@protobase/server 0.67.4 → 0.67.5

package/dist/better-auth/create-auth.d.ts

@@ -590,7 +590,17 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
               userId: string;
               expiresAt: Date;
               token: string;
-              ipAddress?: string | null | undefined;
+              ipAddress?
+              /**
+               * What the sign-in page leads with: `password`, the email address and a password, with emailing a code below it; or
+               * `emailCode`, the address and "Email me a sign-in code", with the password behind "Use a password", for apps whose
+               * people mostly never set one. Only while the policy leaves both on; default `password`.
+               */
+              /**
+               * What the sign-in page leads with: `password`, the email address and a password, with emailing a code below it; or
+               * `emailCode`, the address and "Email me a sign-in code", with the password behind "Use a password", for apps whose
+               * people mostly never set one. Only while the policy leaves both on; default `password`.
+               */ : string | null | undefined;
               userAgent?: string | null | undefined;
             };
           };
@@ -1666,7 +1676,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
               email: string;
               emailVerified: boolean;
               name: string;
-              image? /** Public origin of the API, for example `https://admin.example.com`. Issuer and audience of the tokens; new passkeys are made for its host unless `passkeyDomain` names another. */ : string | null | undefined;
+              image?: string | null | undefined;
             };
           };
         }>>[];
@@ -2411,9 +2421,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
               email: string;
               emailVerified: boolean;
               name: string;
-              image?
-              /** The RP ID of new passkeys, from `resolvePasskeyDomain`; default the host of `baseURL`. */
-              /** The RP ID of new passkeys, from `resolvePasskeyDomain`; default the host of `baseURL`. */ : string | null | undefined;
+              image?: string | null | undefined;
             };
           };
         }>>[];

package/dist/better-auth/create-auth.js

@@ -17,7 +17,7 @@ import { jsonOnlyOnMobile, mobileRequests } from "./mobile-requests.js";
 import { passwordLength } from "./new-account-password.js";
 import { platformMailer } from "../mail/platform-mailer.js";
 import { readOperatorSettings, resolveOperator } from "./operator-provider.js";
-import { defaultInvitationUrl } from "./invitations/invitation-link-hook.js";
+import "./invitations/invitation-link-hook.js";
 import { lastAdminGuardPlugin } from "./last-admin-guard.js";
 import { setPasswordPath, setPasswordPlugin } from "./set-password.js";
 import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
@@ -271,7 +271,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				definitions,
 				defaultPolicy: signInPolicy,
 				...mail && { mail },
-				invitationUrl: organizations?.invitationUrl ?? defaultInvitationUrl(options.baseURL),
+				...organizations?.invitationUrl !== void 0 && { invitationUrl: organizations.invitationUrl },
 				invitationSeconds: organizations?.invitationExpiresIn ?? 604800,
 				...organizations && { organizations }
 			}),
@@ -410,7 +410,7 @@ const createAuth = (options, plugins = {}) => {
 	const personalMail = resolvePersonalMail(options.personalMail ?? [], socialProviders, options.encryptOAuthTokens === true);
 	const origins = resolveOrigins(options.baseURL, options.origins ?? platformOrigins());
 	const passkeyDomain = resolvePasskeyDomain(options.passkeyDomain ?? platformPasskeyDomain(), [options.baseURL, ...origins]);
-	const organizations = options.organizations && resolveOrganizations(options.organizations, definitions, options.baseURL);
+	const organizations = options.organizations && resolveOrganizations(options.organizations, definitions);
 	const mcp = options.mcp && resolveMcp(options.baseURL, options.mcp);
 	let instance;
 	const context = () => instance?.$context ?? Promise.reject(/* @__PURE__ */ new Error("The auth instance is not made yet"));

