@protobase/server 0.6.0 → 0.8.0

package/dist/request-access.js

@@ -3,15 +3,19 @@ import { checkedFilter } from "./filter-input.js";
 import { tenantScope } from "./tenant.js";
 import { checkFilter, resolveAccess, restrictModel } from "@protobase/schema";
 //#region src/request-access.ts
+const organizationOf = (session) => session.organization ? { organization: session.organization } : {};
 const withoutSensitive = (model) => ({
 	...model,
 	fields: Object.fromEntries(Object.entries(model.fields).filter(([, field]) => !field.sensitive))
 });
 const requestAccess = async (deps, entry, session) => {
-	const resolved = await resolveAccess(entry.source, { user: {
-		id: session.user.id,
-		roles: session.user.roles
-	} }, deps.accessOptions);
+	const resolved = await resolveAccess(entry.source, {
+		user: {
+			id: session.user.id,
+			roles: session.user.roles
+		},
+		...organizationOf(session)
+	}, deps.accessOptions);
 	const readable = restrictModel(entry.model, resolved);
 	return {
 		entry,
@@ -86,6 +90,7 @@ const recordDecision = async (access, operation, record, input) => {
 			id: session.user.id,
 			roles: session.user.roles
 		},
+		...organizationOf(session),
 		model: full,
 		operation,
 		record

package/dist/resource-source.d.ts

@@ -1,5 +1,5 @@
 import { PageDefinition } from "@protobase/layout";
-import { AccessSource, UserMenuSource, ViewModel } from "@protobase/schema";
+import { AccessSource, FileProcessor, UserMenuSource, ViewModel } from "@protobase/schema";
 import { z } from "zod";
 //#region src/resource-source.d.ts
 type FieldSource = {
@@ -7,6 +7,9 @@ type FieldSource = {
   meta: {
     readOnly: boolean;
     nullable: boolean;
+    file?: {
+      derive?: Record<string, FileProcessor>;
+    };
   };
 };
 /** What the server needs from a resource builder; every `resource(...)` chain satisfies it. */

package/dist/routes/batch.js

@@ -1,6 +1,6 @@
+import { parseParams } from "../params.js";
 import { batchBody } from "../batch/schema.js";
 import { runBatch } from "../batch/run-batch.js";
-import { parseParams } from "../params.js";
 import { Hono } from "hono";
 //#region src/routes/batch.ts
 /**

package/dist/routes/collection.js

@@ -1,6 +1,7 @@
 import { runWrite } from "../write-pipeline.js";
-import { facets, numericHistogram, timeSeries } from "../aggregate-service.js";
 import { listRecords } from "../list-service.js";
+import { facets, numericHistogram, timeSeries } from "../aggregate-service.js";
+import { uploadFile } from "../files/upload.js";
 import { returnPreference } from "./preferences.js";
 import { resolveTarget, unknownAction } from "./target.js";
 import { Hono } from "hono";
@@ -31,6 +32,7 @@ const collectionRoutes = (deps) => {
 	app.post("/:target", async (c) => {
 		const { entry, action } = resolveTarget(deps, c.req.param("target"));
 		const session = c.get("session");
+		if (action === "upload") return c.json(await uploadFile(deps, entry, session, c.req.raw), 201);
 		const body = await c.req.json();
 		if (action === "search") {
 			const { body: page, warning } = await listRecords(deps, entry, session, body, searchFilterLength);

