@protobase/server 0.63.0 → 0.63.2

package/dist/better-auth/create-auth.d.ts

@@ -113,10 +113,10 @@ export type CreateAuthOptions = {
   /**
    * The mail providers people may link their own mailbox with, from the account page, for the app's functions to send
    * mail from it (`context.personalMail`), such as `['gmail']`. Each links through its sign-in provider, which
-   * `socialProviders` must have: Gmail through `google`. Default none.
+   * `socialProviders` must have: Gmail through `google`. Needs `encryptOAuthTokens`. Default none.
    */
   personalMail?: PersonalMailProviderId[];
-  /** Encrypt the OAuth access, refresh and ID tokens Better Auth stores for social sign-ins, with `secret`. Default off. */
+  /** Encrypt the OAuth access and refresh tokens Better Auth stores for social sign-ins, with `secret`; `personalMail` needs it. Default off. */
   encryptOAuthTokens?: boolean;
   /** Runs after a user is created, by any route: `createUser`, an admin, or a social sign-up. Default none. */
   onUserCreated?: UserCreatedHook;

package/dist/better-auth/create-auth.js

@@ -78,6 +78,7 @@ const tokenLifetime = "15m";
 /** The configured roles with `admin` first; `admin` is added when missing. */
 const normalizeRoles = (roles) => roleDefinitions(roles).names;
 const adminImpersonationPaths = ["/admin/impersonate-user", "/admin/stop-impersonating"];
+const providerTokenPaths = ["/get-access-token", "/refresh-token"];
 /** The optional plugins `options` turns on, imported: an app without SAML or MCP loads neither. */
 const loadAuthPlugins = async (options) => ({
 	...(options.sso?.saml.length ?? 0) > 0 && { samlPlugin: (await import("./saml-plugin.js")).samlPlugin },
@@ -268,6 +269,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			...accountDeletion ? [] : [selfDeletionPath],
 			...unusedEmailCodePaths,
 			...adminImpersonationPaths,
+			...providerTokenPaths,
 			...organizations ? organizationPaths : [],
 			...saml.length > 0 ? samlDisabledPaths : [],
 			...mcp ? mcpUnusedPaths : []
@@ -371,7 +373,7 @@ const createAuth = (options, plugins = {}) => {
 	const socialProviders = Object.keys(options.socialProviders ?? {});
 	const platformSignIn = platformSignInFor(signInSettings && resolvePlatformSignIn(signInSettings), socialProviders);
 	const saml = resolveSamlProviders(options.sso?.saml ?? [], [...socialProviders, ...platformSignIn ? [platformSignIn.provider] : []]);
-	const personalMail = resolvePersonalMail(options.personalMail ?? [], socialProviders);
+	const personalMail = resolvePersonalMail(options.personalMail ?? [], socialProviders, options.encryptOAuthTokens === true);
 	const origins = resolveOrigins(options.baseURL, options.origins ?? platformOrigins());
 	const passkeyDomain = resolvePasskeyDomain(options.passkeyDomain ?? platformPasskeyDomain(), [options.baseURL, ...origins]);
 	const organizations = options.organizations && resolveOrganizations(options.organizations, definitions, options.baseURL);
@@ -477,4 +479,4 @@ const createAuth = (options, plugins = {}) => {
 /** `createAuth` with the optional plugins its options turn on loaded first (see `loadAuthPlugins`). */
 const buildAuth = async (options) => createAuth(options, await loadAuthPlugins(options));
 //#endregion
-export { authBasePath, betterAuthOptions, buildAuth, createAuth, loadAuthPlugins, normalizeRoles };
+export { authBasePath, betterAuthOptions, buildAuth, createAuth, loadAuthPlugins, normalizeRoles, providerTokenPaths };

