@protobase/server 0.8.2 → 0.10.0

package/dist/active-role.js

@@ -0,0 +1,8 @@
+//#region src/active-role.ts
+/**
+* The one role a session works as, which picks its bottom bar: the first of its roles. A Better Auth token carries the
+* session's active role alone (see `narrowClaims`); with another authenticator, the caller's first role.
+*/
+const activeRole = (session) => session.user.roles[0];
+//#endregion
+export { activeRole };

package/dist/admin-options.d.ts

@@ -1,4 +1,5 @@
 import { AuditQueue, PipelineHook, ScanGuardMode } from "./types.js";
+import { CorsOrigins } from "./api-cors.js";
 import { AssistantOptions } from "./assistant/assistant-settings.js";
 import { RuntimeOptions } from "./runtime/runtime-settings.js";
 import { ResolveOptions } from "@protobase/schema";
@@ -29,6 +30,13 @@ export type AdminOptions = {
   onUnhandledError?: (error: unknown) => void;
   /** The assistant in the admin app's dock: a backend elsewhere or the built-in one (see `AssistantOptions`); `false` turns it off. */
   assistant?: AssistantOptions | false;
+  /**
+   * The websites whose browser code may call the API (`/api/*` but `/api/auth/*`) besides the app's own origins (see
+   * `createAuth`'s `origins`): a list of origins, or `*` for any. Defaults to the one the platform passes in
+   * `PROTOBASE_CORS_ORIGINS` (`*` or comma separated), when set. With neither this nor other origins, the API sends no
+   * CORS headers.
+   */
+  cors?: CorsOrigins;
   /** The runtime updates endpoint behind the top bar's update button (see `RuntimeOptions`); `false` turns it off. */
   runtime?: RuntimeOptions | false;
 };

package/dist/api-cors.d.ts

@@ -0,0 +1,5 @@
+import "hono";
+//#region src/api-cors.d.ts
+/** The websites whose browser code may call the API: `*` for any, or a list of origins such as `https://shop.com`. */
+export type CorsOrigins = '*' | string[];
+//#endregion

package/dist/api-cors.js

@@ -0,0 +1,53 @@
+import { readList } from "./better-auth/origins.js";
+import { cors } from "hono/cors";
+//#region src/api-cors.ts
+const corsOriginsVariable = "PROTOBASE_CORS_ORIGINS";
+/** The origins in `PROTOBASE_CORS_ORIGINS`, `*` or comma separated; `undefined` when it is unset. One that is not a URL stops the server at startup. */
+const readCorsOrigins = (env) => {
+	const value = env[corsOriginsVariable]?.trim();
+	if (!value) return void 0;
+	if (value === "*") return "*";
+	return readList(value).map((origin) => {
+		if (!URL.canParse(origin)) throw new Error(`${corsOriginsVariable} lists "${origin}", which is not a URL such as https://shop.com`);
+		return new URL(origin).origin;
+	});
+};
+const allowHeaders = [
+	"authorization",
+	"content-type",
+	"if-match",
+	"if-none-match"
+];
+const exposeHeaders = [
+	"location",
+	"etag",
+	"x-meta-version",
+	"x-protobase-warning"
+];
+/**
+* CORS for the API: an allowed origin gets `Access-Control-Allow-Origin` (`*` when any is), preflights are answered
+* before authentication and kept for ten minutes.
+*/
+const apiCors = ({ own, allowed, skip }) => {
+	const origin = (requestOrigin) => {
+		if (allowed === "*") return "*";
+		return own.includes(requestOrigin) || allowed.includes(requestOrigin) ? requestOrigin : null;
+	};
+	const handler = cors({
+		origin,
+		allowHeaders,
+		exposeHeaders,
+		maxAge: 600,
+		allowMethods: [
+			"GET",
+			"HEAD",
+			"POST",
+			"PUT",
+			"PATCH",
+			"DELETE"
+		]
+	});
+	return (c, next) => skip(c.req.path) ? next() : handler(c, next);
+};
+//#endregion
+export { apiCors, corsOriginsVariable, readCorsOrigins };