package/dist/routes/record.js

@@ -3,13 +3,13 @@ import { keyFromPath } from "../key.js";
 import { pickFields } from "../rows.js";
 import { readRecord } from "../read-service.js";
 import { runWrite } from "../write-pipeline.js";
+import { auditOrigin } from "../audit/origin.js";
 import { deletedRows, selectedFields } from "../params.js";
 import { returnPreference } from "./preferences.js";
 import { resolveTarget } from "./target.js";
 import { revealField } from "../reveal-service.js";
 import { Hono } from "hono";
 //#region src/routes/record.ts
-const headerValue = (name, value) => value === void 0 ? {} : { [name]: value };
 const recordRoutes = (deps) => {
 	const app = new Hono();
 	app.get("/:resource/:key", async (c) => {
@@ -31,10 +31,7 @@ const recordRoutes = (deps) => {
 		const revealed = await revealField(deps, entry, c.get("session"), {
 			key: keyFromPath(c, entry, ":reveal"),
 			field: typeof body === "object" && body !== null ? body.field : void 0,
-			origin: {
-				...headerValue("userAgent", c.req.header("user-agent")),
-				...headerValue("forwardedFor", c.req.header("x-forwarded-for"))
-			}
+			origin: auditOrigin(c.req.raw.headers)
 		});
 		return c.json(revealed, 200, { "Cache-Control": "no-store" });
 	};

package/dist/types.d.ts

@@ -8,9 +8,14 @@ export type User = {
   id: string | number;
   roles: string[];
 };
+/** The organization a request works in, with organizations on: the same value as `tenant`. */
+export type SessionOrganization = {
+  id: TenantValue;
+};
 export type Session = {
   user: User;
   tenant?: TenantValue;
+  organization?: SessionOrganization;
 };
 /** Resolves the caller of a request, or throws a 401 problem (see `unauthorized`). */
 export type Authenticator = (request: Request) => Promise<Session> | Session;
@@ -32,8 +37,13 @@ export type WriteEvent = {
 };
 /** Extension point of the write pipeline: a hook that throws rolls the write back. */
 export type PipelineHook = (event: WriteEvent, trx: Db) => Promise<void>;
+/** Where a request came from, as its headers say; proxies set `forwardedFor`, so it is only as trustworthy as they are. */
+export type AuditOrigin = {
+  userAgent?: string;
+  forwardedFor?: string;
+};
 /** What happened, by whom, to which value. It never carries the value itself. */
-export type AuditEvent = {
+export type FieldRevealedEvent = {
   type: 'field.revealed';
   /** ISO 8601, when the server answered. */
   at: string;
@@ -47,12 +57,22 @@ export type AuditEvent = {
   /** The record's key as its URL has it (composite keys joined with a comma). */
   recordKey: string;
   field: string;
-  /** Where the request came from, as its headers say; proxies set `forwardedFor`, so it is only as trustworthy as they are. */
-  origin: {
-    userAgent?: string;
-    forwardedFor?: string;
+  origin: AuditOrigin;
+};
+/** Someone with a global role started working in an organization they are not a member of. */
+export type OrganizationEnteredEvent = {
+  type: 'organization.entered';
+  /** ISO 8601, when the server answered. */
+  at: string;
+  /** Their global roles, which let them in. */
+  actor: {
+    id: string | number;
+    roles: string[];
   };
+  organization: TenantValue;
+  origin: AuditOrigin;
 };
+export type AuditEvent = FieldRevealedEvent | OrganizationEnteredEvent;
 /**
  * Where audit events go. `publish` resolves once the event is accepted; when it rejects, the request that caused the
  * event fails, so nothing is revealed without its event. A real queue replaces the console one through

package/dist/write-pipeline.js

@@ -3,6 +3,7 @@ import { deleteRecord, fetchRecord, insertRecord, restoreRecord } from "./record
 import { tenantScope } from "./tenant.js";
 import { requestAccess, requireOperation, targetFilter, writableFields } from "./request-access.js";
 import { writeTransaction } from "./transactions.js";
+import { attachFiles } from "./files/attach.js";
 import { validateBody } from "./validate-body.js";
 import { assertWritten, checkPrecondition, decide, denied, firstKeyField, missing, notifier, shown } from "./write-shared.js";
 import { applyUpdate, planUpdate } from "./write-update.js";
@@ -22,7 +23,7 @@ const create = async (trx, deps, access, body) => {
 	const tenantValues = full.tenant && scope ? { [full.tenant]: scope.tenantValue } : {};
 	const preset = typeof body === "object" && body !== null && !Array.isArray(body) && writableFields(access, "create").includes(full.owner ?? "") ? withOwner(access, body) : body;
 	const row = {
-		...withOwner(access, validateBody(access, "create", preset, tenantValues)),
+		...await attachFiles(access, withOwner(access, validateBody(access, "create", preset, tenantValues))),
 		...tenantValues
 	};
 	const filter = await decide(access, "create", void 0, row);