package/dist/better-auth/organizations/session-organization.js

@@ -37,21 +37,28 @@ const organizationClaims = async (adapter, user, activeOrganizationId) => {
 	return {};
 };
 /**
+* The organization a new session of `user` starts in (`initialOrganization`): the one they last worked in while they
+* may still enter it, else their oldest membership, else none.
+*/
+const startingOrganization = async (adapter, user) => {
+	const last = user.lastOrganizationId;
+	return initialOrganization({
+		memberships: summaries(await membershipsOf(adapter, user.id)),
+		last,
+		entersAny: globalRoles(user.role).length > 0,
+		lastExists: Boolean(last) && await findOrganization(adapter, last) !== null
+	});
+};
+/**
 * Better Auth's session hooks for organizations: a new session starts in the organization the person last worked in
-* (`initialOrganization`), and a session's change of organization is kept on the user as the next one's start.
+* (`startingOrganization`), and a session's change of organization is kept on the user as the next one's start.
 */
 const sessionOrganizationHooks = (context) => ({
 	create: { before: async (session) => {
 		const { adapter, internalAdapter } = await context();
 		const user = await internalAdapter.findUserById(session.userId);
 		if (!user) return;
-		const last = user.lastOrganizationId;
-		const activeOrganizationId = initialOrganization({
-			memberships: summaries(await membershipsOf(adapter, user.id)),
-			last,
-			entersAny: globalRoles(user.role).length > 0,
-			lastExists: Boolean(last) && await findOrganization(adapter, last) !== null
-		});
+		const activeOrganizationId = await startingOrganization(adapter, user);
 		return activeOrganizationId ? { data: {
 			...session,
 			activeOrganizationId
@@ -65,4 +72,4 @@ const sessionOrganizationHooks = (context) => ({
 	} }
 });
 //#endregion
-export { lastOrganizationField, mayEnter, organizationClaims, sessionOrganizationHooks };
+export { lastOrganizationField, mayEnter, organizationClaims, sessionOrganizationHooks, startingOrganization };

package/dist/better-auth/tokens.d.ts

@@ -4,12 +4,18 @@ export type IssueTokenOptions = {
   email: string;
   /** Lifetime in seconds. Default 15 minutes, at most 24 hours. */
   ttlSeconds?: number;
+  /**
+   * With organizations, the organization the token works in, by id or slug; refused unless the person may work in it.
+   * Default: the one a new session of theirs would start in.
+   */
+  organization?: string;
 };
 export declare const maxTokenTtlSeconds: number;
 /**
- * Mints a bearer token for an existing user: signed with the JWT plugin's keys, same issuer, audience and claims
- * (`sub`, `email`, `role`) as `/api/auth/token`, so the API accepts it like a token from a browser session. It carries
- * the role the user last chose, else their first.
+ * Mints a bearer token for an existing user: signed with the JWT plugin's keys, same issuer, audience and claims as
+ * `/api/auth/token` for a new session of theirs (see `tokenClaims`), so the API accepts it like a token from a browser
+ * session. It carries the role the user last chose, else their first; with organizations, the claims of
+ * `options.organization`, else of the organization a new session would start in.
  * Host side only: there is no HTTP route for this.
  */
 export declare const issueToken: (auth: AdminAuth, options: IssueTokenOptions) => Promise<{

