@protobase/server 0.63.0 → 0.63.1

package/dist/better-auth/create-auth.d.ts

@@ -113,10 +113,10 @@ export type CreateAuthOptions = {
   /**
    * The mail providers people may link their own mailbox with, from the account page, for the app's functions to send
    * mail from it (`context.personalMail`), such as `['gmail']`. Each links through its sign-in provider, which
-   * `socialProviders` must have: Gmail through `google`. Default none.
+   * `socialProviders` must have: Gmail through `google`. Needs `encryptOAuthTokens`. Default none.
    */
   personalMail?: PersonalMailProviderId[];
-  /** Encrypt the OAuth access, refresh and ID tokens Better Auth stores for social sign-ins, with `secret`. Default off. */
+  /** Encrypt the OAuth access and refresh tokens Better Auth stores for social sign-ins, with `secret`; `personalMail` needs it. Default off. */
   encryptOAuthTokens?: boolean;
   /** Runs after a user is created, by any route: `createUser`, an admin, or a social sign-up. Default none. */
   onUserCreated?: UserCreatedHook;

package/dist/better-auth/create-auth.js

@@ -78,6 +78,7 @@ const tokenLifetime = "15m";
 /** The configured roles with `admin` first; `admin` is added when missing. */
 const normalizeRoles = (roles) => roleDefinitions(roles).names;
 const adminImpersonationPaths = ["/admin/impersonate-user", "/admin/stop-impersonating"];
+const providerTokenPaths = ["/get-access-token", "/refresh-token"];
 /** The optional plugins `options` turns on, imported: an app without SAML or MCP loads neither. */
 const loadAuthPlugins = async (options) => ({
 	...(options.sso?.saml.length ?? 0) > 0 && { samlPlugin: (await import("./saml-plugin.js")).samlPlugin },
@@ -268,6 +269,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			...accountDeletion ? [] : [selfDeletionPath],
 			...unusedEmailCodePaths,
 			...adminImpersonationPaths,
+			...providerTokenPaths,
 			...organizations ? organizationPaths : [],
 			...saml.length > 0 ? samlDisabledPaths : [],
 			...mcp ? mcpUnusedPaths : []
@@ -371,7 +373,7 @@ const createAuth = (options, plugins = {}) => {
 	const socialProviders = Object.keys(options.socialProviders ?? {});
 	const platformSignIn = platformSignInFor(signInSettings && resolvePlatformSignIn(signInSettings), socialProviders);
 	const saml = resolveSamlProviders(options.sso?.saml ?? [], [...socialProviders, ...platformSignIn ? [platformSignIn.provider] : []]);
-	const personalMail = resolvePersonalMail(options.personalMail ?? [], socialProviders);
+	const personalMail = resolvePersonalMail(options.personalMail ?? [], socialProviders, options.encryptOAuthTokens === true);
 	const origins = resolveOrigins(options.baseURL, options.origins ?? platformOrigins());
 	const passkeyDomain = resolvePasskeyDomain(options.passkeyDomain ?? platformPasskeyDomain(), [options.baseURL, ...origins]);
 	const organizations = options.organizations && resolveOrganizations(options.organizations, definitions, options.baseURL);
@@ -477,4 +479,4 @@ const createAuth = (options, plugins = {}) => {
 /** `createAuth` with the optional plugins its options turn on loaded first (see `loadAuthPlugins`). */
 const buildAuth = async (options) => createAuth(options, await loadAuthPlugins(options));
 //#endregion
-export { authBasePath, betterAuthOptions, buildAuth, createAuth, loadAuthPlugins, normalizeRoles };
+export { authBasePath, betterAuthOptions, buildAuth, createAuth, loadAuthPlugins, normalizeRoles, providerTokenPaths };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.63.0";
+var version = "0.63.1";
 //#endregion
 export { version };

package/dist/personal-mail/personal-mail-providers.js

@@ -4,13 +4,17 @@ import { gmail } from "./gmail.js";
 const personalMailProviders = { gmail };
 /**
 * The providers of `ids`, each checked against the app's sign-in providers: linking one goes through its sign-in
-* provider, so an app without it is a configuration error at startup.
+* provider, so an app without it is a configuration error at startup. So is one whose OAuth tokens are not encrypted
+* (`encryptOAuthTokens`): a linked account's tokens send mail as the person, so they are never stored in plain text.
 */
-const resolvePersonalMail = (ids, signInProviders) => ids.map((id) => {
-	if (!Object.hasOwn(personalMailProviders, id)) throw new Error(`auth.personalMail: "${id}" is not a mail provider; use one of ${Object.keys(personalMailProviders).join(", ")}`);
-	const provider = personalMailProviders[id]();
-	if (!signInProviders.includes(provider.signInProvider)) throw new Error(`auth.personalMail: ${provider.name} links through the sign-in provider "${provider.signInProvider}"; add it to auth.socialProviders`);
-	return provider;
-});
+const resolvePersonalMail = (ids, signInProviders, encryptOAuthTokens) => {
+	if (ids.length > 0 && !encryptOAuthTokens) throw new Error("auth.personalMail: the linked mailboxes' tokens would be stored in plain text; turn on auth.encryptOAuthTokens");
+	return ids.map((id) => {
+		if (!Object.hasOwn(personalMailProviders, id)) throw new Error(`auth.personalMail: "${id}" is not a mail provider; use one of ${Object.keys(personalMailProviders).join(", ")}`);
+		const provider = personalMailProviders[id]();
+		if (!signInProviders.includes(provider.signInProvider)) throw new Error(`auth.personalMail: ${provider.name} links through the sign-in provider "${provider.signInProvider}"; add it to auth.socialProviders`);
+		return provider;
+	});
+};
 //#endregion
 export { personalMailProviders, resolvePersonalMail };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.63.0",
+  "version": "0.63.1",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -42,9 +42,9 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.63.0",
-    "@protobase/query": "0.63.0",
-    "@protobase/schema": "0.63.0",
+    "@protobase/layout": "0.63.1",
+    "@protobase/query": "0.63.1",
+    "@protobase/schema": "0.63.1",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",