@protobase/server 0.62.5 → 0.63.0

package/dist/calls/guest-store.d.ts

@@ -0,0 +1,48 @@
+import { GuestRow } from "./guest-checks-sql.js";
+import { CreateLinkInput } from "./guest-links-sql.js";
+import { DecideInput, LobbyState } from "./guest-lobby-sql.js";
+import { CallGuestLink, CallGuestRefusal, CallLobbyGuest } from "@protobase/schema/internal";
+import { Db } from "@protobase/query";
+//#region src/calls/guest-store.d.ts
+/** Where guest links, the lobby's guests and the organizations' switch are kept: the `calls` schema. */
+export type GuestStore = {
+  createLink: (input: CreateLinkInput) => Promise<{
+    link: CallGuestLink;
+    token: string;
+  } | {
+    refused: CallGuestRefusal;
+  }>;
+  revokeLink: (input: {
+    call: string;
+    link: string;
+    member: string;
+  }) => Promise<boolean>;
+  decide: (input: DecideInput) => Promise<{
+    refused?: CallGuestRefusal;
+  }>;
+  lobbies: (calls: readonly string[]) => Promise<Map<string, {
+    guests: CallLobbyGuest[];
+    links: CallGuestLink[];
+  }>>;
+  enter: (input: {
+    link: Buffer;
+    name: string;
+    token: Buffer;
+  }) => Promise<{
+    guest: string;
+  } | {
+    refused: 'gone';
+  }>;
+  state: (token: Buffer) => Promise<LobbyState | undefined>;
+  leave: (token: Buffer) => Promise<void>;
+  byToken: (token: Buffer) => Promise<GuestRow | undefined>;
+  stillAllowed: (guest: string) => Promise<boolean>;
+  /** The calls whose guests turning guests off took out. */
+  setOrganization: (input: {
+    organization: string;
+    allowed: boolean;
+    by: string;
+  }) => Promise<string[]>;
+  organizationAllowed: (organization: string) => Promise<boolean>;
+};
+//#endregion

package/dist/calls/guest-store.js

@@ -0,0 +1,20 @@
+import { guestByToken, guestStillAllowed } from "./guest-checks-sql.js";
+import { createLink, organizationGuests, revokeLink, setOrganizationGuests } from "./guest-links-sql.js";
+import { decideGuest, enterLobby, leaveLobby, lobbies, lobbyState } from "./guest-lobby-sql.js";
+//#region src/calls/guest-store.ts
+/** The `calls` schema of the app's database; writes under the API's statement timeout. */
+const sqlGuestStore = (db, timeoutMs, organizationOf) => ({
+	createLink: (input) => createLink(db, timeoutMs, organizationOf, input),
+	revokeLink: (input) => revokeLink(db, timeoutMs, input),
+	decide: (input) => decideGuest(db, timeoutMs, input),
+	lobbies: (calls) => lobbies(db, calls),
+	enter: (input) => enterLobby(db, timeoutMs, input),
+	state: (token) => lobbyState(db, token),
+	leave: (token) => leaveLobby(db, token),
+	byToken: (token) => guestByToken(db, token),
+	stillAllowed: (guest) => guestStillAllowed(db, guest),
+	setOrganization: (input) => setOrganizationGuests(db, timeoutMs, input),
+	organizationAllowed: (organization) => organizationGuests(db, organization)
+});
+//#endregion
+export { sqlGuestStore };

package/dist/calls/guest-tokens.js

@@ -0,0 +1,17 @@
+import { createHash, randomBytes } from "node:crypto";
+//#region src/calls/guest-tokens.ts
+/** What starts a guest link's token, and a guest's: neither is ever a session token, a JWT or an API key. */
+const linkTokenPrefix = "pbgl_";
+const guestTokenPrefix = "pbg_";
+/** A new token, 32 random bytes in base64url after its prefix. */
+const newToken = (prefix) => `${prefix}${randomBytes(32).toString("base64url")}`;
+/** The SHA-256 a token is stored and looked up by; `undefined` for a value that is no token of this kind. */
+const tokenHash = (prefix, token) => {
+	if (typeof token !== "string" || !token.startsWith(prefix) || token.length !== prefix.length + 43) return;
+	return createHash("sha256").update(token).digest();
+};
+/** The member a guest is in their call: no `calls.join` takes a member of this form. */
+const guestMember = (guest) => `guest:${guest}`;
+const isGuestMember = (member) => member.startsWith("guest:");
+//#endregion
+export { guestMember, guestTokenPrefix, isGuestMember, linkTokenPrefix, newToken, tokenHash };