package/dist/better-auth/tokens.js

@@ -1,17 +1,26 @@
-import { parseRoles } from "./parse-roles.js";
-import { narrowClaims } from "./roles/active-role.js";
+import { mayEnter, startingOrganization } from "./organizations/session-organization.js";
+import { tokenClaims } from "./token-claims.js";
+import { findOrganizationByKey } from "./organizations/host.js";
 //#region src/better-auth/tokens.ts
 const defaultTtlSeconds = 900;
 const maxTokenTtlSeconds = 86400;
+const organizationOf = async (auth, adapter, user, organization) => {
+	if (organization === void 0) return startingOrganization(adapter, user);
+	const found = await findOrganizationByKey(auth, organization);
+	if (!await mayEnter(adapter, user, found.id)) throw new Error(`${user.email} may not work in organization "${organization}"`);
+	return found.id;
+};
 /**
-* Mints a bearer token for an existing user: signed with the JWT plugin's keys, same issuer, audience and claims
-* (`sub`, `email`, `role`) as `/api/auth/token`, so the API accepts it like a token from a browser session. It carries
-* the role the user last chose, else their first.
+* Mints a bearer token for an existing user: signed with the JWT plugin's keys, same issuer, audience and claims as
+* `/api/auth/token` for a new session of theirs (see `tokenClaims`), so the API accepts it like a token from a browser
+* session. It carries the role the user last chose, else their first; with organizations, the claims of
+* `options.organization`, else of the organization a new session would start in.
 * Host side only: there is no HTTP route for this.
 */
 const issueToken = async (auth, options) => {
 	const ttl = options.ttlSeconds ?? defaultTtlSeconds;
 	if (!Number.isInteger(ttl) || ttl < 1 || ttl > 86400) throw new Error(`Token lifetime must be between 1 second and ${maxTokenTtlSeconds} seconds (24 hours)`);
+	if (options.organization !== void 0 && !auth.organizations) throw new Error("Organizations are off: a token cannot name an organization");
 	const { adapter } = await auth.$context;
 	const user = await adapter.findOne({
 		model: "user",
@@ -22,15 +31,19 @@ const issueToken = async (auth, options) => {
 	});
 	if (!user) throw new Error(`No user with email ${options.email}`);
 	if (user.banned) throw new Error(`${options.email} is banned`);
+	const organizationId = auth.organizations ? await organizationOf(auth, adapter, user, options.organization) : void 0;
+	const claims = await tokenClaims(user, {
+		wanted: [user.lastRole],
+		organizationId,
+		...auth.organizations && { organizations: adapter }
+	});
 	const issuedAt = Math.floor(Date.now() / 1e3);
-	const { role } = narrowClaims({ role: parseRoles(user.role).join(",") }, [user.lastRole], Boolean(auth.organizations));
 	await auth.api.ensureSigningKey();
 	const { token } = await auth.api.signJWT({ body: { payload: {
 		iat: issuedAt,
 		exp: issuedAt + ttl,
 		sub: user.id,
-		email: user.email,
-		role
+		...claims
 	} } });
 	return {
 		token,

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.63.0";
+var version = "0.63.2";
 //#endregion
 export { version };

package/dist/personal-mail/personal-mail-providers.js

@@ -4,13 +4,17 @@ import { gmail } from "./gmail.js";
 const personalMailProviders = { gmail };
 /**
 * The providers of `ids`, each checked against the app's sign-in providers: linking one goes through its sign-in
-* provider, so an app without it is a configuration error at startup.
+* provider, so an app without it is a configuration error at startup. So is one whose OAuth tokens are not encrypted
+* (`encryptOAuthTokens`): a linked account's tokens send mail as the person, so they are never stored in plain text.
 */
-const resolvePersonalMail = (ids, signInProviders) => ids.map((id) => {
-	if (!Object.hasOwn(personalMailProviders, id)) throw new Error(`auth.personalMail: "${id}" is not a mail provider; use one of ${Object.keys(personalMailProviders).join(", ")}`);
-	const provider = personalMailProviders[id]();
-	if (!signInProviders.includes(provider.signInProvider)) throw new Error(`auth.personalMail: ${provider.name} links through the sign-in provider "${provider.signInProvider}"; add it to auth.socialProviders`);
-	return provider;
-});
+const resolvePersonalMail = (ids, signInProviders, encryptOAuthTokens) => {
+	if (ids.length > 0 && !encryptOAuthTokens) throw new Error("auth.personalMail: the linked mailboxes' tokens would be stored in plain text; turn on auth.encryptOAuthTokens");
+	return ids.map((id) => {
+		if (!Object.hasOwn(personalMailProviders, id)) throw new Error(`auth.personalMail: "${id}" is not a mail provider; use one of ${Object.keys(personalMailProviders).join(", ")}`);
+		const provider = personalMailProviders[id]();
+		if (!signInProviders.includes(provider.signInProvider)) throw new Error(`auth.personalMail: ${provider.name} links through the sign-in provider "${provider.signInProvider}"; add it to auth.socialProviders`);
+		return provider;
+	});
+};
 //#endregion
 export { personalMailProviders, resolvePersonalMail };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.63.0",
+  "version": "0.63.2",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -42,9 +42,9 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.63.0",
-    "@protobase/query": "0.63.0",
-    "@protobase/schema": "0.63.0",
+    "@protobase/layout": "0.63.2",
+    "@protobase/query": "0.63.2",
+    "@protobase/schema": "0.63.2",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",