@protobase/server 0.63.1 → 0.63.3

package/dist/better-auth/first-admin-url.js

@@ -0,0 +1,15 @@
+import { checkedUrl } from "../checked-url.js";
+//#region src/better-auth/first-admin-url.ts
+const firstAdminUrlVariable = "PROTOBASE_FIRST_ADMIN_URL";
+/**
+* Where the app's first user is added when the platform hosting it does that, such as its console's page for the app,
+* from `PROTOBASE_FIRST_ADMIN_URL`. The no-users page then links there in place of the `protobase users create`
+* command, which only someone on the host can run. A value that is no http(s) URL stops the server at startup.
+*/
+const firstAdminUrl = (env) => {
+	const url = env[firstAdminUrlVariable]?.trim();
+	if (!url) return void 0;
+	return checkedUrl(url, firstAdminUrlVariable);
+};
+//#endregion
+export { firstAdminUrl, firstAdminUrlVariable };

package/dist/better-auth/organizations/session-organization.js

@@ -37,21 +37,28 @@ const organizationClaims = async (adapter, user, activeOrganizationId) => {
 	return {};
 };
 /**
+* The organization a new session of `user` starts in (`initialOrganization`): the one they last worked in while they
+* may still enter it, else their oldest membership, else none.
+*/
+const startingOrganization = async (adapter, user) => {
+	const last = user.lastOrganizationId;
+	return initialOrganization({
+		memberships: summaries(await membershipsOf(adapter, user.id)),
+		last,
+		entersAny: globalRoles(user.role).length > 0,
+		lastExists: Boolean(last) && await findOrganization(adapter, last) !== null
+	});
+};
+/**
 * Better Auth's session hooks for organizations: a new session starts in the organization the person last worked in
-* (`initialOrganization`), and a session's change of organization is kept on the user as the next one's start.
+* (`startingOrganization`), and a session's change of organization is kept on the user as the next one's start.
 */
 const sessionOrganizationHooks = (context) => ({
 	create: { before: async (session) => {
 		const { adapter, internalAdapter } = await context();
 		const user = await internalAdapter.findUserById(session.userId);
 		if (!user) return;
-		const last = user.lastOrganizationId;
-		const activeOrganizationId = initialOrganization({
-			memberships: summaries(await membershipsOf(adapter, user.id)),
-			last,
-			entersAny: globalRoles(user.role).length > 0,
-			lastExists: Boolean(last) && await findOrganization(adapter, last) !== null
-		});
+		const activeOrganizationId = await startingOrganization(adapter, user);
 		return activeOrganizationId ? { data: {
 			...session,
 			activeOrganizationId
@@ -65,4 +72,4 @@ const sessionOrganizationHooks = (context) => ({
 	} }
 });
 //#endregion
-export { lastOrganizationField, mayEnter, organizationClaims, sessionOrganizationHooks };
+export { lastOrganizationField, mayEnter, organizationClaims, sessionOrganizationHooks, startingOrganization };