package/dist/batch/run-batch.js

@@ -2,7 +2,7 @@ import { HttpProblem, badRequest, notFound } from "../problem.js";
 import { problemOf } from "../error-handler.js";
 import { requestAccess } from "../request-access.js";
 import { writeTransaction } from "../transactions.js";
-import { actorSettings } from "../changes/actor.js";
+import { actorSettings, wakeDispatch } from "../changes/actor.js";
 import { keyOf } from "../write-shared.js";
 import { writeIn } from "../write-pipeline.js";
 import { resolveData, resolveKey } from "./refs.js";
@@ -38,7 +38,7 @@ const runBatch = async (deps, session, operations) => {
 		accesses.set(entry.name, access);
 		return access;
 	};
-	return writeTransaction(deps.db, deps.statementTimeoutMs, async (trx) => {
+	const written = await writeTransaction(deps.db, deps.statementTimeoutMs, async (trx) => {
 		const created = /* @__PURE__ */ new Map();
 		const results = [];
 		for (const [index, operation] of operations.entries()) try {
@@ -101,6 +101,8 @@ const runBatch = async (deps, session, operations) => {
 		}
 		return results;
 	}, actorSettings(deps, session));
+	wakeDispatch(deps);
+	return written;
 };
 //#endregion
 export { runBatch };

package/dist/better-auth/admin-only.js

@@ -1,9 +1,11 @@
-import { parseRoles } from "./parse-roles.js";
+import "./organizations/role-definitions.js";
+import { sessionRoles } from "./roles/session-role.js";
 import { APIError, createAuthMiddleware, sessionMiddleware } from "better-auth/api";
 //#region src/better-auth/admin-only.ts
-/** Lets a request through only with the session of an admin; others get `403 ADMIN_ONLY` with `message`. */
+/** Lets a request through only with the session of someone acting as an admin; others get `403 ADMIN_ONLY` with `message`. */
 const adminOnly = (message) => createAuthMiddleware({ use: [sessionMiddleware] }, async (ctx) => {
-	if (!parseRoles(ctx.context.session.user.role).includes("admin")) throw new APIError("FORBIDDEN", {
+	const { active } = await sessionRoles(ctx.context, ctx.context.session);
+	if (active !== "admin") throw new APIError("FORBIDDEN", {
 		code: "ADMIN_ONLY",
 		message
 	});

package/dist/better-auth/authenticator.d.ts

@@ -7,7 +7,7 @@ export type BetterAuthAuthenticatorOptions = {
   auth?: AdminAuth;
   /** Or its JWKS endpoint, for an API that runs apart from the auth server. Needs `issuer`. */
   jwksUrl?: string | URL;
-  /** Defaults to the auth instance's `baseURL`; it is both issuer and audience of its tokens. */
+  /** Defaults to the auth instance's `issuer`, its `baseURL`; it is both issuer and audience of its tokens. */
   issuer?: string;
   /** The one tenant everyone works in, for an app without organizations; never read from the token. */
   tenant?: TenantValue | (() => Promise<TenantValue | undefined>);

package/dist/better-auth/authenticator.js

@@ -9,7 +9,7 @@ import { cachedKeys } from "./jwks-cache.js";
 * role, is left out.
 */
 const betterAuthAuthenticator = (options) => {
-	const issuer = options.issuer ?? options.auth?.options.baseURL;
+	const issuer = options.issuer ?? options.auth?.issuer;
 	if (!issuer) throw new Error("betterAuthAuthenticator needs `issuer` (or an `auth` instance with a baseURL)");
 	if (!options.auth && !options.jwksUrl) throw new Error("betterAuthAuthenticator needs `auth` or `jwksUrl`");
 	const organizations = options.organizations ?? Boolean(options.auth?.organizations);

