@protobase/server 0.66.9 → 0.66.10

package/dist/better-auth/auth-settings.d.ts

@@ -2579,6 +2579,41 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-password-confirmation";
+    endpoints: {
+      confirmPassword: import("better-call").StrictEndpoint<"/account/confirm-password", {
+        method: "POST";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        body: import("zod").ZodObject<{
+          password: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        status: boolean;
+      }>;
+    };
   } | {
     id: "email-otp";
     version: string;
@@ -8893,6 +8928,10 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
         window: number;
         max: number;
       };
+      "/account/confirm-password": {
+        window: number;
+        max: number;
+      };
     };
   };
   advanced: {

package/dist/better-auth/confirmation-code-plugin.js

@@ -1,6 +1,7 @@
 import { sendAuthEmail } from "./auth-mail/send-auth-email.js";
 import { codeLifetime } from "./sign-in-mail.js";
 import { saveStrongSignIn } from "./strong-sign-ins.js";
+import { hasPasskeyOrSecondStep } from "./strong-factors.js";
 import { checkConfirmationCode, dropConfirmationCode, newConfirmationCode, saveConfirmationCode } from "./confirmation-codes.js";
 import * as z$1 from "zod";
 import { APIError, createAuthEndpoint, sessionMiddleware } from "better-auth/api";
@@ -31,13 +32,7 @@ const refusals = {
 		message: "The code has expired. Ask for a new one."
 	}
 };
-const isOffered = async (context, { user }) => !user.twoFactorEnabled && await context.adapter.count({
-	model: "passkey",
-	where: [{
-		field: "userId",
-		value: user.id
-	}]
-}) === 0;
+const isOffered = async (context, { user }) => !await hasPasskeyOrSecondStep(context.adapter, user);
 /**
 * An emailed code that confirms it's them inside a session someone is signed in with, for an account without a passkey
 * or a second step, which has nothing stronger to confirm with: a right code notes a strong sign-in for that session

package/dist/better-auth/create-auth.d.ts

@@ -1666,7 +1666,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image? /** Public origin of the API, for example `https://admin.example.com`. Issuer and audience of the tokens; new passkeys are made for its host unless `passkeyDomain` names another. */ : string | null | undefined;
             };
           };
         }>>[];
@@ -2411,7 +2411,9 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /** The RP ID of new passkeys, from `resolvePasskeyDomain`; default the host of `baseURL`. */
+              /** The RP ID of new passkeys, from `resolvePasskeyDomain`; default the host of `baseURL`. */ : string | null | undefined;
             };
           };
         }>>[];
@@ -2712,6 +2714,41 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-password-confirmation";
+    endpoints: {
+      confirmPassword: import("better-call").StrictEndpoint<"/account/confirm-password", {
+        method: "POST";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        body: import("zod").ZodObject<{
+          password: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        status: boolean;
+      }>;
+    };
   } | {
     id: "email-otp";
     version: string;
@@ -9028,6 +9065,10 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         window: number;
         max: number;
       };
+      "/account/confirm-password": {
+        window: number;
+        max: number;
+      };
     };
   };
   advanced: {

package/dist/better-auth/create-auth.js

@@ -50,6 +50,7 @@ import { confirmedOnCreate, confirmedOnUpdate, emailConfirmedField } from "./ema
 import { rehashPasswordsPlugin, verifyAcceptedHash } from "./password-hashes.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
 import { strongSignInsPlugin } from "./strong-sign-ins.js";
+import { passwordConfirmationPath, passwordConfirmationPlugin } from "./password-confirmation.js";
 import { recentConfirmationPlugin } from "./recent-confirmation.js";
 import { confirmationCodePaths, confirmationCodePlugin } from "./confirmation-code-plugin.js";
 import { tokenClaims } from "./token-claims.js";
@@ -225,6 +226,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			}),
 			strongSignInsPlugin(),
 			recentConfirmationPlugin(),
+			passwordConfirmationPlugin(),
 			...mail ? [
 				emailOTP(emailCodeOptions(mail)),
 				noAccountMailPlugin(mail),
@@ -361,6 +363,10 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				[confirmationCodePaths.verify]: {
 					window: 60,
 					max: 5
+				},
+				[passwordConfirmationPath]: {
+					window: 60,
+					max: 5
 				}
 			}
 		},

package/dist/better-auth/password-checks.js

@@ -7,7 +7,8 @@ const checkedFields = {
 	"/two-factor/enable": "password",
 	"/two-factor/disable": "password",
 	"/two-factor/get-totp-uri": "password",
-	"/two-factor/generate-backup-codes": "password"
+	"/two-factor/generate-backup-codes": "password",
+	"/account/confirm-password": "password"
 };
 /**
 * Counts the checks of each account in a fixed window that opens at its first check: `take` answers how many seconds

