), ...toBeAdded.flatMap(({ table, fields }) => Object.keys(fields).map((field) => `${table}.${field}`))];
-};
+const missingTablesAndColumns = ({ toBeCreated, toBeAdded }) => [...toBeCreated.map(({ table }) => table), ...toBeAdded.flatMap(({ table, fields }) => Object.keys(fields).map((field) => `${table}.${field}`))];
 /**
-* Refuses to go on while the admin store lacks a table or column Better Auth needs, since every sign-in would fail.
-* The server never changes the schema itself: the project's migrations do, before the new version serves.
+* Refuses to go on while the admin store lacks a table or column Better Auth needs, or still has the camelCase names
+* of Protobase 0.6, since every sign-in would fail. The server never changes the schema itself: the project's
+* migrations do, before the new version serves.
 */
 const checkAuthSchema = async (auth) => {
-	const missing = await missingAuthSchema(auth);
+	const plan = await getMigrations(auth.options, { throwOnUnsafe: false });
+	if (hasCamelCaseNames(plan)) throw new Error(`The auth schema still has the camelCase names of Protobase 0.6, which this version names in snake_case. Write their rename as a migration with \`${authMigrationCommand}\`, apply it with the project's migrations, then start again.`);
+	const missing = missingTablesAndColumns(plan);
 	if (missing.length === 0) return;
 	throw new Error(`The auth schema is behind this version of Protobase (missing ${missing.join(", ")}). Write the change as a migration with \`${authMigrationCommand}\`, apply it with the project's migrations, then start again.`);
 };
 //#endregion
-export { authMigrationCommand, authSchemaMigration, checkAuthSchema, missingAuthSchema, skipExisting };
+export { authMigrationCommand, authSchemaMigration, checkAuthSchema, skipExisting };

package/dist/better-auth/authenticator.d.ts

@@ -9,14 +9,18 @@ export type BetterAuthAuthenticatorOptions = {
   jwksUrl?: string | URL;
   /** Defaults to the auth instance's `baseURL`; it is both issuer and audience of its tokens. */
   issuer?: string;
-  /** The one tenant everyone works in (organizations are not used yet); never read from the token. */
+  /** The one tenant everyone works in, for an app without organizations; never read from the token. */
   tenant?: TenantValue | (() => Promise<TenantValue | undefined>);
+  /** Whether the tokens carry organizations; read from `auth` when given. Needed with `jwksUrl` only. */
+  organizations?: boolean;
   /** How long the key set is cached; see `cachedKeys`. */
   cache?: JwksCacheOptions;
 };
 /**
- * Verifies the bearer JWT that Better Auth's jwt plugin issues. `sub` is the user id, the `role` claim
- * (a comma separated string from the admin plugin) becomes `roles`.
+ * Verifies the bearer JWT that Better Auth's jwt plugin issues. `sub` is the user id, the `role` claim (a comma
+ * separated string from the admin plugin) becomes `roles`. With organizations, the `org` claim is the tenant and the
+ * organization, and the membership's `app_roles` are added to the global roles; `user`, which stands for no global
+ * role, is left out.
  */
 export declare const betterAuthAuthenticator: (options: BetterAuthAuthenticatorOptions) => Authenticator;
 //#endregion

package/dist/better-auth/authenticator.js

@@ -1,21 +1,42 @@
+import { noGlobalRole } from "./organizations/role-definitions.js";
 import { jwtAuthenticator } from "../auth/jwt.js";
 import { cachedKeys } from "./jwks-cache.js";
 //#region src/better-auth/authenticator.ts
 /**
-* Verifies the bearer JWT that Better Auth's jwt plugin issues. `sub` is the user id, the `role` claim
-* (a comma separated string from the admin plugin) becomes `roles`.
+* Verifies the bearer JWT that Better Auth's jwt plugin issues. `sub` is the user id, the `role` claim (a comma
+* separated string from the admin plugin) becomes `roles`. With organizations, the `org` claim is the tenant and the
+* organization, and the membership's `app_roles` are added to the global roles; `user`, which stands for no global
+* role, is left out.
 */
 const betterAuthAuthenticator = (options) => {
 	const issuer = options.issuer ?? options.auth?.options.baseURL;
 	if (!issuer) throw new Error("betterAuthAuthenticator needs `issuer` (or an `auth` instance with a baseURL)");
 	if (!options.auth && !options.jwksUrl) throw new Error("betterAuthAuthenticator needs `auth` or `jwksUrl`");
-	return jwtAuthenticator({
+	const organizations = options.organizations ?? Boolean(options.auth?.organizations);
+	const verify = jwtAuthenticator({
 		...options.auth ? { keys: cachedKeys(() => options.auth.api.getJwks(), options.cache) } : { jwksUrl: options.jwksUrl },
 		issuer,
 		audience: issuer,
 		rolesClaim: "role",
+		...organizations && {
+			tenantClaim: "org",
+			extraRolesClaim: "app_roles"
+		},
 		...options.tenant !== void 0 && { tenant: options.tenant }
 	});
+	if (!organizations) return verify;
+	return async (request) => {
+		const session = await verify(request);
+		const user = {
+			...session.user,
+			roles: session.user.roles.filter((role) => role !== noGlobalRole)
+		};
+		return {
+			...session,
+			user,
+			...session.tenant !== void 0 && { organization: { id: session.tenant } }
+		};
+	};
 };
 //#endregion
 export { betterAuthAuthenticator };