@protobase/server 0.66.1 → 0.66.3

package/dist/better-auth/auth-settings.d.ts

@@ -8714,6 +8714,53 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
         }, ctx: ReplacingContext | null) => Promise<void>;
       };
     };
+    account: {
+      create?: {
+        before?: (account: import("better-auth").Account, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+          data: {
+            id?: string | undefined;
+            createdAt?: Date | undefined;
+            updatedAt?: Date | undefined;
+            providerId?: string | undefined;
+            accountId?: string | undefined;
+            userId?: string | undefined;
+            accessToken?: string | null | undefined;
+            refreshToken?: string | null | undefined;
+            idToken?: string | null | undefined;
+            accessTokenExpiresAt?: Date | null | undefined;
+            refreshTokenExpiresAt?: Date | null | undefined;
+            scope?: string | null | undefined;
+            password?: string | null | undefined;
+          } & Record<string, any>;
+        }>;
+        after?: (account: import("better-auth").Account, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+      };
+      update?: {
+        before?: (account: Partial<import("better-auth").Account> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+          data: {
+            [x: string]: any;
+            id?: string | undefined;
+            createdAt?: Date | undefined;
+            updatedAt?: Date | undefined;
+            providerId?: string | undefined;
+            accountId?: string | undefined;
+            userId?: string | undefined;
+            accessToken?: string | null | undefined;
+            refreshToken?: string | null | undefined;
+            idToken?: string | null | undefined;
+            accessTokenExpiresAt?: Date | null | undefined;
+            refreshTokenExpiresAt?: Date | null | undefined;
+            scope?: string | null | undefined;
+            password?: string | null | undefined;
+          };
+        }>;
+        after?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+      };
+      delete?: {
+        before?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+        after?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+      };
+    };
   };
   rateLimit: {
     enabled: true;

package/dist/better-auth/create-auth.d.ts

@@ -8832,6 +8832,53 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         }, ctx: ReplacingContext | null) => Promise<void>;
       };
     };
+    account: {
+      create?: {
+        before?: (account: import("better-auth").Account, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+          data: {
+            id?: string | undefined;
+            createdAt?: Date | undefined;
+            updatedAt?: Date | undefined;
+            providerId?: string | undefined;
+            accountId?: string | undefined;
+            userId?: string | undefined;
+            accessToken?: string | null | undefined;
+            refreshToken?: string | null | undefined;
+            idToken?: string | null | undefined;
+            accessTokenExpiresAt?: Date | null | undefined;
+            refreshTokenExpiresAt?: Date | null | undefined;
+            scope?: string | null | undefined;
+            password?: string | null | undefined;
+          } & Record<string, any>;
+        }>;
+        after?: (account: import("better-auth").Account, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+      };
+      update?: {
+        before?: (account: Partial<import("better-auth").Account> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+          data: {
+            [x: string]: any;
+            id?: string | undefined;
+            createdAt?: Date | undefined;
+            updatedAt?: Date | undefined;
+            providerId?: string | undefined;
+            accountId?: string | undefined;
+            userId?: string | undefined;
+            accessToken?: string | null | undefined;
+            refreshToken?: string | null | undefined;
+            idToken?: string | null | undefined;
+            accessTokenExpiresAt?: Date | null | undefined;
+            refreshTokenExpiresAt?: Date | null | undefined;
+            scope?: string | null | undefined;
+            password?: string | null | undefined;
+          };
+        }>;
+        after?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+      };
+      delete?: {
+        before?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+        after?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+      };
+    };
   };
   rateLimit: {
     enabled: true;

package/dist/better-auth/create-auth.js

@@ -8,6 +8,7 @@ import { goTrueSessionsPlugin } from "../gotrue/sessions-plugin.js";
 import { betterAuthLinkedAccounts } from "../personal-mail/linked-accounts.js";
 import { resolvePersonalMail } from "../personal-mail/personal-mail-providers.js";
 import { personalMailer } from "../personal-mail/personal-mailer.js";
+import { mailLinkHooks } from "../personal-mail/mail-link-hooks.js";
 import { endReplacedSession } from "./end-replaced-session.js";
 import { authBasePath } from "./auth-base-path.js";
 import { authLogger } from "./auth-logger.js";
@@ -299,7 +300,8 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				},
 				update: { before: async (user) => ({ data: confirmedOnUpdate(user, /* @__PURE__ */ new Date()) }) }
 			},
-			session: withEndedReplaced(organizations ? sessionOrganizationHooks(context) : {})
+			session: withEndedReplaced(organizations ? sessionOrganizationHooks(context) : {}),
+			account: mailLinkHooks(resolvePersonalMail(options.personalMail ?? [], Object.keys(options.socialProviders ?? {}), options.encryptOAuthTokens === true))
 		},
 		rateLimit: {
 			enabled: true,