package/dist/better-auth/password-confirmation.js

@@ -0,0 +1,63 @@
+import { hasPasskeyOrSecondStep } from "./strong-factors.js";
+import { confirmationMinutes } from "@protobase/schema/internal";
+import * as z$1 from "zod";
+import { APIError, createAuthEndpoint, sessionMiddleware } from "better-auth/api";
+//#region src/better-auth/password-confirmation.ts
+/** The endpoint that confirms it's them with the account's password, as Better Auth's `ctx.path` names it. */
+const passwordConfirmationPath = "/account/confirm-password";
+const identifierOf = (sessionId) => `protobase-password-confirmation-${sessionId}`;
+/** Notes that the session re-entered the account's password now; the note lasts `confirmationMinutes`. */
+const savePasswordConfirmation = async (internal, sessionId, now = /* @__PURE__ */ new Date()) => {
+	const identifier = identifierOf(sessionId);
+	await internal.deleteVerificationByIdentifier(identifier);
+	await internal.createVerificationValue({
+		identifier,
+		value: now.toISOString(),
+		expiresAt: new Date(now.getTime() + confirmationMinutes * 6e4)
+	});
+};
+/** Whether the session re-entered the account's password within `confirmationMinutes`. */
+const isPasswordConfirmed = async (internal, sessionId, now = /* @__PURE__ */ new Date()) => {
+	const found = await internal.findVerificationValue(identifierOf(sessionId));
+	return Boolean(found) && new Date(found.expiresAt) > now;
+};
+const notOffered = {
+	code: "PASSWORD_CONFIRMATION_NOT_OFFERED",
+	message: "Confirm it's you with your passkey or your second step instead."
+};
+const noPassword = {
+	code: "PASSWORD_CONFIRMATION_NOT_OFFERED",
+	message: "This account has no password: confirm it's you with an emailed code instead."
+};
+const wrongPassword = {
+	code: "INVALID_PASSWORD",
+	message: "The password is not right."
+};
+/**
+* `POST /account/confirm-password` with `{ password }`: an account with a password and neither a passkey nor a second
+* step confirms it's them with it, for adding its first passkey (`recentConfirmationPlugin`). Unlike an emailed code,
+* it is no strong sign-in: a reveal still asks for one. Each try counts toward the password checks of the account
+* (`passwordChecksPlugin`); staff sessions are refused by the staff plugin.
+*/
+const passwordConfirmationPlugin = () => ({
+	id: "protobase-password-confirmation",
+	endpoints: { confirmPassword: createAuthEndpoint(passwordConfirmationPath, {
+		method: "POST",
+		use: [sessionMiddleware],
+		body: z$1.object({ password: z$1.string() })
+	}, async (ctx) => {
+		const signed = ctx.context.session;
+		if (await hasPasskeyOrSecondStep(ctx.context.adapter, signed.user)) throw new APIError("FORBIDDEN", notOffered);
+		const hash = (await ctx.context.internalAdapter.findCredentialAccount(signed.user.id))?.password;
+		if (!hash) throw new APIError("FORBIDDEN", noPassword);
+		if (ctx.body.password.length > ctx.context.password.config.maxPasswordLength) throw new APIError("BAD_REQUEST", wrongPassword);
+		if (!await ctx.context.password.verify({
+			hash,
+			password: ctx.body.password
+		})) throw new APIError("BAD_REQUEST", wrongPassword);
+		await savePasswordConfirmation(ctx.context.internalAdapter, signed.session.id);
+		return ctx.json({ status: true });
+	}) }
+});
+//#endregion
+export { isPasswordConfirmed, passwordConfirmationPath, passwordConfirmationPlugin, savePasswordConfirmation };

