@protobase/server 0.66.6 → 0.66.8

package/dist/better-auth/create-auth.js

@@ -13,13 +13,14 @@ import { endReplacedSession } from "./end-replaced-session.js";
 import { authBasePath } from "./auth-base-path.js";
 import { authLogger } from "./auth-logger.js";
 import { cookiePrefixOf } from "./cookie-prefix.js";
-import { mobileRequests } from "./mobile-requests.js";
+import { jsonOnlyOnMobile, mobileRequests } from "./mobile-requests.js";
 import { passwordLength } from "./new-account-password.js";
 import { platformMailer } from "../mail/platform-mailer.js";
 import { readOperatorSettings, resolveOperator } from "./operator-provider.js";
 import { defaultInvitationUrl } from "./invitations/invitation-link-hook.js";
 import { lastAdminGuardPlugin } from "./last-admin-guard.js";
 import { setPasswordPath, setPasswordPlugin } from "./set-password.js";
+import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
 import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
 import { leakedPasswordsPlugin } from "./leaked-passwords.js";
 import { lockedAccountsPlugin, readLockedAccounts } from "./locked-accounts.js";
@@ -35,6 +36,8 @@ import { passkeyHosts, readPasskeyDomain, resolvePasskeyDomain } from "./passkey
 import { coreNames, pluginNames } from "./snake-case-names.js";
 import { passkeyPlugin } from "./passkey-plugin.js";
 import { passwordResetOptions } from "./password-reset.js";
+import { mailPasswordChanged, passwordChangePlugin } from "./password-change.js";
+import { passwordChecksPlugin } from "./password-checks.js";
 import { rolesPlugin } from "./roles/roles-plugin.js";
 import { versionedSecrets } from "./secret-versions.js";
 import { signingKeyRotation, signingKeys } from "./signing-keys.js";
@@ -43,11 +46,12 @@ import { appSignInPolicy } from "./app-sign-in-policy.js";
 import { assertNoEndpointKeyClashes } from "./endpoint-key-clashes.js";
 import { emailInDomains, resolveSamlProviders, samlDisabledPaths, samlGuardPlugin } from "./saml-sign-in.js";
 import { noAccountMailPlugin } from "./no-account-mail.js";
-import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
 import { confirmedOnCreate, confirmedOnUpdate, emailConfirmedField } from "./email-confirmed.js";
 import { rehashPasswordsPlugin, verifyAcceptedHash } from "./password-hashes.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
 import { strongSignInsPlugin } from "./strong-sign-ins.js";
+import { recentConfirmationPlugin } from "./recent-confirmation.js";
+import { confirmationCodePaths, confirmationCodePlugin } from "./confirmation-code-plugin.js";
 import { tokenClaims } from "./token-claims.js";
 import { twoFactorAfterPasswordOrCode } from "./two-factor-challenge.js";
 import { metadataField, userFieldsNamed, userModel, userTable, withUserColumns } from "./user-table.js";
@@ -177,7 +181,11 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			minPasswordLength: passwordLength.min,
 			maxPasswordLength: passwordLength.max,
 			...passwordHashes.length > 0 && { password: { verify: verifyAcceptedHash(passwordHashes) } },
-			...mail && passwordResetOptions(mail, mcp ? { onPasswordReset: async ({ user }) => revokeMcpGrants((await context()).adapter, user.id) } : {})
+			...mail && passwordResetOptions(mail, { onPasswordReset: async ({ user }) => {
+				const auth = await context();
+				if (mcp) await revokeMcpGrants(auth.adapter, user.id);
+				await mailPasswordChanged({ context: auth }, mail, user.email);
+			} })
 		},
 		...options.socialProviders && { socialProviders: options.socialProviders },
 		user: {
@@ -185,7 +193,10 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			...Object.keys(userFields).length > 0 && { additionalFields: userFields },
 			...deleteUser
 		},
-		session: coreNames.session,
+		session: {
+			...coreNames.session,
+			freshAge: 0
+		},
 		verification: coreNames.verification,
 		account: {
 			...coreNames.account,
@@ -213,7 +224,12 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				origins: appOrigins(options.baseURL, origins)
 			}),
 			strongSignInsPlugin(),
-			...mail ? [emailOTP(emailCodeOptions(mail)), noAccountMailPlugin(mail)] : [],
+			recentConfirmationPlugin(),
+			...mail ? [
+				emailOTP(emailCodeOptions(mail)),
+				noAccountMailPlugin(mail),
+				confirmationCodePlugin(mail)
+			] : [],
 			...mail && signUpRole ? [signUpPlugin({
 				role: signUpRole,
 				mail,
@@ -222,7 +238,9 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			...signIn ? [genericOAuth({ config: [platformSignInProvider(signIn)] })] : [],
 			...saml.length > 0 ? [loaded(plugins.samlPlugin, "sso.saml")(saml, options.baseURL), samlGuardPlugin(samlIds)] : [],
 			signInPolicyPlugin(policy),
+			passwordChecksPlugin(),
 			setPasswordPlugin(),
+			passwordChangePlugin(mail),
 			...options.leakedPasswords ? [leakedPasswordsPlugin()] : [],
 			goTrueSessionsPlugin({
 				issuer: goTrueIssuer(options.baseURL),
@@ -335,6 +353,14 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				[signUpPaths.create]: {
 					window: 60,
 					max: options.signInPerMinute ?? 5
+				},
+				[confirmationCodePaths.send]: {
+					window: 60,
+					max: 5
+				},
+				[confirmationCodePaths.verify]: {
+					window: 60,
+					max: 5
 				}
 			}
 		},
@@ -412,9 +438,10 @@ const createAuth = (options, plugins = {}) => {
 	return Object.assign(auth, {
 		/**
 		* Answers a request from the app's iOS or Android build: Better Auth also trusts the Capacitor origin the request
-		* names. Only `createAdmin` with a `mobile` section uses it; `handler` and `api` never trust a Capacitor origin.
+		* names. Only `createAdmin` with a `mobile` section uses it; `handler` and `api` never trust a Capacitor origin. A
+		* Capacitor origin's POST without a JSON body is refused before it is granted, as only a page sends one.
 		*/
-		handleMobile: (request) => auth.handler(mobile.grant(request)),
+		handleMobile: async (request) => jsonOnlyOnMobile(request) ?? auth.handler(mobile.grant(request)),
 		/**
 		* What runs when a user is deleted: `set` a named listener that removes what the app keeps of the user elsewhere,
 		* such as their devices; `run` is for a deletion outside Better Auth's endpoints (`deleteUser`).

