@protobase/server 0.7.0 → 0.8.0

package/dist/assistant/conversations.d.ts

@@ -1,5 +1,5 @@
-import { ChatMessage } from "./chat-completions.js";
 import { Session } from "../types.js";
+import { ChatMessage } from "./chat-completions.js";
 import { ConversationStore } from "./conversation-store.js";
 import { AssistantEvent, AssistantState } from "@protobase/schema";
 //#region src/assistant/conversations.d.ts

package/dist/assistant/tools.d.ts

@@ -1,7 +1,7 @@
 import { Session } from "../types.js";
+import { ToolRecords } from "./records.js";
 import { Conversation } from "./conversations.js";
 import { ApprovalAnswer, ApprovalRequest } from "./approval.js";
-import { ToolRecords } from "./records.js";
 import { AssistantPart } from "@protobase/schema";
 //#region src/assistant/tools.d.ts
 export type ToolContext = {

package/dist/assistant/turn.d.ts

@@ -1,7 +1,7 @@
-import { ModelSettings, ReasoningEffort } from "./chat-completions.js";
 import { Session } from "../types.js";
-import { Conversation } from "./conversations.js";
 import { ToolRecords } from "./records.js";
+import { ModelSettings, ReasoningEffort } from "./chat-completions.js";
+import { Conversation } from "./conversations.js";
 import { AssistantTool } from "./tools.js";
 //#region src/assistant/turn.d.ts
 export type TurnOptions = {

package/dist/audit/origin.js

@@ -0,0 +1,12 @@
+//#region src/audit/origin.ts
+/** Where a request came from, for an audit event: its user agent and the proxies' `X-Forwarded-For`, when sent. */
+const auditOrigin = (headers) => {
+	const userAgent = headers.get("user-agent");
+	const forwardedFor = headers.get("x-forwarded-for");
+	return {
+		...userAgent !== null && { userAgent },
+		...forwardedFor !== null && { forwardedFor }
+	};
+};
+//#endregion
+export { auditOrigin };

package/dist/auth/jwt.d.ts

@@ -9,6 +9,8 @@ export type JwtOptions = {
   audience?: string;
   /** Claim holding the roles, an array, or a string separated by spaces or commas. Default `roles`. */
   rolesClaim?: string;
+  /** A second claim whose roles are added to those of `rolesClaim`, such as an organization membership's. */
+  extraRolesClaim?: string;
   /** Claim holding the tenant. Default `tenant`. */
   tenantClaim?: string;
   /** Accepted signature algorithms. Default: asymmetric ones only, so a token can never be "verified" with a public key used as an HMAC secret. */

package/dist/auth/jwt.js

@@ -25,21 +25,23 @@ const jwtAuthenticator = (options) => {
 	return async (request) => {
 		const [scheme, token] = (request.headers.get("authorization") ?? "").split(" ");
 		if (scheme?.toLowerCase() !== "bearer" || !token) throw unauthorized("Send a bearer token in the Authorization header");
-		const { sub, [tenantClaim]: tenant, [rolesClaim]: roles } = (await jwtVerify(token, keys, {
+		const verified = await jwtVerify(token, keys, {
 			algorithms: options.algorithms ?? asymmetric,
 			...options.issuer && { issuer: options.issuer },
 			...options.audience && { audience: options.audience }
 		}).catch((error) => {
 			if (error instanceof errors.JOSEError) throw unauthorized("The bearer token is invalid or expired");
 			throw error;
-		})).payload;
+		});
+		const { sub, [tenantClaim]: tenant, [rolesClaim]: roles } = verified.payload;
+		const extraRoles = options.extraRolesClaim === void 0 ? [] : rolesOf(verified.payload[options.extraRolesClaim]);
 		if (!sub) throw unauthorized("The bearer token has no subject");
 		const claimed = typeof tenant === "string" || typeof tenant === "number" ? tenant : void 0;
 		const tenantValue = options.tenant === void 0 ? claimed : typeof options.tenant === "function" ? await options.tenant() : options.tenant;
 		return {
 			user: {
 				id: sub,
-				roles: rolesOf(roles)
+				roles: [.../* @__PURE__ */ new Set([...rolesOf(roles), ...extraRoles])]
 			},
 			...tenantValue !== void 0 && { tenant: tenantValue }
 		};