package/dist/better-auth/create-auth.d.ts

@@ -1,8 +1,8 @@
 import { SignInPolicy } from "./sign-in-policy.js";
 import { StaffSignIn } from "./staff-log.js";
-import { RoleDefinitions, RolesInput } from "./organizations/role-definitions.js";
 import { Mailer } from "../mail/smtp-mailer.js";
 import { OperatorProvider } from "./operator-provider.js";
+import { RoleDefinitions, RolesInput } from "./organizations/role-definitions.js";
 import { OrganizationRole } from "./organizations/store.js";
 import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/options.js";
 import { PlatformSignIn } from "./platform-sign-in.js";
@@ -12,8 +12,21 @@ import { BetterAuthOptions } from "better-auth";
 export type CreateAuthOptions = {
   /** A `pg` Pool, or `{ dialect, type: 'postgres', schemaName? }` for a Kysely dialect: the admin store, apart from the application's tables (its own schema or database). */
   database: BetterAuthOptions['database'];
-  /** Public origin of the API, for example `https://admin.example.com`. Issuer and audience of the tokens; passkeys belong to its host. */
+  /** Public origin of the API, for example `https://admin.example.com`. Issuer and audience of the tokens; new passkeys are made for its host unless `passkeyDomain` names another. */
   baseURL: string;
+  /**
+   * The other origins the app is served on, for example `['https://admin.shop.com']`. A request to one of them is
+   * answered for that host: its sign-in callbacks and the links it mails, such as a password reset, stay there, and
+   * passkeys work on every origin. Tokens keep `baseURL` as issuer, whatever host issued them. Defaults to the
+   * comma-separated list the platform passes in `PROTOBASE_ORIGINS`, when set; none otherwise.
+   */
+  origins?: string[];
+  /**
+   * The host new passkeys are made for (their RP ID): the host of `baseURL` or of one of `origins`. Each passkey keeps
+   * the one it was made for, and works on every origin, so changing it breaks none. Defaults to the one the platform
+   * passes in `PROTOBASE_PASSKEY_DOMAIN`, when set, and to the host of `baseURL` otherwise.
+   */
+  passkeyDomain?: string;
   /** The name authenticator apps and passkey prompts show for this app. Default `Protobase`. */
   appName?: string;
   /** Signs cookies and encrypts the JWT private keys. Generate with `openssl rand -base64 32`. */
@@ -1075,26 +1088,26 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           user: import("better-auth").User & Record<string, any>;
           session: import("better-auth").Session & Record<string, any>;
         }) => Promise<{
-          email: string;
           role: any;
+          email: string;
         } | {
           org?: undefined;
           org_role?: undefined;
           app_roles?: undefined;
-          email: string;
           role: any;
+          email: string;
         } | {
           org: string;
           org_role: OrganizationRole;
           app_roles: string[];
-          email: string;
           role: any;
+          email: string;
         } | {
           org: string;
           org_role?: undefined;
           app_roles?: undefined;
-          email: string;
           role: any;
+          email: string;
         }>;
       };
       disableSettingJwtHeader: true;
@@ -1990,9 +2003,39 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       INVALID_TWO_FACTOR_COOKIE: import("better-auth").RawError<"INVALID_TWO_FACTOR_COOKIE">;
     };
   }, {
-    id: "passkey";
-    version: string;
     endpoints: {
+      generatePasskeyAuthenticationOptions: import("better-auth").StrictEndpoint<"/passkey/generate-authenticate-options", {
+        method: "GET";
+        query: import("zod").ZodOptional<import("zod").ZodObject<{
+          rpId: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+      }, import("@simplewebauthn/server").PublicKeyCredentialRequestOptionsJSON>;
+      verifyPasskeyAuthentication: import("better-auth").StrictEndpoint<"/passkey/verify-authentication", {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          response: import("zod").ZodRecord<import("zod").ZodAny, import("zod").ZodAny>;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        session: {
+          id: string;
+          createdAt: Date;
+          updatedAt: Date;
+          userId: string;
+          expiresAt: Date;
+          token: string;
+          ipAddress?: string | null | undefined;
+          userAgent?: string | null | undefined;
+        };
+        user: {
+          id: string;
+          createdAt: Date;
+          updatedAt: Date;
+          email: string;
+          emailVerified: boolean;
+          name: string;
+          image?: string | null | undefined;
+        };
+      }>;
       generatePasskeyRegistrationOptions: import("better-auth").StrictEndpoint<"/passkey/generate-register-options", {
         method: "GET";
         use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
@@ -2133,100 +2176,6 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           };
         };
       }, import("@simplewebauthn/server").PublicKeyCredentialCreationOptionsJSON>;
-      generatePasskeyAuthenticationOptions: import("better-auth").StrictEndpoint<"/passkey/generate-authenticate-options", {
-        method: "GET";
-        metadata: {
-          openapi: {
-            operationId: string;
-            description: string;
-            responses: {
-              200: {
-                description: string;
-                content: {
-                  "application/json": {
-                    schema: {
-                      type: "object";
-                      properties: {
-                        challenge: {
-                          type: string;
-                        };
-                        rp: {
-                          type: string;
-                          properties: {
-                            name: {
-                              type: string;
-                            };
-                            id: {
-                              type: string;
-                            };
-                          };
-                        };
-                        user: {
-                          type: string;
-                          properties: {
-                            id: {
-                              type: string;
-                            };
-                            name: {
-                              type: string;
-                            };
-                            displayName: {
-                              type: string;
-                            };
-                          };
-                        };
-                        timeout: {
-                          type: string;
-                        };
-                        allowCredentials: {
-                          type: string;