package/dist/write-shared.js

@@ -1,9 +1,11 @@
 import { forbidden, notFound, preconditionFailed, preconditionRequired } from "./problem.js";
+import { presentFiles } from "./files/present.js";
 import { ifMatchSatisfied } from "./etag.js";
 import { pickFields } from "./rows.js";
 import { fetchRecord } from "./records.js";
 import { tenantScope } from "./tenant.js";
 import { andFilters, recordDecision } from "./request-access.js";
+import { scheduleRemovedFiles } from "./files/attach.js";
 //#region src/write-shared.ts
 const missing = (entry) => notFound(`No ${entry.name} with this key`);
 const checkPrecondition = (current, ifMatch, required) => {
@@ -30,9 +32,9 @@ const assertWritten = async (trx, access, written, operation, ...filters) => {
 		fields: [firstKeyField(access)]
 	})) throw denied(access.entry, `leave in that state (${operation})`);
 };
-/** The caller sees the readable fields only; hooks get the whole record. */
-const shown = (access, written) => ({
-	record: pickFields(written.record, Object.keys(access.model.fields)),
+/** The caller sees the readable fields only, files as objects with their URL; hooks get the whole record. */
+const shown = async (access, written) => ({
+	record: (await presentFiles(access, [pickFields(written.record, Object.keys(access.model.fields))]))[0],
 	etag: written.etag
 });
 /** Runs the pipeline hooks for one write, inside the transaction. */
@@ -47,6 +49,7 @@ const notifier = (deps, access) => async (trx, kind, before, after) => {
 		...after && { after }
 	};
 	for (const hook of deps.hooks) await hook(event, trx);
+	await scheduleRemovedFiles(access, kind, before, after);
 };
 //#endregion
 export { assertWritten, checkPrecondition, decide, denied, firstKeyField, keyOf, missing, notifier, shown };

package/dist/write-update.js

@@ -1,6 +1,7 @@
 import { fetchRecord, updateRecord } from "./records.js";
 import { tenantScope } from "./tenant.js";
 import { targetFilter } from "./request-access.js";
+import { attachFiles } from "./files/attach.js";
 import { validateBody } from "./validate-body.js";
 import { assertWritten, checkPrecondition, decide, denied, firstKeyField, missing, notifier } from "./write-shared.js";
 //#region src/write-update.ts
@@ -20,7 +21,7 @@ const planUpdate = async (trx, access, key, body, ifMatch, required = true) => {
 	});
 	if (!current) throw missing(entry);
 	checkPrecondition(current, ifMatch, required);
-	const values = validateBody(access, "update", body, current.record);
+	const values = await attachFiles(access, validateBody(access, "update", body, current.record), current.record);
 	const filter = Object.keys(values).length === 0 ? void 0 : await decide(access, "update", current.record, values);
 	if (filter && !await fetchRecord(trx, entry, key, tenant, {
 		filter,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,13 +30,15 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.6.0",
-    "@protobase/query": "0.6.0",
-    "@protobase/schema": "0.6.0",
+    "@protobase/layout": "0.8.0",
+    "@protobase/query": "0.8.0",
+    "@protobase/schema": "0.8.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@simplewebauthn/server": "^13.3.1",
     "better-auth": "^1.7.7",
+    "file-type": "^22.1.1",
     "hono": "^4.13.13",
+    "image-size": "^2.0.4",
     "jose": "^6.2.12",
     "kysely": "^0.29.6",
     "nodemailer": "^10.0.16",