package/dist/better-auth/mcp/revoke-grants.js

@@ -28,7 +28,11 @@ const revokeMcpGrants = async (adapter, userId, clientId) => {
 		where
 	});
 };
-const ownPaths = ["/revoke-sessions", "/revoke-other-sessions"];
+const ownPaths = [
+	"/revoke-sessions",
+	"/revoke-other-sessions",
+	"/change-password"
+];
 const adminPaths = [
 	"/admin/revoke-user-sessions",
 	"/admin/ban-user",
@@ -42,14 +46,14 @@ const securesAccount = (data) => {
 };
 /**
 * The user whose MCP grants a finished request ends, or `undefined`: the person who signed out everywhere, signed out
-* their other devices, or changed their password signing out the other devices; the user an admin ended the sessions
+* their other devices, or changed their password; the user an admin ended the sessions
 * of, banned, set the password of, or marked unverified. Nobody when the request failed.
 */
 const grantOwnerToRevoke = (request) => {
 	const { path, context } = request;
 	if (context.returned instanceof Error || path === void 0) return void 0;
 	const body = bodyOf(request);
-	if (ownPaths.includes(path) || path === "/change-password" && body.revokeOtherSessions === true) return context.session?.user.id;
+	if (ownPaths.includes(path)) return context.session?.user.id;
 	if (adminPaths.includes(path) || path === "/admin/update-user" && securesAccount(body.data)) return body.userId === void 0 ? void 0 : String(body.userId);
 };
 /**
@@ -62,7 +66,6 @@ const mcpGrantRevocation = () => ({
 		matcher: (context) => context.path !== void 0 && [
 			...ownPaths,
 			...adminPaths,
-			"/change-password",
 			"/admin/update-user"
 		].includes(context.path),
 		handler: createAuthMiddleware(async (ctx) => {