-                          items: {
-                            type: string;
-                            properties: {
-                              id: {
-                                type: string;
-                              };
-                              type: {
-                                type: string;
-                              };
-                              transports: {
-                                type: string;
-                                items: {
-                                  type: string;
-                                };
-                              };
-                            };
-                          };
-                        };
-                        userVerification: {
-                          type: string;
-                        };
-                        authenticatorSelection: {
-                          type: string;
-                          properties: {
-                            authenticatorAttachment: {
-                              type: string;
-                            };
-                            requireResidentKey: {
-                              type: string;
-                            };
-                            userVerification: {
-                              type: string;
-                            };
-                          };
-                        };
-                        extensions: {
-                          type: string;
-                        };
-                      };
-                    };
-                  };
-                };
-              };
-            };
-          };
-        };
-      }, import("@simplewebauthn/server").PublicKeyCredentialRequestOptionsJSON>;
       verifyPasskeyRegistration: import("better-auth").StrictEndpoint<"/passkey/verify-registration", {
         method: "POST";
         body: import("zod").ZodObject<{
@@ -2292,63 +2241,6 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           };
         };
       }, import("@better-auth/passkey").Passkey>;
-      verifyPasskeyAuthentication: import("better-auth").StrictEndpoint<"/passkey/verify-authentication", {
-        method: "POST";
-        body: import("zod").ZodObject<{
-          response: import("zod").ZodRecord<import("zod").ZodAny, import("zod").ZodAny>;
-        }, import("zod/v4/core").$strip>;
-        metadata: {
-          openapi: {
-            operationId: string;
-            description: string;
-            responses: {
-              200: {
-                description: string;
-                content: {
-                  "application/json": {
-                    schema: {
-                      type: "object";
-                      properties: {
-                        session: {
-                          $ref: string;
-                        };
-                        user: {
-                          $ref: string;
-                        };
-                      };
-                    };
-                  };
-                };
-              };
-            };
-          };
-          $Infer: {
-            body: {
-              response: import("@simplewebauthn/server").AuthenticationResponseJSON;
-            };
-          };
-        };
-      }, {
-        session: {
-          id: string;
-          createdAt: Date;
-          updatedAt: Date;
-          userId: string;
-          expiresAt: Date;
-          token: string;
-          ipAddress?: string | null | undefined;
-          userAgent?: string | null | undefined;
-        };
-        user: {
-          id: string;
-          createdAt: Date;
-          updatedAt: Date;
-          email: string;
-          emailVerified: boolean;
-          name: string;
-          image?: string | null | undefined;
-        };
-      }>;
       listPasskeys: import("better-auth").StrictEndpoint<"/passkey/list-user-passkeys", {
         method: "GET";
         use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
@@ -2515,6 +2407,13 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     schema: {
       passkey: {
         fields: {
+          rpID: {
+            type: "string";
+            required: false;
+            fieldName: string;
+            input: false;
+            defaultValue: () => string;
+          };
           name: {
             type: "string";
             required: false;
@@ -2564,6 +2463,8 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         };
       };
     };
+    id: "passkey";
+    version: string;
     $ERROR_CODES: {
       CHALLENGE_NOT_FOUND: import("better-auth").RawError<"CHALLENGE_NOT_FOUND">;
       YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY">;
@@ -3663,6 +3564,101 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-roles";
+    schema: {
+      session: {
+        fields: {
+          activeRole: {
+            type: "string";
+            required: false;
+            input: false;
+            fieldName: string;
+          };
+        };
+      };
+      user: {
+        fields: {
+          lastRole: {
+            type: "string";
+            required: false;
+            input: false;
+            fieldName: string;
+          };
+        };
+      };
+    };
+    endpoints: {
+      currentRole: import("better-auth").StrictEndpoint<"/role/current", {
+        method: "GET";
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+      }, {
+        active: string | null;
+        roles: {
+          name: string;
+          label: string;
+        }[];
+      }>;
+      switchRole: import("better-auth").StrictEndpoint<"/role/switch", {
+        method: "POST";
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        body: import("zod").ZodObject<{
+          role: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        role: string;
+      }>;
+    };
+    hooks: {
+      before: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | import("better-auth/plugins").DefaultOrganizationPlugin<{
     organizationHooks: {
       beforeCreateOrganization?: (data: {
@@ -4264,7 +4260,11 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   socialProviders?: import("better-auth").SocialProviders | undefined;
   appName: string;
   database: any;
-  baseURL: string;
+  baseURL: string | {
+    allowedHosts: string[];
+    fallback: string;
+    protocol: "https" | "http";
+  };
   basePath: string;
   secret: string;
   trustedOrigins: string[];
@@ -4281,6 +4281,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     minPasswordLength: number;
   };
 }> & {
+  /** Issuer and audience of the tokens: `baseURL`, on every origin. */
+  issuer: string;
+  /** Every origin the app is served on, `baseURL`'s first. */
+  origins: string[];
+  /** The RP ID of new passkeys. */
+  passkeyDomain: string;
   roles: string[];
   roleDefinitions: RoleDefinitions;
   organizations: ResolvedOrganizations | undefined;