@protobase/server 0.8.2 → 0.10.0

package/dist/better-auth/create-auth.js

@@ -1,3 +1,4 @@
+import { multiHostBaseURL, readOrigins, resolveOrigins } from "./origins.js";
 import { readMailSettings } from "../mail/mail-settings.js";
 import { smtpMailer } from "../mail/smtp-mailer.js";
 import { readOperatorSettings, resolveOperator } from "./operator-provider.js";
@@ -6,14 +7,17 @@ import { lastOrganizationField, organizationClaims, sessionOrganizationHooks } f
 import { organizationPlugin } from "./organizations/organization-plugin.js";
 import { protobaseOrganizationPlugin } from "./organizations/protobase-plugin.js";
 import { resolveOrganizations } from "./organizations/options.js";
+import { passkeyHosts, readPasskeyDomain, resolvePasskeyDomain } from "./passkey-domain.js";
+import { coreNames, pluginNames } from "./snake-case-names.js";
+import { passkeyPlugin } from "./passkey-plugin.js";
 import { passwordResetOptions } from "./password-reset.js";
+import { narrowClaims } from "./roles/active-role.js";
+import { rolesPlugin } from "./roles/roles-plugin.js";
 import { platformSignInFor, platformSignInProvider, readPlatformSignIn, resolvePlatformSignIn } from "./platform-sign-in.js";
 import { signInPolicyPlugin } from "./policy-plugin.js";
 import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
-import { coreNames, pluginNames } from "./snake-case-names.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
 import { twoFactorAfterPasswordOrCode } from "./two-factor-challenge.js";
-import { passkey } from "@better-auth/passkey";
 import { APIError } from "better-auth/api";
 import { betterAuth } from "better-auth";
 import { admin, emailOTP, genericOAuth, jwt } from "better-auth/plugins";
@@ -21,6 +25,8 @@ import { adminAc, userAc } from "better-auth/plugins/admin/access";
 //#region src/better-auth/create-auth.ts
 const platformOperator = () => readOperatorSettings(globalThis.process?.env ?? {});
 const platformSignInSettings = () => readPlatformSignIn(globalThis.process?.env ?? {});
+const platformOrigins = () => readOrigins(globalThis.process?.env ?? {});
+const platformPasskeyDomain = () => readPasskeyDomain(globalThis.process?.env ?? {});
 const platformMailer = () => {
 	const settings = readMailSettings(globalThis.process?.env ?? {});
 	return settings && smtpMailer(settings);
@@ -42,17 +48,19 @@ const organizationPaths = ["/organization/set-active", "/organization/accept-inv
 * The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
 * sign-in provider already resolved.
 */
-const betterAuthOptions = (options, { roles, defaultRole, mailer, operator, platformSignIn, organizations, context = noContext }) => {
+const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, mailer, operator, platformSignIn, organizations, context = noContext }) => {
 	const secure = options.baseURL.startsWith("https://");
 	const signIn = platformSignInFor(platformSignIn, Object.keys(options.socialProviders ?? {}));
+	const hosts = passkeyHosts([options.baseURL, ...origins]);
 	return {
 		appName: options.appName ?? "Protobase",
 		database: options.database,
-		baseURL: options.baseURL,
+		baseURL: multiHostBaseURL(options.baseURL, origins),
 		basePath: authBasePath,
 		secret: options.secret,
 		trustedOrigins: [
 			options.baseURL,
+			...origins,
 			"https://*.trycloudflare.com",
 			...options.trustedOrigins ?? []
 		],
@@ -86,11 +94,17 @@ const betterAuthOptions = (options, { roles, defaultRole, mailer, operator, plat
 					expirationTime: tokenLifetime,
 					issuer: options.baseURL,
 					audience: options.baseURL,
-					definePayload: async ({ user, session }) => ({
-						email: user.email,
-						role: user.role,
-						...organizations && await organizationClaims((await context()).adapter, user, session.activeOrganizationId)
-					})
+					definePayload: async ({ user, session }) => {
+						const { activeRole, activeOrganizationId } = session;
+						const claims = {
+							role: user.role,
+							...organizations && await organizationClaims((await context()).adapter, user, activeOrganizationId)
+						};
+						return {
+							email: user.email,
+							...narrowClaims(claims, [activeRole, user.lastRole], Boolean(organizations))
+						};
+					}
 				},
 				disableSettingJwtHeader: true
 			}),
@@ -99,7 +113,11 @@ const betterAuthOptions = (options, { roles, defaultRole, mailer, operator, plat
 				allowPasswordless: true,
 				...mailer && { otpOptions: twoFactorCodeOptions(mailer) }
 			}),
-			passkey({ schema: pluginNames.passkey }),
+			passkeyPlugin({
+				domain: passkeyDomain ?? hosts[0],
+				hosts,
+				formerDomain: hosts[0]
+			}),
 			...mailer ? [emailOTP(emailCodeOptions(mailer))] : [],
 			...signIn ? [genericOAuth({ config: [platformSignInProvider(signIn)] })] : [],
 			signInPolicyPlugin({
@@ -115,6 +133,7 @@ const betterAuthOptions = (options, { roles, defaultRole, mailer, operator, plat
 				...operator && { operator },
 				...mailer && { mailer }
 			}),
+			rolesPlugin({ definitions }),
 			...organizations ? [organizationPlugin({
 				resolved: organizations,
 				secret: options.secret,
@@ -186,11 +205,16 @@ const createAuth = (options) => {
 	const signInSettings = options.signInProvider === void 0 ? platformSignInSettings() : options.signInProvider || void 0;
 	const socialProviders = Object.keys(options.socialProviders ?? {});
 	const platformSignIn = platformSignInFor(signInSettings && resolvePlatformSignIn(signInSettings), socialProviders);
+	const origins = resolveOrigins(options.baseURL, options.origins ?? platformOrigins());
+	const passkeyDomain = resolvePasskeyDomain(options.passkeyDomain ?? platformPasskeyDomain(), [options.baseURL, ...origins]);
 	const organizations = options.organizations && resolveOrganizations(options.organizations, definitions, options.baseURL);
 	let instance;
 	const context = () => instance?.$context ?? Promise.reject(/* @__PURE__ */ new Error("The auth instance is not made yet"));
 	const auth = betterAuth(betterAuthOptions(options, {
+		origins,
+		passkeyDomain,
 		roles,
+		definitions,
 		defaultRole,
 		mailer,
 		operator,
@@ -202,6 +226,12 @@ const createAuth = (options) => {
 	}));
 	instance = auth;
 	return Object.assign(auth, {
+		/** Issuer and audience of the tokens: `baseURL`, on every origin. */
+		issuer: options.baseURL,
+		/** Every origin the app is served on, `baseURL`'s first. */
+		origins: [new URL(options.baseURL).origin, ...origins],
+		/** The RP ID of new passkeys. */
+		passkeyDomain,
 		roles,
 		roleDefinitions: definitions,
 		organizations,