package/dist/better-auth/status-route.js

@@ -6,7 +6,8 @@ import { hasUsers } from "./users.js";
 import { Hono } from "hono";
 //#region src/better-auth/status-route.ts
 /**
-* `GET {authBase}/status`: `needsAdmin` while the admin store has no user, so a login page can say how to create one;
+* `GET {authBase}/status`: `needsAdmin` while the admin store has no user, so a login page can say how to create one,
+* with `firstAdminUrl` then, the platform's page where it is added, when the platform names one (see `firstAdminUrl`);
 * `signInMethods`, the ways to sign in the sign-in policy leaves on (`password`, `emailCode`, `passkey`), so it offers
 * only those; `passwordReset` when reset mail can be sent and passwords are on, so it offers "Forgot password?" only
 * then; `signInFirst: 'emailCode'` when the app has the sign-in page lead with an emailed code and the policy leaves both it and passwords on; `changeEmail` when mail can be sent, so the account page offers to change the address with an emailed code; `accountDeletion` when people may delete their own account, so the account page offers it; `signUp` when the app has open sign-up, so it offers "Create an account"; the ids of the `socialProviders` people can sign in with, so it offers "Continue with GitHub" when `github` is
@@ -18,7 +19,7 @@ import { Hono } from "hono";
 * `plugins`, those the app loads before sign-in (see `PluginOption`); and `locale`, the language `options.locale` puts
 * the screens in, so the sign-in screens and public forms, which come before `/meta`, are in it too.
 */
-const statusRoute = (auth, { anonymous = false, plugins = [], locale } = {}) => {
+const statusRoute = (auth, { anonymous = false, plugins = [], locale, firstAdminUrl } = {}) => {
 	const app = new Hono();
 	app.get("/status", async (c) => {
 		const context = await auth.$context;
@@ -33,8 +34,10 @@ const statusRoute = (auth, { anonymous = false, plugins = [], locale } = {}) =>
 		const platformSignIn = platform && policy.platformSignIn === "allowed" && context.socialProviders.some((provider) => provider.id === platform.provider) ? platform : void 0;
 		const socialProviders = [...auth.socialProviders, ...platformSignIn ? [platformSignIn.provider] : []];
 		const passkeyDomains = signInMethods.includes("passkey") ? await signInPasskeyDomains(context.adapter, auth.passkeyDomain, auth.origins) : [];
+		const needsAdmin = !await hasUsers(auth);
 		return c.json({
-			needsAdmin: !await hasUsers(auth),
+			needsAdmin,
+			...needsAdmin && firstAdminUrl && { firstAdminUrl },
 			signInMethods,
 			passwordReset: auth.passwordReset && policy.password === "allowed",
 			...auth.signInFirst === "emailCode" && signInMethods.includes("emailCode") && signInMethods.includes("password") && { signInFirst: "emailCode" },

package/dist/better-auth/tokens.d.ts

@@ -4,12 +4,18 @@ export type IssueTokenOptions = {
   email: string;
   /** Lifetime in seconds. Default 15 minutes, at most 24 hours. */
   ttlSeconds?: number;
+  /**
+   * With organizations, the organization the token works in, by id or slug; refused unless the person may work in it.
+   * Default: the one a new session of theirs would start in.
+   */
+  organization?: string;
 };
 export declare const maxTokenTtlSeconds: number;
 /**
- * Mints a bearer token for an existing user: signed with the JWT plugin's keys, same issuer, audience and claims
- * (`sub`, `email`, `role`) as `/api/auth/token`, so the API accepts it like a token from a browser session. It carries
- * the role the user last chose, else their first.
+ * Mints a bearer token for an existing user: signed with the JWT plugin's keys, same issuer, audience and claims as
+ * `/api/auth/token` for a new session of theirs (see `tokenClaims`), so the API accepts it like a token from a browser
+ * session. It carries the role the user last chose, else their first; with organizations, the claims of
+ * `options.organization`, else of the organization a new session would start in.
  * Host side only: there is no HTTP route for this.
  */
 export declare const issueToken: (auth: AdminAuth, options: IssueTokenOptions) => Promise<{