package/dist/better-auth/mobile-requests.js

@@ -1,5 +1,9 @@
 import { capacitorOrigins } from "../mobile-config.js";
 //#region src/better-auth/mobile-requests.ts
+const capacitorOriginOf = (request) => {
+	const origin = request.headers.get("origin");
+	return origin !== null && capacitorOrigins.includes(origin);
+};
 /**
 * Which requests come from the app's iOS or Android build: `grant` marks a request, and `trusted` gives the Capacitor
 * origin it names as an origin Better Auth trusts, for that very request only. Any other request, or an Origin that is
@@ -14,10 +18,26 @@ const mobileRequests = () => {
 		},
 		trusted: (request) => {
 			if (!request || !granted.has(request)) return [];
-			const origin = request.headers.get("origin");
-			return origin !== null && capacitorOrigins.includes(origin) ? [origin] : [];
+			return capacitorOriginOf(request) ? [request.headers.get("origin")] : [];
 		}
 	};
 };
+const mediaType = (request) => request.headers.get("content-type")?.split(";")[0].trim().toLowerCase();
+/**
+* Refuses a POST from a Capacitor origin whose body is not JSON. A page can send a form, `text/plain` or multipart POST
+* without a preflight, but not a JSON one, and `/api/auth` answers no preflight: so the grant only ever sees requests
+* the app's native HTTP sends. A request from any other origin is left alone, such as an identity provider's form POST.
+*/
+const jsonOnlyOnMobile = (request) => {
+	if (request.method !== "POST" || !capacitorOriginOf(request)) return;
+	if (mediaType(request) === "application/json") return;
+	return new Response(JSON.stringify({
+		message: "A request from the app takes a JSON body only",
+		code: "UNSUPPORTED_MEDIA_TYPE"
+	}), {
+		status: 415,
+		headers: { "content-type": "application/json" }
+	});
+};
 //#endregion
-export { mobileRequests };
+export { jsonOnlyOnMobile, mobileRequests };

package/dist/better-auth/password-change.js

@@ -0,0 +1,68 @@
+import { setPasswordPath } from "./set-password.js";
+import { sendAuthEmail } from "./auth-mail/send-auth-email.js";
+import * as z$1 from "zod";
+import { APIError, createAuthEndpoint, createAuthMiddleware } from "better-auth/api";
+//#region src/better-auth/password-change.ts
+/**
+* Mails `email` that its account's password changed, when the app has mail: in the background, as Better Auth sends
+* its own mail, so the answer does not wait on the mail server.
+*/
+const mailPasswordChanged = async (ctx, mail, email) => {
+	if (!mail) return;
+	await ctx.context.runInBackgroundOrAwait(sendAuthEmail(mail, "passwordChangedEmail", email, {}, ctx.context.baseURL));
+};
+const ownChanges = ["/change-password", setPasswordPath];
+const adminChange = "/admin/set-user-password";
+/** Whose account a finished request gave a new password: the address of the person, or the id of the user an admin set it for. */
+const changedAccount = ({ path, body, context }) => {
+	if (context.returned instanceof Error || path === void 0) return;
+	if (ownChanges.includes(path)) return context.session ? { email: context.session.user.email } : void 0;
+	const userId = typeof body === "object" && body !== null ? body.userId : void 0;
+	if (path === adminChange && userId !== void 0) return { userId: String(userId) };
+};
+/**
+* A password change ends the account's other sessions and tells its owner:
+* - `/change-password` always signs out the other devices, whatever `revokeOtherSessions` says: this device gets a
+*   new session, and the MCP grant revocation disconnects the account's MCP clients.
+* - When the app has mail, the owner is emailed after `/change-password`, a first password (`/account/set-password`)
+*   and an admin's `/admin/set-user-password`; `passwordChanged` mails them for a change outside these endpoints,
+*   such as the GoTrue-compatible `PUT /user`. A password reset mails them from `onPasswordReset`.
+*/
+const passwordChangePlugin = (mail) => ({
+	id: "protobase-password-change",
+	endpoints: { passwordChanged: createAuthEndpoint.serverOnly({
+		method: "POST",
+		body: z$1.object({ email: z$1.string() })
+	}, async (ctx) => {
+		await mailPasswordChanged(ctx, mail, ctx.body.email);
+		return ctx.json({ status: true });
+	}) },
+	hooks: {
+		before: [{
+			matcher: (ctx) => ctx.path === "/change-password",
+			handler: createAuthMiddleware(async (ctx) => {
+				if (typeof ctx.body !== "object" || ctx.body === null) return;
+				return { context: { body: {
+					...ctx.body,
+					revokeOtherSessions: true
+				} } };
+			})
+		}],
+		after: [{
+			matcher: (ctx) => ctx.path !== void 0 && [...ownChanges, adminChange].includes(ctx.path),
+			handler: createAuthMiddleware(async (ctx) => {
+				const changed = changedAccount(ctx);
+				if (!changed || !mail) return;
+				if ("email" in changed) {
+					await mailPasswordChanged(ctx, mail, changed.email);
+					return;
+				}
+				const user = await ctx.context.internalAdapter.findUserById(changed.userId);
+				if (!user) throw new APIError("NOT_FOUND", { message: "The user whose password was set is gone" });
+				await mailPasswordChanged(ctx, mail, user.email);
+			})
+		}]
+	}
+});
+//#endregion
+export { changedAccount, mailPasswordChanged, passwordChangePlugin };

