@protobase/server 0.69.0 → 0.69.2

package/dist/better-auth/auth-settings.d.ts

@@ -1,5 +1,6 @@
 import { UserColumn } from "./user-table.js";
 import { Mailer } from "../mail/mail-message.js";
+import { Session } from "../types.js";
 import { SignInPolicy } from "./sign-in-policy.js";
 import { StaffSignIn } from "./staff-log.js";
 import { Person } from "./organizations/people-endpoint.js";
@@ -3327,6 +3328,10 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
             scopes: string[];
             created_at: Date;
             needs_sign_in: boolean;
+            used_by: {
+              id: string;
+              name: string;
+            }[];
           }[];
         }[];
       }>;
@@ -9157,6 +9162,23 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
     events: {
       set: (next: ConnectionListener) => undefined;
     };
+    list: (session: Session) => Promise<{
+      key: string;
+      label: string;
+      provider: string;
+      scopes: string[];
+      link_params: Record<string, string>;
+      accounts: {
+        id: string;
+        scopes: string[];
+        created_at: Date;
+        needs_sign_in: boolean;
+        used_by: {
+          id: string;
+          name: string;
+        }[];
+      }[];
+    }[]>;
   };
   mcp: {
     resource: string;

package/dist/better-auth/connections/connection-events.d.ts

@@ -7,5 +7,12 @@ export type ConnectionListener = {
   disconnected: (accountId: string) => Promise<void>;
   /** The accounts among `accountIds` that a trigger waits on to be signed in again. */
   needsSignIn: (accountIds: string[]) => Promise<string[]>;
+  /** The workflows among those `userId` turned on, and may still change, whose enabled version binds one of `accountIds`, by account. */
+  uses: (userId: string, accountIds: string[]) => Promise<AccountUses>;
 };
+/** The workflows that use each account, by its id. */
+export type AccountUses = Record<string, {
+  id: string;
+  name: string;
+}[]>;
 //#endregion

package/dist/better-auth/connections/connection-events.js

@@ -9,7 +9,8 @@ const connectionEvents = () => {
 		set: (next) => void (listener = next),
 		linked: async (accountId) => listener?.linked(accountId),
 		disconnected: async (accountId) => listener?.disconnected(accountId),
-		needsSignIn: async (accountIds) => listener && accountIds.length > 0 ? listener.needsSignIn(accountIds) : []
+		needsSignIn: async (accountIds) => listener && accountIds.length > 0 ? listener.needsSignIn(accountIds) : [],
+		uses: async (userId, accountIds) => listener && accountIds.length > 0 ? listener.uses(userId, accountIds) : {}
 	};
 };
 //#endregion

package/dist/better-auth/connections/connections-plugin.js

@@ -1,5 +1,4 @@
-import { storedScopes } from "../../personal-mail/linked-accounts.js";
-import { holdsScopes } from "../../workflows/connections/connection-provider.js";
+import { listConnections } from "./list-connections.js";
 import { revokeToken } from "./revoke-token.js";
 import * as z$1 from "zod";
 import { decryptOAuthToken } from "better-auth/oauth2";
@@ -15,7 +14,8 @@ const notFound = () => new APIError("NOT_FOUND", {
 });
 /**
 * The signed-in person's connections: `GET /connections` lists each connection the app's workflow plugins declare with
-* the person's accounts that fit it, and whether a trigger waits for one to be signed in again, never a token.
+* the person's accounts that fit it, whether a trigger waits for one to be signed in again and the workflows that use
+* it, never a token (see `listConnections`).
 * `POST /connections/disconnect` revokes an account's token at its provider, then deletes it whatever the provider
 * answered, and stops the triggers on it; their own account only, and never the last account they sign in with. Connecting is
 * Better Auth's `/link-social`; a sign-in (not a link) through a provider only connections use is refused.
@@ -29,22 +29,12 @@ const connectionsPlugin = ({ connections, events, allowPrivateAddresses }) => {
 				method: "GET",
 				use: [sessionMiddleware]
 			}, async (ctx) => {
-				const accounts = await ctx.context.internalAdapter.findAccounts(ctx.context.session.user.id);
-				const fitting = (connection) => accounts.filter((account) => account.providerId === connection.providerId && holdsScopes(storedScopes(account.scope), connection.declaration));
-				const waiting = new Set(await events.needsSignIn(connections.flatMap((connection) => fitting(connection).map((account) => account.id))));
-				return ctx.json({ connections: connections.map((connection) => ({
-					key: connection.key,
-					label: connection.declaration.label,
-					provider: connection.providerId,
-					scopes: connection.declaration.scopes ?? [],
-					link_params: connection.declaration.link_params ?? {},
-					accounts: fitting(connection).map((account) => ({
-						id: account.id,
-						scopes: storedScopes(account.scope),
-						created_at: account.createdAt,
-						needs_sign_in: waiting.has(account.id)
-					}))
-				})) });
+				const adapter = ctx.context.internalAdapter;
+				return ctx.json({ connections: await listConnections({
+					findAccounts: (userId) => adapter.findAccounts(userId),
+					connections,
+					events
+				}, ctx.context.session.user.id) });
 			}),
 			disconnectConnection: createAuthEndpoint(connectionPaths.disconnect, {
 				method: "POST",