package/dist/calls/member-relay.js

@@ -1,9 +1,11 @@
-import { memberEnd } from "./close-codes.js";
 import { parseClientMessage } from "./client-message.js";
+import { memberEnd } from "./close-codes.js";
 //#region src/calls/member-relay.ts
 /** The close code of a socket whose caller Protobase refused: the member leaves the call too. */
 const refusedCloseCode = 1008;
 const mayPublish = (rights, tracks) => rights.publish === true || Array.isArray(rights.publish) && tracks.every((track) => rights.publish.includes(track.source));
+const guestSources = (rights, asked) => [...new Set(asked)].filter((source) => rights.publish === true || Array.isArray(rights.publish) && rights.publish.includes(source));
+const isGuestMessage = (message) => message.type.startsWith("guest-");
 const refusals = {
 	removed: "You were removed from this call",
 	full: "This call is full",
@@ -15,7 +17,7 @@ const refusals = {
 * may not make, and tells the call and the plugin how the socket ended. The plugin only ever sees well-formed messages
 * of a member Protobase let in.
 */
-const memberRelay = ({ door, backend, record, member, rights, maxMembers, maxMinutes, report, user, ring }) => {
+const memberRelay = ({ door, backend, record, member, rights, maxMembers, maxMinutes, report, user, ring, invites = false, name, guest }) => {
 	let browser;
 	let session;
 	let inCall;
@@ -49,14 +51,20 @@ const memberRelay = ({ door, backend, record, member, rights, maxMembers, maxMin
 				muted: false
 			}))
 		} : void 0;
+		const more = {
+			...user !== void 0 && { user },
+			...ring && !resume && { ring },
+			...invites && { invites },
+			...name !== void 0 && { name },
+			...guest && { guest }
+		};
 		const admitted = await door.admit({
 			record,
 			member,
 			maxMembers,
 			maxMinutes,
 			...resume && { resume },
-			...user !== void 0 && { user },
-			...ring && !resume && { ring }
+			...more
 		}, {
 			send,
 			close
@@ -80,9 +88,59 @@ const memberRelay = ({ door, backend, record, member, rights, maxMembers, maxMin
 		await session.receive(message);
 		await admitted.listen(session.roster ?? (() => {}));
 	};
+	const guests = async (message, call) => {
+		const actions = door.guests;
+		if (!invites || !actions) return send({
+			type: "guest-refused",
+			reason: "not-allowed"
+		});
+		switch (message.type) {
+			case "guest-link": {
+				const made = await actions.link({
+					call,
+					member,
+					publish: guestSources(rights, message.publish),
+					...message.expires_at && { expiresAt: new Date(message.expires_at) }
+				});
+				if ("refused" in made) return send({
+					type: "guest-refused",
+					reason: made.refused
+				});
+				return send({
+					type: "guest-link",
+					link: made.link,
+					token: made.token
+				});
+			}
+			case "guest-link-revoke": return send(await actions.revoke({
+				call,
+				link: message.link,
+				member
+			}) ? { type: "guest-done" } : {
+				type: "guest-refused",
+				reason: "gone"
+			});
+			case "guest-decide": {
+				const decided = await actions.decide({
+					call,
+					guest: message.guest,
+					member,
+					admit: message.admit
+				});
+				return send(decided.refused ? {
+					type: "guest-refused",
+					reason: decided.refused
+				} : { type: "guest-done" });
+			}
+			case "guest-remove":
+				await actions.remove(call, message.guest);
+				return send({ type: "guest-done" });
+		}
+	};
 	const relay = async (message) => {
 		if (message.type === "join" || message.type === "resume") return enter(message);
-		if (!session) return close(refusedCloseCode, "Join or resume the call first");
+		if (!session || !inCall) return close(refusedCloseCode, "Join or resume the call first");
+		if (isGuestMessage(message)) return guests(message, inCall.call);
 		if (message.type === "publish" && !mayPublish(rights, message.tracks)) return send({
 			type: "publish-refused",
 			reason: "The member may not publish these tracks"