package/dist/better-auth/invitations/invitation-link-hook.js

@@ -1,3 +1,4 @@
+import { requestAppUrl } from "../../request-app-url.js";
 import { invitationLink, invitationToken } from "./invitation-token.js";
 import { createAuthMiddleware } from "better-auth/api";
 //#region src/better-auth/invitations/invitation-link-hook.ts
@@ -9,7 +10,7 @@ import { createAuthMiddleware } from "better-auth/api";
 const invitationLinkHook = (paths, invitationUrl) => ({
 	matcher: (context) => paths.includes(context.path ?? ""),
 	handler: createAuthMiddleware(async (ctx) => {
-		const answer = await withInvitationLink(ctx.context.returned, ctx.context.secret, invitationUrl);
+		const answer = await withInvitationLink(ctx.context.returned, ctx.context.secret, invitationPage(invitationUrl, ctx.context.baseURL));
 		if (answer) ctx.context.returned = answer;
 	})
 });
@@ -26,9 +27,13 @@ const withInvitationLink = async (returned, secret, invitationUrl) => {
 		link: invitationLink(invitationUrl, token)
 	};
 };
-/** The page an invitation link opens, with `?token=`, unless the app names another. */
-const defaultInvitationUrl = (baseURL) => `${baseURL.replace(/\/$/, "")}/-/invitation`;
+/**
+* The page an invitation link opens, with `?token=`: the app's own `invitationUrl`, or `/-/invitation` on the origin
+* the request came to, from Better Auth's `ctx.context.baseURL` (`requestAppUrl`), so a link made on one of the app's
+* origins opens there.
+*/
+const invitationPage = (invitationUrl, requestURL) => invitationUrl ?? requestAppUrl(requestURL, "/-/invitation");
 /** How long an invitation works unless the app says otherwise: 7 days, in seconds. */
 const defaultInvitationSeconds = 604800;
 //#endregion
-export { defaultInvitationSeconds, defaultInvitationUrl, invitationLinkHook, withInvitationLink };
+export { defaultInvitationSeconds, invitationLinkHook, invitationPage, withInvitationLink };

package/dist/better-auth/organizations/options.d.ts

@@ -22,7 +22,7 @@ export type OrganizationsOptions = {
    * rows in any `.tenant` resource; `'cascade'` leaves it to the project's foreign keys.
    */
   deleteRecords?: 'refuse' | 'cascade';
-  /** The page an invitation link opens, with `?token=`. Default `{baseURL}/-/invitation`. */
+  /** The page an invitation link opens, with `?token=`. Default `/-/invitation` on the origin the request came to. */
   invitationUrl?: string;
   /** Runs after an organization is created, with its owner's membership, for example to add the app's own row for it. */
   onCreated?: (input: {
@@ -42,7 +42,7 @@ export type ResolvedOrganizations = {
   membershipLimit: number;
   generateId: () => string | Promise<string>;
   deleteRecords: 'refuse' | 'cascade';
-  invitationUrl: string;
+  invitationUrl?: string;
   options: OrganizationsOptions;
 };
 //#endregion

package/dist/better-auth/organizations/options.js

@@ -1,7 +1,6 @@
 import { membershipRoles } from "./role-definitions.js";
-import { defaultInvitationUrl } from "../invitations/invitation-link-hook.js";
 //#region src/better-auth/organizations/options.ts
-const resolveOrganizations = (options, definitions, baseURL) => {
+const resolveOrganizations = (options, definitions) => {
 	const holdable = membershipRoles(definitions);
 	const creatorAppRoles = options.creatorAppRoles === void 0 || options.creatorAppRoles === "all" ? holdable : options.creatorAppRoles;
 	const unknown = creatorAppRoles.find((name) => !holdable.includes(name));
@@ -16,7 +15,7 @@ const resolveOrganizations = (options, definitions, baseURL) => {
 		membershipLimit: options.membershipLimit ?? 1e3,
 		generateId: options.generateId ?? (() => crypto.randomUUID()),
 		deleteRecords: options.deleteRecords ?? "refuse",
-		invitationUrl: options.invitationUrl ?? defaultInvitationUrl(baseURL),
+		...options.invitationUrl !== void 0 && { invitationUrl: options.invitationUrl },
 		options
 	};
 };