package/dist/better-auth/connections/list-connections.js

@@ -0,0 +1,34 @@
+import { storedScopes } from "../../personal-mail/linked-accounts.js";
+import { holdsScopes } from "../../workflows/connections/connection-provider.js";
+//#region src/better-auth/connections/list-connections.ts
+/**
+* A person's connections: each connection the app's workflow plugins declare with the person's accounts that fit it,
+* whether a trigger waits for one to be signed in again, and the workflows that use it. Each account's fields are picked
+* one by one, so no token leaves. `user` is the signed-in person's own id, from their session; reading without one fails,
+* since the store would read every person's accounts.
+*/
+const listConnections = async ({ findAccounts, connections, events }, user) => {
+	if (user === "" || user === void 0 || user === null) throw new Error("Connections are listed for a signed-in person's id");
+	const userId = String(user);
+	const accounts = await findAccounts(userId);
+	const fitting = (connection) => accounts.filter((account) => account.providerId === connection.providerId && holdsScopes(storedScopes(account.scope), connection.declaration));
+	const ids = connections.flatMap((connection) => fitting(connection).map((account) => account.id));
+	const waiting = new Set(await events.needsSignIn(ids));
+	const uses = await events.uses(userId, ids);
+	return connections.map((connection) => ({
+		key: connection.key,
+		label: connection.declaration.label,
+		provider: connection.providerId,
+		scopes: connection.declaration.scopes ?? [],
+		link_params: connection.declaration.link_params ?? {},
+		accounts: fitting(connection).map((account) => ({
+			id: account.id,
+			scopes: storedScopes(account.scope),
+			created_at: account.createdAt,
+			needs_sign_in: waiting.has(account.id),
+			used_by: uses[account.id] ?? []
+		}))
+	}));
+};
+//#endregion
+export { listConnections };

package/dist/better-auth/create-auth.d.ts

@@ -1,5 +1,6 @@
 import { UserColumn, UserTableOptions } from "./user-table.js";
 import { Mailer } from "../mail/mail-message.js";
+import { Session } from "../types.js";
 import { SignInPolicy } from "./sign-in-policy.js";
 import { StaffSignIn } from "./staff-log.js";
 import { Person } from "./organizations/people-endpoint.js";
@@ -3215,7 +3216,11 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image? /**
+               * Refuses a new password that appears in a known data breach, by Have I Been Pwned's password list: at sign-up, from
+               * an invitation, and when a password is set, changed, reset or given by an admin. Only the first five characters of
+               * the password's SHA-1 hash leave the server. While the list cannot be reached, setting a password fails. Default off.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -3472,6 +3477,10 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
             scopes: string[];
             created_at: Date;
             needs_sign_in: boolean;
+            used_by: {
+              id: string;
+              name: string;
+            }[];
           }[];
         }[];
       }>;
@@ -9339,12 +9348,32 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
     signInProviders: string[];
     clients: string[];
   };
-  /** The workflow connections people connect accounts through, and the listener (`set`) the workflows give for their links and disconnects. */
+  /**
+   * The workflow connections people connect accounts through, the listener (`set`) the workflows give for their links
+   * and disconnects, and `list`, on the server only, of the session's own person's accounts, as `GET /connections` lists them.
+   */
   connections: {
     declared: ResolvedConnection[];
     events: {
       set: (next: ConnectionListener) => undefined;
     };
+    list: (session: Session) => Promise<{
+      key: string;
+      label: string;
+      provider: string;
+      scopes: string[];
+      link_params: Record<string, string>;
+      accounts: {
+        id: string;
+        scopes: string[];
+        created_at: Date;
+        needs_sign_in: boolean;
+        used_by: {
+          id: string;
+          name: string;
+        }[];
+      }[];
+    }[]>;
   };
   /** The OAuth provider for MCP clients, when on: the endpoint's resource (its URL) and path, and the scope its tokens carry. */
   mcp: {