package/dist/better-auth/password-checks.js

@@ -0,0 +1,69 @@
+import { APIError, createAuthMiddleware, getSessionFromCtx } from "better-auth/api";
+const maxTrackedAccounts = 1e4;
+const checkedFields = {
+	"/change-password": "currentPassword",
+	"/verify-password": "password",
+	"/delete-user": "password",
+	"/two-factor/enable": "password",
+	"/two-factor/disable": "password",
+	"/two-factor/get-totp-uri": "password",
+	"/two-factor/generate-backup-codes": "password"
+};
+/**
+* Counts the checks of each account in a fixed window that opens at its first check: `take` answers how many seconds
+* the account waits before its next check, or `undefined` when this one may go ahead and is counted. Bounded: a window
+* that ended is dropped, and at `maxTracked` accounts the oldest window is dropped.
+*/
+const checkCounter = ({ max, windowSeconds, maxTracked = maxTrackedAccounts, now = Date.now }) => {
+	const windows = /* @__PURE__ */ new Map();
+	const windowMs = windowSeconds * 1e3;
+	const prune = (at) => {
+		for (const [key, window] of windows) if (at - window.opened >= windowMs) windows.delete(key);
+		while (windows.size >= maxTracked) windows.delete(windows.keys().next().value);
+	};
+	return { take: (key) => {
+		const at = now();
+		const window = windows.get(key);
+		if (window && at - window.opened < windowMs) {
+			if (window.count >= max) return Math.ceil((window.opened + windowMs - at) / 1e3);
+			window.count += 1;
+			return;
+		}
+		windows.delete(key);
+		prune(at);
+		windows.set(key, {
+			opened: at,
+			count: 1
+		});
+	} };
+};
+/**
+* Limits the current-password checks behind a session to `passwordChecksPerWindow` an account a minute, on top of
+* Better Auth's limit per client address, so a stolen session cannot guess the password from many addresses. Every
+* check counts, a right one too, and is counted before the password is compared, so requests sent at once cannot pass
+* the limit together. A refused check answers `429 TOO_MANY_PASSWORD_CHECKS`, with `X-Retry-After` in seconds. A
+* request without a session is left to the endpoint, which refuses it. The count lives in this process's memory.
+*/
+const passwordChecksPlugin = (counter = checkCounter({
+	max: 5,
+	windowSeconds: 60
+})) => ({
+	id: "protobase-password-checks",
+	hooks: { before: [{
+		matcher: (ctx) => ctx.path !== void 0 && Object.hasOwn(checkedFields, ctx.path),
+		handler: createAuthMiddleware(async (ctx) => {
+			const password = ctx.body?.[checkedFields[ctx.path]];
+			if (typeof password !== "string" || password === "") return;
+			const session = await getSessionFromCtx(ctx);
+			if (!session) return;
+			const wait = counter.take(session.user.id);
+			if (wait === void 0) return;
+			throw new APIError("TOO_MANY_REQUESTS", {
+				code: "TOO_MANY_PASSWORD_CHECKS",
+				message: "Too many password attempts. Try again in a minute."
+			}, { "X-Retry-After": String(wait) });
+		})
+	}] }
+});
+//#endregion
+export { checkCounter, passwordChecksPlugin };