package/dist/batch/reorder.js

@@ -71,7 +71,7 @@ const reorderIn = async (trx, deps, access, input) => {
 	const results = [];
 	for (const [i, key] of input.keys.entries()) {
 		const plan = plans.get(i);
-		results.push(shown(access, plan ? await applyUpdate(trx, deps, access, key, plan) : current[i]));
+		results.push(await shown(access, plan ? await applyUpdate(trx, deps, access, key, plan) : current[i]));
 	}
 	return results;
 };

package/dist/better-auth/authenticator.d.ts

@@ -9,14 +9,18 @@ export type BetterAuthAuthenticatorOptions = {
   jwksUrl?: string | URL;
   /** Defaults to the auth instance's `baseURL`; it is both issuer and audience of its tokens. */
   issuer?: string;
-  /** The one tenant everyone works in (organizations are not used yet); never read from the token. */
+  /** The one tenant everyone works in, for an app without organizations; never read from the token. */
   tenant?: TenantValue | (() => Promise<TenantValue | undefined>);
+  /** Whether the tokens carry organizations; read from `auth` when given. Needed with `jwksUrl` only. */
+  organizations?: boolean;
   /** How long the key set is cached; see `cachedKeys`. */
   cache?: JwksCacheOptions;
 };
 /**
- * Verifies the bearer JWT that Better Auth's jwt plugin issues. `sub` is the user id, the `role` claim
- * (a comma separated string from the admin plugin) becomes `roles`.
+ * Verifies the bearer JWT that Better Auth's jwt plugin issues. `sub` is the user id, the `role` claim (a comma
+ * separated string from the admin plugin) becomes `roles`. With organizations, the `org` claim is the tenant and the
+ * organization, and the membership's `app_roles` are added to the global roles; `user`, which stands for no global
+ * role, is left out.
  */
 export declare const betterAuthAuthenticator: (options: BetterAuthAuthenticatorOptions) => Authenticator;
 //#endregion

package/dist/better-auth/authenticator.js

@@ -1,21 +1,42 @@
+import { noGlobalRole } from "./organizations/role-definitions.js";
 import { jwtAuthenticator } from "../auth/jwt.js";
 import { cachedKeys } from "./jwks-cache.js";
 //#region src/better-auth/authenticator.ts
 /**
-* Verifies the bearer JWT that Better Auth's jwt plugin issues. `sub` is the user id, the `role` claim
-* (a comma separated string from the admin plugin) becomes `roles`.
+* Verifies the bearer JWT that Better Auth's jwt plugin issues. `sub` is the user id, the `role` claim (a comma
+* separated string from the admin plugin) becomes `roles`. With organizations, the `org` claim is the tenant and the
+* organization, and the membership's `app_roles` are added to the global roles; `user`, which stands for no global
+* role, is left out.
 */
 const betterAuthAuthenticator = (options) => {
 	const issuer = options.issuer ?? options.auth?.options.baseURL;
 	if (!issuer) throw new Error("betterAuthAuthenticator needs `issuer` (or an `auth` instance with a baseURL)");
 	if (!options.auth && !options.jwksUrl) throw new Error("betterAuthAuthenticator needs `auth` or `jwksUrl`");
-	return jwtAuthenticator({
+	const organizations = options.organizations ?? Boolean(options.auth?.organizations);
+	const verify = jwtAuthenticator({
 		...options.auth ? { keys: cachedKeys(() => options.auth.api.getJwks(), options.cache) } : { jwksUrl: options.jwksUrl },
 		issuer,
 		audience: issuer,
 		rolesClaim: "role",
+		...organizations && {
+			tenantClaim: "org",
+			extraRolesClaim: "app_roles"
+		},
 		...options.tenant !== void 0 && { tenant: options.tenant }
 	});
+	if (!organizations) return verify;
+	return async (request) => {
+		const session = await verify(request);
+		const user = {
+			...session.user,
+			roles: session.user.roles.filter((role) => role !== noGlobalRole)
+		};
+		return {
+			...session,
+			user,
+			...session.tenant !== void 0 && { organization: { id: session.tenant } }
+		};
+	};
 };
 //#endregion
 export { betterAuthAuthenticator };