package/dist/better-auth/organizations/organization-plugin.js

@@ -2,8 +2,10 @@ import "./role-definitions.js";
 import { checkAppRoleChange, effectiveRoles, globalRoles, parseAppRoles } from "./app-roles.js";
 import { findMember } from "./store.js";
 import { invitationLink, invitationToken } from "../invitations/invitation-token.js";
+import { invitationPage } from "../invitations/invitation-link-hook.js";
 import { sendAuthEmail } from "../auth-mail/send-auth-email.js";
 import { APIError } from "better-auth/api";
+import { getCurrentAuthEndpointContext } from "@better-auth/core/context";
 import { organization } from "better-auth/plugins/organization";
 //#region src/better-auth/organizations/organization-plugin.ts
 /** The snake_case names of the organization plugin's tables and columns, with the app roles of members and invitations. */
@@ -112,8 +114,8 @@ const organizationPlugin = ({ resolved, secret, mail, context }) => {
 		cancelPendingInvitationsOnReInvite: true,
 		schema: organizationNames,
 		...mail && { sendInvitationEmail: async ({ invitation, organization, inviter }) => {
-			const token = await invitationToken(secret, invitation);
-			const url = invitationLink(resolved.invitationUrl, token);
+			const page = invitationPage(resolved.invitationUrl, getCurrentAuthEndpointContext().context.baseURL);
+			const url = invitationLink(page, await invitationToken(secret, invitation));
 			await sendAuthEmail(mail, "invitationEmail", invitation.email, {
 				inviter: inviter.user.name || inviter.user.email,
 				organization: organization.name,

package/dist/better-auth/users/user-endpoints.js

@@ -1,5 +1,6 @@
 import { adminOnly } from "../admin-only.js";
 import { invitationLink, invitationToken } from "../invitations/invitation-token.js";
+import { invitationPage } from "../invitations/invitation-link-hook.js";
 import { sendAuthEmail } from "../auth-mail/send-auth-email.js";
 import { createAppInvitation, deleteAppInvitation, listAppInvitations } from "./app-invitation-store.js";
 import { roleLabels } from "../roles/role-labels.js";
@@ -46,7 +47,7 @@ const userEndpoints = ({ definitions, mail, invitationUrl, invitationSeconds })
 			inviterId: inviter.id
 		}, invitationSeconds);
 		if (mail) {
-			const url = invitationLink(invitationUrl, await invitationToken(ctx.context.secret, invitation));
+			const url = invitationLink(invitationPage(invitationUrl, ctx.context.baseURL), await invitationToken(ctx.context.secret, invitation));
 			await sendAuthEmail(mail, "invitationEmail", invitation.email, {
 				inviter: inviter.name || inviter.email,
 				url,

package/dist/mail/mailing-app.js

@@ -1,3 +1,4 @@
+import { requestAppUrl } from "../request-app-url.js";
 //#region src/mail/mailing-app.ts
 /**
 * The app as an auth email names it: `appName`, and the home page on the origin of `requestURL`, a URL on the origin
@@ -5,7 +6,7 @@
 */
 const mailingApp = ({ appName, baseURL }, requestURL) => ({
 	name: appName,
-	url: new URL("/", requestURL ?? baseURL).href
+	url: requestAppUrl(requestURL ?? baseURL, "/")
 });
 //#endregion
 export { mailingApp };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.67.4";
+var version = "0.67.5";
 //#endregion
 export { version };

package/dist/request-app-url.js

@@ -0,0 +1,9 @@
+//#region src/request-app-url.ts
+/**
+* The app's page at `path`, which starts with `/`, on the origin of `requestURL`: a URL Better Auth resolved for the
+* request (`ctx.context.baseURL`), on the request's host when that is one of the app's origins and on `baseURL`'s
+* otherwise. Only its origin counts, so Better Auth's base path, such as `/api/auth`, never reaches the page.
+*/
+const requestAppUrl = (requestURL, path) => new URL(path, requestURL).href;
+//#endregion
+export { requestAppUrl };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.67.4",
+  "version": "0.67.5",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -37,15 +37,16 @@
   },
   "dependencies": {
     "@better-auth/cimd": "^1.7.12",
+    "@better-auth/core": "^1.7.12",
     "@better-auth/mcp": "^1.7.12",
     "@better-auth/oauth-provider": "^1.7.12",
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.67.4",
-    "@protobase/query": "0.67.4",
-    "@protobase/schema": "0.67.4",
+    "@protobase/layout": "0.67.5",
+    "@protobase/query": "0.67.5",
+    "@protobase/schema": "0.67.5",
     "@react-email/render": "^2.1.0",
     "@react-pdf/primitives": "^4.4.0",
     "@react-pdf/renderer": "^4.9.0",