package/dist/better-auth/operator-provider.d.ts

@@ -1,7 +1,8 @@
 //#region src/better-auth/operator-provider.d.ts
 /**
  * The identity provider the operator's staff sign in with to sign in as people of this app: any OpenID Connect
- * provider, with this app registered as a confidential client whose redirect URI is `{baseURL}/api/auth/staff/callback`.
+ * provider, with this app registered as a confidential client whose redirect URI is `{origin}/api/auth/staff/callback`,
+ * for `baseURL` and each of the app's other `origins`.
  */
 export type OperatorProvider = {
   /** The provider's issuer URL; its settings are read from `{issuer}/.well-known/openid-configuration`. */

package/dist/better-auth/origins.d.ts

@@ -0,0 +1,4 @@
+//#region src/better-auth/origins.d.ts
+/** Where browsers read which origins may use the app's passkeys (WebAuthn Related Origin Requests). */
+export declare const webauthnPath = "/.well-known/webauthn";
+//#endregion

package/dist/better-auth/origins.js

@@ -0,0 +1,43 @@
+//#region src/better-auth/origins.ts
+const originsVariable = "PROTOBASE_ORIGINS";
+/** The comma-separated list in an environment variable, blanks left out; empty when it is unset. */
+const readList = (value) => (value ?? "").split(",").map((item) => item.trim()).filter(Boolean);
+/** The origins the platform passes in `PROTOBASE_ORIGINS`, comma separated; empty when it is unset. */
+const readOrigins = (env) => readList(env[originsVariable]);
+const originOf = (value, what) => {
+	if (!URL.canParse(value)) throw new Error(`${what} must be a URL such as https://admin.example.com, not "${value}"`);
+	const url = new URL(value);
+	if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error(`${what} must be an http or https URL, not "${value}"`);
+	return url;
+};
+/**
+* The origins the app is served on besides `baseURL`, as `https://host[:port]`, without `baseURL`'s own and without
+* repeats. Each must be a URL with the scheme of `baseURL`, since Better Auth builds every host's URLs with one scheme.
+*/
+const resolveOrigins = (baseURL, origins) => {
+	const base = originOf(baseURL, "baseURL");
+	const resolved = origins.map((origin) => {
+		const url = originOf(origin, `The origin "${origin}"`);
+		if (url.protocol !== base.protocol) throw new Error(`The origin "${origin}" must use ${base.protocol.slice(0, -1)}, like baseURL`);
+		return url.origin;
+	});
+	return [...new Set(resolved)].filter((origin) => origin !== base.origin);
+};
+/**
+* Better Auth's `baseURL` for an app on several origins: each request is answered for its own host when that is one of
+* them (its links, such as a password reset, and its passkey and sign-in callbacks then stay on that host), and for
+* `baseURL` otherwise. With no other origins it is `baseURL` itself.
+*/
+const multiHostBaseURL = (baseURL, origins) => {
+	if (origins.length === 0) return baseURL;
+	const base = new URL(baseURL);
+	return {
+		allowedHosts: [base.host, ...origins.map((origin) => new URL(origin).host)],
+		fallback: baseURL,
+		protocol: base.protocol === "https:" ? "https" : "http"
+	};
+};
+/** Where browsers read which origins may use the app's passkeys (WebAuthn Related Origin Requests). */
+const webauthnPath = "/.well-known/webauthn";
+//#endregion
+export { multiHostBaseURL, originsVariable, readList, readOrigins, resolveOrigins, webauthnPath };

package/dist/better-auth/passkey-domain.js

@@ -0,0 +1,41 @@
+//#region src/better-auth/passkey-domain.ts
+const passkeyDomainVariable = "PROTOBASE_PASSKEY_DOMAIN";
+/** The passkey domain the platform passes in `PROTOBASE_PASSKEY_DOMAIN`; `undefined` when it is unset. */
+const readPasskeyDomain = (env) => env["PROTOBASE_PASSKEY_DOMAIN"]?.trim() || void 0;
+/** The host names of the app's origins, which are the RP IDs its passkeys can have, without repeats. */
+const passkeyHosts = (origins) => [...new Set(origins.map((origin) => new URL(origin).hostname))];
+/**
+* The RP ID new passkeys get: `domain` when given, which must be the host of one of the app's origins, and otherwise
+* the host of the first, `baseURL`'s.
+*/
+const resolvePasskeyDomain = (domain, origins) => {
+	const hosts = passkeyHosts(origins);
+	if (domain === void 0) return hosts[0];
+	const host = domain.toLowerCase();
+	if (!hosts.includes(host)) throw new Error(`The passkey domain "${domain}" must be the host of one of the app's origins: ${hosts.join(", ")}`);
+	return host;
+};
+/**
+* The RP IDs a passkey sign-in may ask the browser for, which asks for one at a time: the passkey domain, then each
+* other host of the app that a passkey was made for (passkeys made before they kept their RP ID count for the host of
+* `baseURL`, the first). On one origin that is the passkey domain alone, read without a query.
+*/
+const signInPasskeyDomains = async (adapter, domain, origins) => {
+	const hosts = passkeyHosts(origins);
+	const others = hosts.filter((host) => host !== domain);
+	if (others.length === 0) return [domain];
+	const held = await Promise.all(others.map(async (host) => {
+		const where = (host === hosts[0] ? [host, null] : [host]).map((value) => ({
+			field: "rpID",
+			value,
+			connector: "OR"
+		}));
+		return await adapter.count({
+			model: "passkey",
+			where
+		}) > 0;
+	}));
+	return [domain, ...others.filter((_, index) => held[index])];
+};
+//#endregion
+export { passkeyDomainVariable, passkeyHosts, readPasskeyDomain, resolvePasskeyDomain, signInPasskeyDomains };