package/dist/better-auth/create-auth.js

@@ -12,6 +12,7 @@ import { personalMailer } from "../personal-mail/personal-mailer.js";
 import { mailLinkHooks } from "../personal-mail/mail-link-hooks.js";
 import { bothAccountHooks, connectionAccountHooks } from "./connections/connection-account-hooks.js";
 import { connectionEvents } from "./connections/connection-events.js";
+import { listConnections } from "./connections/list-connections.js";
 import { connectionProvidersPlugin } from "./connections/connection-oauth-provider.js";
 import { connectionsPlugin } from "./connections/connections-plugin.js";
 import { resolveConnections } from "./connections/declared-connections.js";
@@ -552,10 +553,18 @@ const createAuth = (options, plugins = {}) => {
 			signInProviders: socialProviders,
 			clients: connectionClients
 		},
-		/** The workflow connections people connect accounts through, and the listener (`set`) the workflows give for their links and disconnects. */
+		/**
+		* The workflow connections people connect accounts through, the listener (`set`) the workflows give for their links
+		* and disconnects, and `list`, on the server only, of the session's own person's accounts, as `GET /connections` lists them.
+		*/
 		connections: {
 			declared: resolvedConnections,
-			events: { set: events.set }
+			events: { set: events.set },
+			list: async (session) => listConnections({
+				findAccounts: async (userId) => (await auth.$context).internalAdapter.findAccounts(userId),
+				connections: resolvedConnections,
+				events
+			}, session.user.id)
 		},
 		/** The OAuth provider for MCP clients, when on: the endpoint's resource (its URL) and path, and the scope its tokens carry. */
 		mcp: mcp && {

package/dist/create-admin.js

@@ -391,6 +391,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 			commented,
 			...engine && { workflows: {
 				...engine.types,
+				listConnections: auth.connections.list,
 				issueWebhook: (session, id, secret) => issueWebhook(engine.issue, session, id, {
 					...secret !== void 0 && { secret },
 					origin: new URL(auth.mcp.resource).origin

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.69.0";
+var version = "0.69.2";
 //#endregion
 export { version };

package/dist/view-access.js

@@ -297,7 +297,8 @@ const actionShape = (model, models, createPages) => shapes.object({
 		link: linkShape(model, models, createPages),
 		ai: aiShape(model)
 	}),
-	inputs: inputsShape(models)
+	inputs: inputsShape(models),
+	mailbox: shapes.data
 }, { requires: [
 	"run",
 	"inputs",

package/dist/workflows/connections/connection-uses.js

@@ -0,0 +1,28 @@
+import { enablerMayUpdate } from "./enabler-authority.js";
+import { sql } from "kysely";
+//#region src/workflows/connections/connection-uses.ts
+/**
+* The workflows that use a person's accounts: those whose enabled version they turned on and binds one of the
+* accounts in its `connections`, kept only while they may still update the workflow, as a step's token needs.
+*/
+const connectionUses = ({ deps, schema, roles }) => async (userId, accountIds) => {
+	const uses = {};
+	if (accountIds.length === 0) return uses;
+	const db = deps().db;
+	const { rows } = await sql`select w.id, w.name, v.tenant_id, c.value as account
+    from ${sql.id(schema, "workflows")} w
+    join ${sql.id(schema, "versions")} v on v.workflow_id = w.id and v.version = w.enabled_version
+    cross join lateral jsonb_each_text(coalesce(v.definition -> 'connections', '{}'::jsonb)) c
+    where v.enabled_by = ${userId} and c.value in (${sql.join(accountIds)})
+    order by w.name, w.id`.execute(db);
+	for (const row of rows) {
+		if (!await enablerMayUpdate(db, deps(), roles, userId, row.tenant_id ?? void 0, row.id)) continue;
+		uses[row.account] = [...uses[row.account] ?? [], {
+			id: row.id,
+			name: row.name
+		}];
+	}
+	return uses;
+};
+//#endregion
+export { connectionUses };

package/dist/workflows/mcp/connection-tools.d.ts

@@ -0,0 +1,15 @@
+import { Session } from "../../types.js";
+import "../../index.js";
+//#region src/workflows/mcp/connection-tools.d.ts
+type Connection = {
+  key: string;
+  label: string;
+  accounts: {
+    id: string;
+    scopes: string[];
+    needs_sign_in: boolean;
+  }[];
+};
+/** The session's own person's connections, each with their accounts that fit it, such as `auth.connections.list`. */
+export type ListConnections = (session: Session) => Promise<Connection[]>;
+//#endregion