package/dist/better-auth/password-reset.js

@@ -5,7 +5,8 @@ const resetLinkLifetimeSeconds = 3600;
 const resetLinkLifetime = "1 hour";
 /**
 * Better Auth's own password reset, sending the link with `mail`. Resetting ends the user's sessions, so a reset
-* after a leaked password also signs out whoever used it, and `onPasswordReset` disconnects the user's MCP clients.
+* after a leaked password also signs out whoever used it, and `onPasswordReset` disconnects the user's MCP clients
+* and tells them their password changed.
 */
 const passwordResetOptions = (mail, { onPasswordReset } = {}) => ({
 	resetPasswordTokenExpiresIn: resetLinkLifetimeSeconds,

package/dist/better-auth/recent-confirmation.js

@@ -0,0 +1,58 @@
+import { isStaffSession } from "./staff-checks.js";
+import { strongSignInAt } from "./strong-sign-ins.js";
+import { confirmationMinutes } from "@protobase/schema/internal";
+import { APIError, createAuthMiddleware, getSessionFromCtx } from "better-auth/api";
+//#region src/better-auth/recent-confirmation.ts
+/** How long after signing in a session counts as recent without confirming: Better Auth's own default fresh age, a day. */
+const recentSessionSeconds = 86400;
+/** The refusal of an account change the session has to confirm first, which the account page answers by asking in place. */
+const confirmationRequired = {
+	code: "STRONG_SIGN_IN_REQUIRED",
+	message: `Confirm it's you first: this change needs a passkey, a second step or an emailed code in the last ${confirmationMinutes} minutes.`
+};
+const passkeyPaths = ["/passkey/generate-register-options", "/passkey/verify-registration"];
+const guardedPaths = [
+	...passkeyPaths,
+	"/unlink-account",
+	"/delete-user"
+];
+const asksToConfirm = async (context, path, body, { user }) => {
+	if (path === "/delete-user") return !body?.password;
+	if (!passkeyPaths.includes(path)) return true;
+	if (user.twoFactorEnabled) return true;
+	return await context.adapter.count({
+		model: "passkey",
+		where: [{
+			field: "userId",
+			value: user.id
+		}]
+	}) > 0;
+};
+/** Whether the session signed in within a day, or confirmed it's them within `confirmationMinutes`. */
+const isRecentlyConfirmed = async (context, session, now = /* @__PURE__ */ new Date()) => {
+	if (now.getTime() - new Date(session.createdAt).getTime() < 864e5) return true;
+	const at = await strongSignInAt(context.internalAdapter, session.id, now);
+	return at !== void 0 && now.getTime() - at.getTime() <= confirmationMinutes * 6e4;
+};
+/**
+* Replaces Better Auth's fresh-session check, which `createAuth` turns off (`freshAge: 0`), and which could only be met
+* by signing out and in again. A session of any age adds a first passkey, and lists its devices. Adding another passkey
+* to an account with a passkey or a second step, unlinking a sign-in provider and deleting the account without a
+* password ask a session older than a day to confirm it's them in place first (`strongSignInsPlugin` notes it), else
+* `403 STRONG_SIGN_IN_REQUIRED`. Staff sessions are left to the staff plugin, which refuses these changes.
+*/
+const recentConfirmationPlugin = () => ({
+	id: "protobase-recent-confirmation",
+	hooks: { before: [{
+		matcher: (context) => context.path !== void 0 && guardedPaths.includes(context.path),
+		handler: createAuthMiddleware(async (ctx) => {
+			const signedIn = await getSessionFromCtx(ctx);
+			if (!signedIn || isStaffSession(signedIn.session)) return;
+			if (!await asksToConfirm(ctx.context, ctx.path, ctx.body, signedIn)) return;
+			if (await isRecentlyConfirmed(ctx.context, signedIn.session)) return;
+			throw new APIError("FORBIDDEN", confirmationRequired);
+		})
+	}] }
+});
+//#endregion
+export { confirmationRequired, isRecentlyConfirmed, recentConfirmationPlugin, recentSessionSeconds };