package/dist/better-auth/passkey-plugin.js

@@ -0,0 +1,151 @@
+import { pluginNames } from "./snake-case-names.js";
+import { APIError, createAuthEndpoint, getSessionFromCtx } from "better-auth/api";
+import { setSessionCookie } from "better-auth/cookies";
+import * as z$1 from "zod";
+import { PASSKEY_ERROR_CODES, passkey } from "@better-auth/passkey";
+import { generateAuthenticationOptions, verifyAuthenticationResponse } from "@simplewebauthn/server";
+import { generateRandomString } from "better-auth/crypto";
+//#region src/better-auth/passkey-plugin.ts
+const challengeCookie = "better-auth-passkey";
+const challengeSeconds = 300;
+const unknownDomain = {
+	code: "UNKNOWN_PASSKEY_DOMAIN",
+	message: "This app has no passkeys for that domain."
+};
+const decodeBase64 = (value) => Uint8Array.from(atob(value), (char) => char.charCodeAt(0));
+/**
+* Better Auth's passkeys, with an RP ID kept per passkey. New passkeys are made for the passkey domain; each keeps the
+* RP ID it was made with, so changing the passkey domain breaks none. A sign-in asks the browser for passkeys of one RP
+* ID, `?rpId=` or the passkey domain, and checks the passkey it gets against its own. On an app with several origins,
+* browsers let each origin use the passkeys of the others through `/.well-known/webauthn` (Related Origin Requests).
+*/
+const passkeyPlugin = ({ domain, hosts, formerDomain }) => {
+	const base = passkey({
+		schema: pluginNames.passkey,
+		rpID: domain
+	});
+	const rpIDOf = (stored) => stored.rpID ?? formerDomain;
+	/** `GET /passkey/generate-authenticate-options?rpId=`: what the browser needs to ask for a passkey of that RP ID. */
+	const generatePasskeyAuthenticationOptions = createAuthEndpoint("/passkey/generate-authenticate-options", {
+		method: "GET",
+		query: z$1.object({ rpId: z$1.string().optional() }).optional()
+	}, async (ctx) => {
+		const rpID = ctx.query?.rpId?.toLowerCase() ?? domain;
+		if (!hosts.includes(rpID)) throw new APIError("BAD_REQUEST", unknownDomain);
+		const session = await getSessionFromCtx(ctx);
+		const passkeys = (session ? await ctx.context.adapter.findMany({
+			model: "passkey",
+			where: [{
+				field: "userId",
+				value: session.user.id
+			}]
+		}) : []).filter((stored) => rpIDOf(stored) === rpID);
+		const options = await generateAuthenticationOptions({
+			rpID,
+			userVerification: "preferred",
+			...passkeys.length > 0 && { allowCredentials: passkeys.map((stored) => ({
+				id: stored.credentialID,
+				...stored.transports && { transports: stored.transports.split(",") }
+			})) }
+		});
+		const token = generateRandomString(32);
+		const cookie = ctx.context.createAuthCookie(challengeCookie);
+		await ctx.setSignedCookie(cookie.name, token, ctx.context.secret, {
+			...cookie.attributes,
+			maxAge: challengeSeconds
+		});
+		await ctx.context.internalAdapter.createVerificationValue({
+			identifier: token,
+			value: JSON.stringify({
+				type: "authentication",
+				expectedChallenge: options.challenge,
+				userData: { id: session?.user.id ?? "" }
+			}),
+			expiresAt: new Date(Date.now() + challengeSeconds * 1e3)