package/dist/workflows/mcp/connection-tools.js

@@ -0,0 +1,32 @@
+import { defineTool } from "../../assistant/tools.js";
+//#region src/workflows/mcp/connection-tools.ts
+/**
+* The caller's own accounts, by connection, which a definition's `connections` binds by id. Each field is picked one by
+* one, so nothing more than the list reads leaves, and never a token; it takes no argument, so it lists no one else's.
+*/
+const listConnectionsTool = (list) => defineTool({
+	name: "list_connections",
+	description: "Lists the connections the app's workflow plugins declare with your own connected accounts, as JSON ({ connections }), each with its key, label and accounts, each account with its id, scopes and needs_sign_in. A workflow binds an account in its definition's connections, as { \"<key>\": \"<account id>\" }; an account is connected, or connected again when it needs a sign-in, on the account page.",
+	parameters: {
+		type: "object",
+		properties: {}
+	},
+	annotations: {
+		readOnlyHint: true,
+		openWorldHint: false
+	},
+	run: async (_args, context) => {
+		const connections = list ? await list(context.session) : [];
+		return JSON.stringify({ connections: connections.map(({ key, label, accounts }) => ({
+			key,
+			label,
+			accounts: accounts.map(({ id, scopes, needs_sign_in }) => ({
+				id,
+				scopes,
+				needs_sign_in
+			}))
+		})) });
+	}
+});
+//#endregion
+export { listConnectionsTool };

package/dist/workflows/mcp/workflow-instructions.js

@@ -4,7 +4,7 @@ import { limits } from "@protobase/workflows";
 * profile of the States Language with JSONata, and how the workflow tools find, make, change and test-run them.
 */
 const workflowInstructions = [
-	"Workflows: list_workflow_types names the step types and triggers with their arguments and inputs; list_workflows and get_workflow read workflows; validate_workflow checks a definition without saving it; create_workflow and update_workflow save one; run_workflow starts a run with an input, and get_workflow_run reads it with each step's input, output, logs and error. A run goes on in the background: read it again until its status is succeeded or failed, then fix the step that failed with update_workflow and run it again. A trigger starts runs only once enable_workflow turned the workflow on. A webhook trigger whose sender you give a URL, such as app:webhook, gets its URL and secret from new_webhook_url, shown once; one that registers its own URL with its service as the workflow is turned on needs none, and new_webhook_url refuses it.",
+	"Workflows: list_workflow_types names the step types and triggers with their arguments and inputs; list_workflows and get_workflow read workflows; validate_workflow checks a definition without saving it; create_workflow and update_workflow save one; run_workflow starts a run with an input, and get_workflow_run reads it with each step's input, output, logs and error. A run goes on in the background: read it again until its status is succeeded or failed, then fix the step that failed with update_workflow and run it again. A trigger starts runs only once enable_workflow turned the workflow on. A webhook trigger whose sender you give a URL, such as app:webhook, gets its URL and secret from new_webhook_url, shown once; one that registers its own URL with its service as the workflow is turned on needs none, and new_webhook_url refuses it. A step or trigger that signs in through a connection uses the account the definition's \"connections\" binds, { \"<connection key>\": \"<account id>\" }: list_connections gives your accounts.",
 	"A definition is one JSON document: { \"trigger\": <trigger>, \"stateMachine\": { \"QueryLanguage\": \"JSONata\", \"StartAt\": \"<state>\", \"States\": { \"<state>\": <state>, ... } } }, the States Language with JSONata expressions, in a profile where every value is read by name. It holds no layout. <trigger> is an object with one key: { \"<trigger id>\": <its input> } for a trigger list_workflow_types names, or { \"manual\": {} } for a workflow that runs only when someone starts it.",
 	"States: Task { Resource: <step type>, Arguments, TimeoutSeconds, Retry, Catch }; Pass { Output, Assign }; Choice { Choices: [{ Condition, Next, Output?, Assign? }], Default }; Map { Items, ItemProcessor: { StartAt, States }, MaxConcurrency }; Wait { Seconds | Timestamp }; Succeed { Output }; Fail { Error, Cause }. Every state may have Comment, Output and Assign. Task, Pass, Map and Wait have exactly one of Next (a state name) and End: true. State names are unique across the document, Maps included, and every state must be reachable from StartAt. InputPath, Parameters, ResultPath and the other JSONPath fields, and Parallel, are not part of the profile.",
 	"Expressions: a string that is whole \"{% ... %}\" is a JSONata expression whose value, of any type, the field takes; any other string is literal text. Build text inside one expression with &: \"{% 'Order ' & $order.id %}\". Expressions sit at any depth in Arguments, Output and Assign, and in Items, Condition, Seconds, Timestamp, Error and Cause.",