package/dist/better-auth/sign-in-mail.js

@@ -1,6 +1,9 @@
 import { sendAuthEmail } from "./auth-mail/send-auth-email.js";
-const codeLifetimeMinutes = 10;
-const codeLifetime = "10 minutes";
+import { emailCodeMinutes } from "@protobase/schema/internal";
+//#region src/better-auth/sign-in-mail.ts
+/** How long an emailed code works: in seconds for the sign-in code, and in the email's words. */
+const codeLifetimeSeconds = emailCodeMinutes * 60;
+const codeLifetime = `${emailCodeMinutes} minutes`;
 /**
 * Better Auth's email OTP plugin for signing in and changing the address: never a sign-up, codes stored hashed, sent
 * with `mail`. A new address gets its own email, with the code that moves the account to it. The plugin's other uses
@@ -8,7 +11,7 @@ const codeLifetime = "10 minutes";
 */
 const emailCodeOptions = (mail) => ({
 	disableSignUp: true,
-	expiresIn: 600,
+	expiresIn: codeLifetimeSeconds,
 	storeOTP: "hashed",
 	changeEmail: { enabled: true },
 	sendVerificationOTP: ({ email, otp, type }, ctx) => sendAuthEmail(mail, type === "change-email" ? "changeEmailCodeEmail" : "signInCodeEmail", email, {
@@ -26,7 +29,7 @@ const unusedEmailCodePaths = [
 ];
 /** The two-factor plugin's emailed code, sent with `mail`; stored hashed. */
 const twoFactorCodeOptions = (mail) => ({
-	period: codeLifetimeMinutes,
+	period: emailCodeMinutes,
 	storeOTP: "hashed",
 	sendOTP: ({ user, otp }, ctx) => sendAuthEmail(mail, "twoFactorCodeEmail", user.email, {
 		code: otp,
@@ -34,4 +37,4 @@ const twoFactorCodeOptions = (mail) => ({
 	}, ctx?.context.baseURL)
 });
 //#endregion
-export { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths };
+export { codeLifetime, codeLifetimeSeconds, emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths };

package/dist/better-auth/sign-up/sign-up-code.js

@@ -1,5 +1,6 @@
+import { codeLifetimeSeconds } from "../sign-in-mail.js";
 import { APIError } from "better-auth/api";
-const signUpCodeLifetime = "10 minutes";
+//#region src/better-auth/sign-up/sign-up-code.ts
 const allowedAttempts = 3;
 const identifierOf = (email) => `sign-up-otp-${email}`;
 /** The SHA-256 of `secret`, base64: what the store keeps of a code or a ticket. */
@@ -26,7 +27,7 @@ const issueSignUpCode = async (context, email) => {
 	await context.internalAdapter.createVerificationValue({
 		identifier,
 		value: `${await hashOf(code)}:0`,
-		expiresAt: new Date(Date.now() + 6e5)
+		expiresAt: new Date(Date.now() + codeLifetimeSeconds * 1e3)
 	});
 	return code;
 };
@@ -50,4 +51,4 @@ const consumeSignUpCode = async (context, email, code) => {
 	throw invalidCode();
 };
 //#endregion
-export { consumeSignUpCode, hashOf, issueSignUpCode, signUpCodeLifetime };
+export { consumeSignUpCode, hashOf, issueSignUpCode };

package/dist/better-auth/sign-up/sign-up-plugin.js

@@ -2,8 +2,9 @@ import { effectiveSignInPolicy } from "../sign-in-policy.js";
 import { readSignInPolicy } from "../policy-store.js";
 import { checkNewAccountPassword } from "../new-account-password.js";
 import { sendAuthEmail } from "../auth-mail/send-auth-email.js";
+import { codeLifetime } from "../sign-in-mail.js";
 import { createSignedUpAccount } from "./sign-up-account.js";
-import { consumeSignUpCode, issueSignUpCode, signUpCodeLifetime } from "./sign-up-code.js";
+import { consumeSignUpCode, issueSignUpCode } from "./sign-up-code.js";
 import { consumeSignUpTicket, issueSignUpTicket } from "./sign-up-ticket.js";
 import * as z$1 from "zod";
 import { APIError, createAuthEndpoint } from "better-auth/api";
@@ -40,7 +41,7 @@ const signUpPlugin = ({ role, mail, defaultPolicy }) => ({
 			if (await adapter.count({ model: "user" }) === 0) throw noAdminYet();
 			const sending = await internalAdapter.findUserByEmail(email) ? sendAuthEmail(mail, "accountExistsEmail", email, {}, ctx.context.baseURL) : sendAuthEmail(mail, "signUpCodeEmail", email, {
 				code: await issueSignUpCode(ctx.context, email),
-				lifetime: signUpCodeLifetime
+				lifetime: codeLifetime
 			}, ctx.context.baseURL);
 			await ctx.context.runInBackgroundOrAwait(sending);
 			return ctx.json({ sent: true });