+		});
+		return ctx.json(options);
+	});
+	/** `POST /passkey/verify-authentication`: checks the browser's answer against the passkey's own RP ID and signs in. */
+	const verifyPasskeyAuthentication = createAuthEndpoint("/passkey/verify-authentication", {
+		method: "POST",
+		body: z$1.object({ response: z$1.record(z$1.any(), z$1.any()) })
+	}, async (ctx) => {
+		const origin = ctx.headers?.get("origin");
+		if (!origin) throw new APIError("BAD_REQUEST", { message: "origin missing" });
+		const response = ctx.body.response;
+		const cookie = ctx.context.createAuthCookie(challengeCookie);
+		const token = await ctx.getSignedCookie(cookie.name, ctx.context.secret);
+		if (!token) throw new APIError("BAD_REQUEST", PASSKEY_ERROR_CODES.CHALLENGE_NOT_FOUND);
+		const challenge = await ctx.context.internalAdapter.consumeVerificationValue(token);
+		if (!challenge) throw new APIError("BAD_REQUEST", PASSKEY_ERROR_CODES.CHALLENGE_NOT_FOUND);
+		const { type, expectedChallenge } = JSON.parse(challenge.value);
+		if (type !== "authentication") throw new APIError("BAD_REQUEST", PASSKEY_ERROR_CODES.CHALLENGE_NOT_FOUND);
+		const stored = await ctx.context.adapter.findOne({
+			model: "passkey",
+			where: [{
+				field: "credentialID",
+				value: response.id
+			}]
+		});
+		if (!stored) throw new APIError("UNAUTHORIZED", PASSKEY_ERROR_CODES.PASSKEY_NOT_FOUND);
+		const verification = await verifyAuthenticationResponse({
+			response,
+			expectedChallenge,
+			expectedOrigin: origin,
+			expectedRPID: rpIDOf(stored),
+			credential: {
+				id: stored.credentialID,
+				publicKey: decodeBase64(stored.publicKey),
+				counter: stored.counter,
+				...stored.transports && { transports: stored.transports.split(",") }
+			},
+			requireUserVerification: false
+		}).catch((error) => {
+			ctx.context.logger.error("Failed to verify the passkey", error);
+		});
+		if (!verification?.verified) throw new APIError("UNAUTHORIZED", PASSKEY_ERROR_CODES.AUTHENTICATION_FAILED);
+		await ctx.context.adapter.update({
+			model: "passkey",
+			where: [{
+				field: "id",
+				value: stored.id
+			}],
+			update: { counter: verification.authenticationInfo.newCounter }
+		});
+		const session = await ctx.context.internalAdapter.createSession(stored.userId);
+		if (!session) throw new APIError("INTERNAL_SERVER_ERROR", PASSKEY_ERROR_CODES.UNABLE_TO_CREATE_SESSION);
+		const user = await ctx.context.internalAdapter.findUserById(stored.userId);
+		if (!user) throw new APIError("INTERNAL_SERVER_ERROR", PASSKEY_ERROR_CODES.USER_NOT_FOUND);
+		await setSessionCookie(ctx, {
+			session,
+			user
+		});
+		return ctx.json({
+			session,
+			user
+		});
+	});
+	return {
+		...base,
+		endpoints: {
+			...base.endpoints,
+			generatePasskeyAuthenticationOptions,
+			verifyPasskeyAuthentication
+		},
+		schema: { passkey: {
+			...base.schema.passkey,
+			fields: {
+				...base.schema.passkey.fields,
+				rpID: {
+					type: "string",
+					required: false,
+					fieldName: "rp_id",
+					input: false,
+					defaultValue: () => domain
+				}
+			}
+		} }
+	};
+};
+//#endregion
+export { passkeyPlugin };