package/dist/calls/organization-guests-route.js

@@ -0,0 +1,38 @@
+import { badRequest, forbidden } from "../problem.js";
+import { Hono } from "hono";
+//#region src/calls/organization-guests-route.ts
+const organizationOf = (session) => {
+	if (session.anonymous || session.client || session.organization === void 0) throw forbidden("organization-required", "Sign in and work in an organization first");
+	return String(session.organization.id);
+};
+/**
+* Whether the calls of the organization the user works in take guests, mounted behind the API's authenticator: `GET /`
+* `{ allowed }` for any member, `PUT /` with `{ allowed }` for its owner or an admin. Turning guests off revokes every
+* guest link of the organization's calls and takes their guests out at once.
+*/
+const organizationGuestsRoute = ({ calls, roleIn }) => {
+	const app = new Hono();
+	app.get("/", async (c) => {
+		const session = c.get("session");
+		const organization = organizationOf(session);
+		if (!await roleIn(organization, String(session.user.id))) throw forbidden("not-a-member", "You are not a member of this organization");
+		return c.json({ allowed: await (await calls.runtime()).guests().organizationAllowed(organization) }, 200, { "Cache-Control": "no-store" });
+	});
+	app.put("/", async (c) => {
+		const session = c.get("session");
+		const organization = organizationOf(session);
+		const role = await roleIn(organization, String(session.user.id));
+		if (role !== "owner" && role !== "admin") throw forbidden("organization-admin-required", "Only an owner or admin of the organization turns guest links on or off");
+		const body = await c.req.json().catch(() => void 0);
+		if (typeof body?.allowed !== "boolean") throw badRequest("allowed-required", "Send { allowed: true } or { allowed: false }");
+		await (await calls.runtime()).setOrganizationGuests({
+			organization,
+			allowed: body.allowed,
+			by: String(session.user.id)
+		});
+		return c.json({ allowed: body.allowed });
+	});
+	return app;
+};
+//#endregion
+export { organizationGuestsRoute };

package/dist/calls/record-organization.js

@@ -0,0 +1,24 @@
+import { decodeKey } from "@protobase/schema/internal";
+import { sql } from "kysely";
+//#region src/calls/record-organization.ts
+/**
+* The organization a call's record is in, read from the record's own tenant field with no access check: `null` for a
+* record of a resource without a tenant, or one that is gone, which no organization's switch covers. A key of a relation
+* to a resource with a key of several fields is read as none either, so its calls take no guests.
+*/
+const recordOrganization = (registry) => async (trx, record) => {
+	const entry = registry.find(record.resource);
+	const tenant = entry?.model.tenant;
+	if (!entry || !tenant) return null;
+	const { model } = entry;
+	const decoded = decodeKey(record.key, entry.keyTypes);
+	const values = Array.isArray(decoded) ? decoded : [decoded];
+	if (values.length !== model.primaryKey.length) return null;
+	const table = model.table.schema ? sql.id(model.table.schema, model.table.name) : sql.id(model.table.name);
+	const where = sql.join(model.primaryKey.map((name, index) => sql`${sql.id(model.fields[name].column)} = ${values[index]}`), sql` and `);
+	const { rows } = await sql`select ${sql.id(model.fields[tenant].column)} as tenant from ${table} where ${where}`.execute(trx);
+	const found = rows[0]?.tenant;
+	return found === void 0 || found === null ? null : String(found);
+};
+//#endregion
+export { recordOrganization };

package/dist/create-admin.js

@@ -61,6 +61,10 @@ import { webhookTable } from "./webhooks/table/webhook-table.js";
 import { subscriptionUrlCheck, subscriptionWriteCheck } from "./webhooks/table/validate-hook.js";
 import { callsService } from "./calls/calls-service.js";
 import { ringRoutes } from "./calls/ring-routes.js";
+import { upgradeAuthenticator } from "./functions/upgrade-caller.js";
+import { guestRoutes } from "./calls/guest-routes.js";
+import { organizationGuestsRoute } from "./calls/organization-guests-route.js";
+import { organizationRole } from "./better-auth/organizations/organization-role.js";
 import { deviceStore, removeDevicesWithUsers } from "./notifications/device-store-of.js";
 import { historyStore, removeHistoryWithUsers } from "./notifications/history-store-of.js";
 import { devicesPath, historyPath } from "./notifications/paths.js";
@@ -91,7 +95,6 @@ import { fieldDecrypter } from "./encryption/decrypt-field.js";
 import { createEncryptionRuntime } from "./encryption/runtime.js";
 import { functionRoutes } from "./functions/routes.js";
 import { supabaseFunctionRoutes } from "./functions/supabase-routes.js";
-import { upgradeAuthenticator } from "./functions/upgrade-caller.js";
 import { localeSetting } from "./locale/locale-option.js";
 import { requestLocale } from "./locale/request-locale.js";
 import { mapSettings } from "./maps/map-settings.js";
@@ -112,7 +115,8 @@ import { createScanGuard } from "./scan-guard.js";
 import { failedJobs, failedJobsView } from "./jobs/failed-jobs.js";
 import { Hono } from "hono";
 import { accountPage, accountPageName, checkPages, settingsResources, withSettingsFields } from "@protobase/layout";
-import { ringsPath, statusPath } from "@protobase/schema/internal";
+import { guestCallsPath, ringsPath, statusPath } from "@protobase/schema/internal";
+import { getIP } from "better-auth/api";
 //#region src/create-admin.ts
 const declaredRoles = (auth, roles) => {
 	const names = [...auth?.roles ?? [], ...Object.keys(roles?.definitions ?? {})];
@@ -270,6 +274,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 			notices: changes,
 			channels: () => channels,
 			notifications: Boolean(notifications),
+			organizations: Boolean(auth?.organizations),
 			...auth?.origins[0] && { origin: auth.origins[0] },
 			...statusTables && { doNotDisturb: (ringDb, userIds) => onDoNotDisturb(ringDb, statusTables.statuses, userIds) }
 		}) }
@@ -470,6 +475,21 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	}
 	if (statusTables) app.route(statusPath(systemPath), guarded((routes) => void routes.route("/", statusRoutes(db, statusTables))));
 	if (deps.calls) app.route(ringsPath(systemPath), guarded((routes) => void routes.route("/", ringRoutes(deps.calls))));
+	if (deps.calls && auth) {
+		const addressOf = (request) => getIP(request, auth.options);
+		app.route(guestCallsPath(systemPath), guestRoutes({
+			calls: deps.calls,
+			addressOf,
+			origins: auth.origins,
+			onError,
+			...upgradeWebSocket && { upgradeWebSocket },
+			report
+		}));
+		if (auth.organizations) app.route(guestCallsPath(systemPath, "organization"), guarded((routes) => void routes.route("/", organizationGuestsRoute({
+			calls: deps.calls,
+			roleIn: organizationRole(auth)
+		}))));
+	}
 	if (forms) app.route(`${systemPath}/forms`, formRoutes(deps, forms));
 	const feed = tableFeed({
 		db,