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.66.1";
+var version = "0.66.3";
 //#endregion
 export { version };

package/dist/personal-mail/linked-accounts.js

@@ -12,7 +12,8 @@ const betterAuthLinkedAccounts = (auth) => ({
 		return (await (await auth.$context).internalAdapter.findAccounts(userId)).map((account) => ({
 			id: account.id,
 			providerId: account.providerId,
-			scopes: storedScopes(account.scope)
+			scopes: storedScopes(account.scope),
+			createdAt: account.createdAt
 		}));
 	},
 	accessToken: async (userId, account, provider) => {
@@ -33,4 +34,4 @@ const validAccessToken = async (auth, userId, accountId, provider) => {
 	}
 };
 //#endregion
-export { betterAuthLinkedAccounts };
+export { betterAuthLinkedAccounts, storedScopes };

package/dist/personal-mail/mail-link-hooks.js

@@ -0,0 +1,34 @@
+import { storedScopes } from "./linked-accounts.js";
+import { getOAuthState } from "better-auth/api";
+//#region src/personal-mail/mail-link-hooks.ts
+const holds = (scope, scopes) => scopes.every((wanted) => storedScopes(scope).includes(wanted));
+/** The mail provider whose scopes `account` holds, of the app's `providers`. */
+const mailProviderOf = (providers, account) => providers.find((candidate) => candidate.signInProvider === account.providerId && holds(account.scope, candidate.scopes));
+/**
+* The new scopes of `userAccounts` once `linked` holds `provider`'s mail scopes: each other account of its sign-in
+* provider that holds them too loses them, so mail goes through `linked` alone.
+*/
+const scopesHandedOver = (provider, linked, userAccounts) => userAccounts.filter((account) => account.id !== linked.id && account.providerId === linked.providerId && holds(account.scope, provider.scopes)).map((account) => ({
+	id: account.id,
+	scope: storedScopes(account.scope).filter((scope) => !provider.scopes.includes(scope)).join(",") || null
+}));
+/**
+* Better Auth's `databaseHooks.account`: an account written by a link, whose OAuth state names the person it links to,
+* becomes the one mail goes through when it holds a mail provider's scopes (see `scopesHandedOver`); other writes read nothing. Only a link
+* writes an existing account's scopes: a sign-in or a token refresh rewrites its tokens and leaves its scopes as they
+* were, so signing in with an older account does not take the mail back to it.
+*/
+const mailLinkHooks = (providers) => {
+	const handOver = async (account, context) => {
+		const provider = mailProviderOf(providers, account);
+		if (!context || !provider || !(await getOAuthState())?.link) return;
+		const adapter = context.context.internalAdapter;
+		for (const { id, scope } of scopesHandedOver(provider, account, await adapter.findAccounts(account.userId))) await adapter.updateAccount(id, { scope });
+	};
+	return {
+		create: { after: handOver },
+		update: { after: handOver }
+	};
+};
+//#endregion
+export { mailLinkHooks, mailProviderOf, scopesHandedOver };

package/dist/personal-mail/personal-mailer.js

@@ -1,10 +1,14 @@
 import { PersonalMailError } from "./personal-mail-error.js";
 //#region src/personal-mail/personal-mailer.ts
-/** The mail provider `userId` linked, of the app's `providers` in their order, with the account that holds its tokens. */
+/**
+* The mail provider `userId` linked, of the app's `providers` in their order, with the account that holds its tokens.
+* Linking a mailbox takes the mail scopes off the person's other accounts of that provider (`mailLinkHooks`), so one
+* account holds them; of accounts that still both hold them, as when both were linked before that, the one created last.
+*/
 const linkedProvider = async (accounts, providers, userId) => {
 	const linked = await accounts.accounts(userId);
 	for (const provider of providers) {
-		const account = linked.find((candidate) => candidate.providerId === provider.signInProvider && provider.scopes.every((scope) => candidate.scopes.includes(scope)));
+		const account = linked.filter((candidate) => candidate.providerId === provider.signInProvider && provider.scopes.every((scope) => candidate.scopes.includes(scope))).reduce((latest, candidate) => latest && latest.createdAt >= candidate.createdAt ? latest : candidate, void 0);
 		if (account) return {
 			provider,
 			account

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.66.1",
+  "version": "0.66.3",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -42,9 +42,9 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.66.1",
-    "@protobase/query": "0.66.1",
-    "@protobase/schema": "0.66.1",
+    "@protobase/layout": "0.66.3",
+    "@protobase/query": "0.66.3",
+    "@protobase/schema": "0.66.3",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",