package/dist/better-auth/recent-confirmation.js

@@ -1,5 +1,7 @@
 import { isStaffSession } from "./staff-checks.js";
 import { strongSignInAt } from "./strong-sign-ins.js";
+import { hasPasskeyOrSecondStep } from "./strong-factors.js";
+import { isPasswordConfirmed } from "./password-confirmation.js";
 import { confirmationMinutes } from "@protobase/schema/internal";
 import { APIError, createAuthMiddleware, getSessionFromCtx } from "better-auth/api";
 //#region src/better-auth/recent-confirmation.ts
@@ -11,22 +13,19 @@ const confirmationRequired = {
 	message: `Confirm it's you first: this change needs a passkey, a second step or an emailed code in the last ${confirmationMinutes} minutes.`
 };
 const passkeyPaths = ["/passkey/generate-register-options", "/passkey/verify-registration"];
+const twoFactorPath = "/two-factor/enable";
 const guardedPaths = [
 	...passkeyPaths,
+	twoFactorPath,
 	"/unlink-account",
 	"/delete-user"
 ];
-const asksToConfirm = async (context, path, body, { user }) => {
-	if (path === "/delete-user") return !body?.password;
-	if (!passkeyPaths.includes(path)) return true;
-	if (user.twoFactorEnabled) return true;
-	return await context.adapter.count({
-		model: "passkey",
-		where: [{
-			field: "userId",
-			value: user.id
-		}]
-	}) > 0;
+const confirmationAsked = async (context, path, body, { user }) => {
+	if (path === "/delete-user") return body?.password ? "nothing" : "confirm";
+	if (path === "/unlink-account") return "confirm";
+	const first = !await hasPasskeyOrSecondStep(context.adapter, user);
+	if (path === twoFactorPath) return first && !(await context.internalAdapter.findCredentialAccount(user.id))?.password ? "confirm" : "nothing";
+	return first ? "confirm-or-password" : "confirm";
 };
 /** Whether the session signed in within a day, or confirmed it's them within `confirmationMinutes`. */
 const isRecentlyConfirmed = async (context, session, now = /* @__PURE__ */ new Date()) => {
@@ -36,10 +35,12 @@ const isRecentlyConfirmed = async (context, session, now = /* @__PURE__ */ new D
 };
 /**
 * Replaces Better Auth's fresh-session check, which `createAuth` turns off (`freshAge: 0`), and which could only be met
-* by signing out and in again. A session of any age adds a first passkey, and lists its devices. Adding another passkey
-* to an account with a passkey or a second step, unlinking a sign-in provider and deleting the account without a
-* password ask a session older than a day to confirm it's them in place first (`strongSignInsPlugin` notes it), else
-* `403 STRONG_SIGN_IN_REQUIRED`. Staff sessions are left to the staff plugin, which refuses these changes.
+* by signing out and in again. A session of any age lists its devices. Adding a passkey, turning on a second step
+* without a password, unlinking a sign-in provider and deleting the account without a password ask a session older
+* than a day to confirm it's them in place first (`strongSignInsPlugin` notes it), else `403 STRONG_SIGN_IN_REQUIRED`.
+* An account with neither a passkey nor a second step confirms its first passkey with its password too, which counts
+* for that change only, never as a strong sign-in. Staff sessions are left to the staff plugin, which refuses these
+* changes.
 */
 const recentConfirmationPlugin = () => ({
 	id: "protobase-recent-confirmation",
@@ -48,8 +49,10 @@ const recentConfirmationPlugin = () => ({
 		handler: createAuthMiddleware(async (ctx) => {
 			const signedIn = await getSessionFromCtx(ctx);
 			if (!signedIn || isStaffSession(signedIn.session)) return;
-			if (!await asksToConfirm(ctx.context, ctx.path, ctx.body, signedIn)) return;
+			const asked = await confirmationAsked(ctx.context, ctx.path, ctx.body, signedIn);
+			if (asked === "nothing") return;
 			if (await isRecentlyConfirmed(ctx.context, signedIn.session)) return;
+			if (asked === "confirm-or-password" && await isPasswordConfirmed(ctx.context.internalAdapter, signedIn.session.id)) return;
 			throw new APIError("FORBIDDEN", confirmationRequired);
 		})
 	}] }

package/dist/better-auth/staff-checks.js

@@ -57,6 +57,7 @@ const accountChanges = [
 	"/passkey/delete-passkey",
 	"/account/confirmation-code/send",
 	"/account/confirmation-code/verify",
+	"/account/confirm-password",
 	"/invitation/accept",
 	"/organization/leave",
 	"/organization/transfer-ownership",

package/dist/better-auth/strong-factors.js

@@ -0,0 +1,14 @@
+//#region src/better-auth/strong-factors.ts
+/**
+* Whether the account has a passkey or a second step, which confirm it's them; one with neither confirms a first one
+* with its password or an emailed code instead.
+*/
+const hasPasskeyOrSecondStep = async (adapter, user) => Boolean(user.twoFactorEnabled) || await adapter.count({
+	model: "passkey",
+	where: [{
+		field: "userId",
+		value: user.id
+	}]
+}) > 0;
+//#endregion
+export { hasPasskeyOrSecondStep };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.66.9";
+var version = "0.66.10";
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.66.9",
+  "version": "0.66.10",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,9 +43,9 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.66.9",
-    "@protobase/query": "0.66.9",
-    "@protobase/schema": "0.66.9",
+    "@protobase/layout": "0.66.10",
+    "@protobase/query": "0.66.10",
+    "@protobase/schema": "0.66.10",
     "@react-email/render": "^2.1.0",
     "@react-pdf/primitives": "^4.4.0",
     "@react-pdf/renderer": "^4.9.0",