package/dist/functions/routes.js

@@ -2,9 +2,9 @@ import { forbidden, notFound } from "../problem.js";
 import { namingTimeouts } from "../statement-timeout.js";
 import { auditOrigin } from "../audit/origin.js";
 import { invokeFunction } from "./define-function.js";
+import { socketAcceptor } from "./accept-socket.js";
 import { runInBackground } from "../background-work.js";
 import { callsAccess } from "../calls/calls-access.js";
-import { socketAcceptor } from "./accept-socket.js";
 import { ownMailbox } from "./own-mailbox.js";
 import { functionGate, requireGate } from "./function-gate.js";
 import { sameCaller } from "./same-caller.js";

package/dist/functions/upgrade-caller.js

@@ -22,4 +22,4 @@ const upgradeAuthenticator = ({ authenticate, origins, sessionToken }) => async
 	return authenticate(new Request(request, { headers }));
 };
 //#endregion
-export { upgradeAuthenticator };
+export { allowedOrigin, upgradeAuthenticator };

package/dist/index.js

@@ -68,6 +68,7 @@ import { historyIdPattern, historyLimits } from "./notifications/history.js";
 import { PushMessageError, maxTtlSeconds, pushMessage, urgencies } from "./notifications/message.js";
 import { NotificationSendError, maxMessageBytes, maxRecipients } from "./notifications/send-input.js";
 import { sendNotification } from "./notifications/send-notification.js";
+import { capSocketMessages, honorSocketMessageCaps, socketMessageCapOf } from "./functions/socket-message-cap.js";
 import { maxHistoryPage, maxUnreadCount } from "./notifications/history-store.js";
 import { generateVapidKeys } from "./notifications/web-push/keys.js";
 import { DeviceStoreError, postgresDeviceStore } from "./notifications/postgres-store.js";
@@ -89,7 +90,6 @@ import { localFileStore } from "./files/local-files.js";
 import { s3FileStore } from "./files/s3-files.js";
 import { storageProvider } from "./files/storage-provider.js";
 import { isBackgroundWork, runInBackground, wantsLongQueries } from "./background-work.js";
-import { capSocketMessages, honorSocketMessageCaps, socketMessageCapOf } from "./functions/socket-message-cap.js";
 import { mapSettings, mapStyleUrl, mapStyleVariable } from "./maps/map-settings.js";
 import { beforeSignInPluginsVariable, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable } from "./plugins/plugin-settings.js";
 import { runtimeUrl, runtimeVariable, seesRuntime } from "./runtime/runtime-settings.js";

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.62.5";
+var version = "0.63.0";
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.62.5",
+  "version": "0.63.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -42,9 +42,9 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.62.5",
-    "@protobase/query": "0.62.5",
-    "@protobase/schema": "0.62.5",
+    "@protobase/layout": "0.63.0",
+    "@protobase/query": "0.63.0",
+    "@protobase/schema": "0.63.0",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",