package/dist/better-auth/tokens.js

@@ -1,17 +1,26 @@
-import { parseRoles } from "./parse-roles.js";
-import { narrowClaims } from "./roles/active-role.js";
+import { mayEnter, startingOrganization } from "./organizations/session-organization.js";
+import { tokenClaims } from "./token-claims.js";
+import { findOrganizationByKey } from "./organizations/host.js";
 //#region src/better-auth/tokens.ts
 const defaultTtlSeconds = 900;
 const maxTokenTtlSeconds = 86400;
+const organizationOf = async (auth, adapter, user, organization) => {
+	if (organization === void 0) return startingOrganization(adapter, user);
+	const found = await findOrganizationByKey(auth, organization);
+	if (!await mayEnter(adapter, user, found.id)) throw new Error(`${user.email} may not work in organization "${organization}"`);
+	return found.id;
+};
 /**
-* Mints a bearer token for an existing user: signed with the JWT plugin's keys, same issuer, audience and claims
-* (`sub`, `email`, `role`) as `/api/auth/token`, so the API accepts it like a token from a browser session. It carries
-* the role the user last chose, else their first.
+* Mints a bearer token for an existing user: signed with the JWT plugin's keys, same issuer, audience and claims as
+* `/api/auth/token` for a new session of theirs (see `tokenClaims`), so the API accepts it like a token from a browser
+* session. It carries the role the user last chose, else their first; with organizations, the claims of
+* `options.organization`, else of the organization a new session would start in.
 * Host side only: there is no HTTP route for this.
 */
 const issueToken = async (auth, options) => {
 	const ttl = options.ttlSeconds ?? defaultTtlSeconds;
 	if (!Number.isInteger(ttl) || ttl < 1 || ttl > 86400) throw new Error(`Token lifetime must be between 1 second and ${maxTokenTtlSeconds} seconds (24 hours)`);
+	if (options.organization !== void 0 && !auth.organizations) throw new Error("Organizations are off: a token cannot name an organization");
 	const { adapter } = await auth.$context;
 	const user = await adapter.findOne({
 		model: "user",
@@ -22,15 +31,19 @@ const issueToken = async (auth, options) => {
 	});
 	if (!user) throw new Error(`No user with email ${options.email}`);
 	if (user.banned) throw new Error(`${options.email} is banned`);
+	const organizationId = auth.organizations ? await organizationOf(auth, adapter, user, options.organization) : void 0;
+	const claims = await tokenClaims(user, {
+		wanted: [user.lastRole],
+		organizationId,
+		...auth.organizations && { organizations: adapter }
+	});
 	const issuedAt = Math.floor(Date.now() / 1e3);
-	const { role } = narrowClaims({ role: parseRoles(user.role).join(",") }, [user.lastRole], Boolean(auth.organizations));
 	await auth.api.ensureSigningKey();
 	const { token } = await auth.api.signJWT({ body: { payload: {
 		iat: issuedAt,
 		exp: issuedAt + ttl,
 		sub: user.id,
-		email: user.email,
-		role
+		...claims
 	} } });
 	return {
 		token,

package/dist/create-admin.js

@@ -111,6 +111,7 @@ import { faviconPath } from "./web-app/web-manifest.js";
 import { webManifestRoute } from "./web-app/web-manifest-route.js";
 import { mcpIcons } from "./web-app/mcp-icons.js";
 import { recordRoutes } from "./routes/record.js";
+import { firstAdminUrl } from "./better-auth/first-admin-url.js";
 import { createScanGuard } from "./scan-guard.js";
 import { failedJobs, failedJobsView } from "./jobs/failed-jobs.js";
 import { Hono } from "hono";
@@ -181,6 +182,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	const systemPath = basePath.slice(0, basePath.lastIndexOf("/"));
 	const assistant = assistantSettings(options.assistant, globalThis.process?.env ?? {});
 	const runtime = runtimeUrl(options.runtime, globalThis.process?.env ?? {});
+	const firstAdmin = firstAdminUrl(globalThis.process?.env ?? {});
 	const errorReporting = errorReportingSettings(options.errorReporting, globalThis.process?.env ?? {});
 	const maps = mapSettings(options.maps, globalThis.process?.env ?? {});
 	const senders = notifications ? notificationSenders(notifications) : [];
@@ -329,7 +331,8 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		app.route(authBasePath, statusRoute(auth, {
 			anonymous: visitorsBrowse(options.roles),
 			plugins: pluginsBeforeSignIn(plugins),
-			...locale && { locale }
+			...locale && { locale },
+			...firstAdmin && { firstAdminUrl: firstAdmin }
 		}));
 		if (auth.organizations) app.route(authBasePath, organizationRoutes({
 			auth,

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.63.1";
+var version = "0.63.3";
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.63.1",
+  "version": "0.63.3",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -42,9 +42,9 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.63.1",
-    "@protobase/query": "0.63.1",
-    "@protobase/schema": "0.63.1",
+    "@protobase/layout": "0.63.3",
+    "@protobase/query": "0.63.3",
+    "@protobase/schema": "0.63.3",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",