package/dist/better-auth/staff-checks.js

@@ -55,6 +55,8 @@ const accountChanges = [
 	"/passkey/verify-registration",
 	"/passkey/update-passkey",
 	"/passkey/delete-passkey",
+	"/account/confirmation-code/send",
+	"/account/confirmation-code/verify",
 	"/invitation/accept",
 	"/organization/leave",
 	"/organization/transfer-ownership",

package/dist/better-auth/strong-sign-ins.js

@@ -12,7 +12,7 @@ const twoFactorPaths = [
 */
 const strongSignInPaths = ["/passkey/verify-authentication", ...twoFactorPaths];
 const identifierOf = (sessionId) => `protobase-strong-sign-in-${sessionId}`;
-/** Notes that the session proved a passkey or a second step now; the note ends with the session. */
+/** Notes that the session proved a passkey, a second step or an emailed confirmation code now; the note ends with the session. */
 const saveStrongSignIn = async (internal, session, now = /* @__PURE__ */ new Date()) => {
 	const identifier = identifierOf(session.id);
 	await internal.deleteVerificationByIdentifier(identifier);
@@ -22,7 +22,7 @@ const saveStrongSignIn = async (internal, session, now = /* @__PURE__ */ new Dat
 		expiresAt: session.expiresAt
 	});
 };
-/** When the session last proved a passkey or a second step, if it did and its note has not expired. */
+/** When the session last proved a passkey, a second step or an emailed confirmation code, if it did and its note has not expired. */
 const strongSignInAt = async (internal, sessionId, now = /* @__PURE__ */ new Date()) => {
 	const found = await internal.findVerificationValue(identifierOf(sessionId));
 	if (!found || new Date(found.expiresAt) <= now) return void 0;