package/dist/workflows/mcp/workflow-read-tools.d.ts

@@ -1,5 +1,6 @@
 import { AssistantTool, ToolContext } from "../../assistant/tools.js";
 import { IssueWebhook } from "./webhook-tools.js";
+import { ListConnections } from "./connection-tools.js";
 import "../../index.js";
 import { ResourceModel } from "@protobase/schema";
 import { CheckOptions, TypeEntry } from "@protobase/workflows";
@@ -13,7 +14,9 @@ export type WorkflowCatalog = {
   checkWith: (models: (name: string) => ResourceModel | undefined) => CheckOptions;
   /** Issues a workflow's webhook URL as the caller, for `new_webhook_url`. */
   issueWebhook?: IssueWebhook;
+  /** The caller's own connected accounts, for `list_connections`; none without it. */
+  listConnections?: ListConnections;
 };
-/** The tools that read workflows, their types and runs, and check definitions. */
+/** The tools that read workflows, their types and runs and the caller's connections, and check definitions. */
 export declare const workflowReadTools: (catalog: WorkflowCatalog) => AssistantTool<ToolContext>[];
 //#endregion

package/dist/workflows/mcp/workflow-read-tools.js

@@ -1,5 +1,6 @@
 import { defineTool } from "../../assistant/tools.js";
 import { refused } from "../../assistant/record-tool-args.js";
+import { listConnectionsTool } from "./connection-tools.js";
 import { mergePatch } from "./merge-patch.js";
 import { definitionParameter, editParameter, idOf, idParameter, objectOf, pageSizeOf, textOf } from "./workflow-tool-args.js";
 import { checkDefinition, typeCatalog } from "@protobase/workflows";
@@ -194,13 +195,14 @@ const getWorkflowRunTool = defineTool({
 		}), refused);
 	}
 });
-/** The tools that read workflows, their types and runs, and check definitions. */
+/** The tools that read workflows, their types and runs and the caller's connections, and check definitions. */
 const workflowReadTools = (catalog) => [
 	listWorkflowTypesTool(catalog),
 	listWorkflowsTool,
 	getWorkflowTool,
 	validateWorkflowTool(catalog),
-	getWorkflowRunTool
+	getWorkflowRunTool,
+	listConnectionsTool(catalog.listConnections)
 ];
 //#endregion
 export { getWorkflowRunTool, getWorkflowTool, listWorkflowsTool, workflowReadTools };

package/dist/workflows/workflow-engine.js

@@ -11,6 +11,7 @@ import { triggerJobs } from "./triggers/trigger-jobs.js";
 import { workflowTypes } from "./workflow-types.js";
 import { betterAuthConnectionAccounts } from "./connections/connection-accounts.js";
 import { connectionWiring } from "./connections/connection-wiring.js";
+import { connectionUses } from "./connections/connection-uses.js";
 import { connectionTriggers } from "./connections/connection-triggers.js";
 import { secretRedactor } from "@protobase/workflows";
 //#region src/workflows/workflow-engine.ts
@@ -60,7 +61,14 @@ const workflowEngine = (options, deps, auth) => {
 		origin: () => auth?.origins[0],
 		systemPath: () => deps().systemPath
 	});
-	auth?.connections.events.set(connectionTriggers(() => deps().db, schema, triggers));
+	auth?.connections.events.set({
+		...connectionTriggers(() => deps().db, schema, triggers),
+		uses: connectionUses({
+			deps,
+			schema,
+			roles
+		})
+	});
 	const webhooks = usable(types.webhooks);
 	const issue = {
 		deps,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.69.0",
+  "version": "0.69.2",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -44,11 +44,11 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.69.0",
-    "@protobase/query": "0.69.0",
-    "@protobase/schema": "0.69.0",
-    "@protobase/workflow-plugins": "0.69.0",
-    "@protobase/workflows": "0.69.0",
+    "@protobase/layout": "0.69.2",
+    "@protobase/query": "0.69.2",
+    "@protobase/schema": "0.69.2",
+    "@protobase/workflow-plugins": "0.69.2",
+    "@protobase/workflows": "0.69.2",
     "@react-email/render": "^2.1.0",
     "@react-pdf/primitives": "^4.4.0",
     "@react-pdf/renderer": "^4.9.0",