package/dist/built-in-resources.d.ts

@@ -0,0 +1,89 @@
+import { EventsOptions } from "./changes/events-options.js";
+import { ResourceModel } from "@protobase/schema";
+//#region src/built-in-resources.d.ts
+export type BuiltInInput = {
+  models: ResourceModel[];
+  /** Whether the app declares jobs of its own. */
+  jobs: boolean;
+  /** Whether the app sends notifications. */
+  notifications: boolean;
+  events?: EventsOptions;
+};
+/**
+ * The resources and views the API adds beside the app's own, by what the app uses: Failed jobs once anything runs
+ * jobs (events, history, comments, AI fields, notifications or the app's jobs), Activity with history and Comments
+ * with comments.
+ */
+export declare const builtInResources: ({ models, jobs, notifications, events }: BuiltInInput) => {
+  resources: (import("@protobase/schema").ResourceBuilder<{
+    readonly id: import("@protobase/schema").Field<string>;
+    readonly name: import("@protobase/schema").Field<string>;
+    readonly error: import("@protobase/schema").Field<string | null>;
+    readonly attempts: import("@protobase/schema").Field<number>;
+    readonly failed_at: import("@protobase/schema").Field<string>;
+    readonly created_at: import("@protobase/schema").Field<string>;
+    readonly key: import("@protobase/schema").Field<string | null>;
+    readonly payload: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly output: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly retry: import("@protobase/schema").Field<boolean>;
+  }, import("@protobase/schema").Ref<"id", string>> | import("@protobase/schema").ResourceBuilder<{
+    readonly id: import("@protobase/schema").Field<string>;
+    readonly resource: import("@protobase/schema").Field<string>;
+    readonly record_key: import("@protobase/schema").Field<string>;
+    readonly tenant_id: import("@protobase/schema").Field<string | null>;
+    readonly operation: import("@protobase/schema").Field<"create" | "update" | "delete" | "undelete">;
+    readonly before: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly after: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly changed: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly actor_id: import("@protobase/schema").Field<string | null>;
+    readonly actor_roles: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly database_role: import("@protobase/schema").Field<string | null>;
+    readonly transaction: import("@protobase/schema").Field<string>;
+    readonly at: import("@protobase/schema").Field<string>;
+  }, import("@protobase/schema").Ref<"id", string>> | import("@protobase/schema").ResourceBuilder<{
+    readonly id: import("@protobase/schema").Field<string>;
+    readonly resource: import("@protobase/schema").Field<string>;
+    readonly record_key: import("@protobase/schema").Field<string>;
+    readonly tenant_id: import("@protobase/schema").Field<string | null>;
+    readonly author_id: import("@protobase/schema").Field<string>;
+    readonly body: import("@protobase/schema").Field<string>;
+    readonly mentions: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly created_at: import("@protobase/schema").Field<string>;
+  }, import("@protobase/schema").Ref<"id", string>>)[];
+  views: (import("@protobase/schema").ViewBuilder<import("@protobase/schema").ResourceBuilder<{
+    readonly id: import("@protobase/schema").Field<string>;
+    readonly name: import("@protobase/schema").Field<string>;
+    readonly error: import("@protobase/schema").Field<string | null>;
+    readonly attempts: import("@protobase/schema").Field<number>;
+    readonly failed_at: import("@protobase/schema").Field<string>;
+    readonly created_at: import("@protobase/schema").Field<string>;
+    readonly key: import("@protobase/schema").Field<string | null>;
+    readonly payload: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly output: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly retry: import("@protobase/schema").Field<boolean>;
+  }, import("@protobase/schema").Ref<"id", string>>> | import("@protobase/schema").ViewBuilder<import("@protobase/schema").ResourceBuilder<{
+    readonly id: import("@protobase/schema").Field<string>;
+    readonly resource: import("@protobase/schema").Field<string>;
+    readonly record_key: import("@protobase/schema").Field<string>;
+    readonly tenant_id: import("@protobase/schema").Field<string | null>;
+    readonly operation: import("@protobase/schema").Field<"create" | "update" | "delete" | "undelete">;
+    readonly before: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly after: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly changed: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly actor_id: import("@protobase/schema").Field<string | null>;
+    readonly actor_roles: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly database_role: import("@protobase/schema").Field<string | null>;
+    readonly transaction: import("@protobase/schema").Field<string>;
+    readonly at: import("@protobase/schema").Field<string>;
+  }, import("@protobase/schema").Ref<"id", string>>> | import("@protobase/schema").ViewBuilder<import("@protobase/schema").ResourceBuilder<{
+    readonly id: import("@protobase/schema").Field<string>;
+    readonly resource: import("@protobase/schema").Field<string>;
+    readonly record_key: import("@protobase/schema").Field<string>;
+    readonly tenant_id: import("@protobase/schema").Field<string | null>;
+    readonly author_id: import("@protobase/schema").Field<string>;
+    readonly body: import("@protobase/schema").Field<string>;
+    readonly mentions: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly created_at: import("@protobase/schema").Field<string>;
+  }, import("@protobase/schema").Ref<"id", string>>>)[];
+};
+//#endregion

package/dist/built-in-resources.js

@@ -0,0 +1,31 @@
+import { hasAiFields } from "./ai/ai-fields.js";
+import { isCaptured } from "./changes/capture-sql.js";
+import { changesSchema } from "./changes/events-options.js";
+import { commentsResource, commentsView } from "./comments/record-comments.js";
+import { activityResource, activityView } from "./history/activity.js";
+import { failedJobs, failedJobsView } from "./jobs/failed-jobs.js";
+//#region src/built-in-resources.ts
+/**
+* The resources and views the API adds beside the app's own, by what the app uses: Failed jobs once anything runs
+* jobs (events, history, comments, AI fields, notifications or the app's jobs), Activity with history and Comments
+* with comments.
+*/
+const builtInResources = ({ models, jobs, notifications, events }) => {
+	const withComments = models.some((model) => model.comments);
+	const withJobs = jobs || models.some(isCaptured) || withComments || hasAiFields(models) || notifications;
+	const withHistory = models.some((model) => model.history);
+	return {
+		resources: [
+			...withJobs ? [failedJobs] : [],
+			...withHistory ? [activityResource(changesSchema(events), { tenant: models.some((model) => model.history && model.tenant) })] : [],
+			...withComments ? [commentsResource({ tenant: models.some((model) => model.comments && model.tenant) })] : []
+		],
+		views: [
+			...withJobs ? [failedJobsView] : [],
+			...withHistory ? [activityView] : [],
+			...withComments ? [commentsView] : []
+		]
+	};
+};
+//#endregion
+export { builtInResources };