package/dist/better-auth/roles/active-role.js

@@ -0,0 +1,26 @@
+import { parseRoles } from "../parse-roles.js";
+import { noGlobalRole } from "../organizations/role-definitions.js";
+import { globalRoles } from "../organizations/app-roles.js";
+//#region src/better-auth/roles/active-role.ts
+/**
+* The one role someone acts with: the first of `wanted` they hold (the session's active role, then the one they last
+* chose), else the first role they hold. `undefined` for someone without a role.
+*/
+const resolveActiveRole = (held, wanted) => wanted.find((name) => typeof name === "string" && held.includes(name)) ?? held[0];
+/**
+* The claims narrowed to the active role (`resolveActiveRole`), so the token carries that role alone: in `role` when it
+* is held globally, in `app_roles` when held as a member, in both when both. Unchanged for someone without a role.
+*/
+const narrowClaims = (claims, wanted, organizations) => {
+	const global = organizations ? globalRoles(claims.role) : parseRoles(claims.role);
+	const membership = claims.app_roles ?? [];
+	const active = resolveActiveRole([.../* @__PURE__ */ new Set([...global, ...membership])], wanted);
+	if (active === void 0) return claims;
+	return {
+		...claims,
+		role: global.includes(active) ? active : noGlobalRole,
+		...claims.app_roles && { app_roles: membership.includes(active) ? [active] : [] }
+	};
+};
+//#endregion
+export { narrowClaims, resolveActiveRole };

package/dist/better-auth/roles/roles-plugin.js

@@ -0,0 +1,73 @@
+import "../organizations/role-definitions.js";
+import { sessionRoles } from "./session-role.js";
+import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
+import * as z$1 from "zod";
+//#region src/better-auth/roles/roles-plugin.ts
+/**
+* Switching the role a session acts with, as switching its organization: the session keeps it, and its tokens carry it
+* alone (see `narrowClaims`), so the API, the views and the menu follow it. The user keeps the last one chosen, for
+* their next session. Better Auth's admin endpoints refuse a superuser acting with another role.
+*/
+const rolesPlugin = ({ definitions }) => ({
+	id: "protobase-roles",
+	schema: {
+		session: { fields: { activeRole: {
+			type: "string",
+			required: false,
+			input: false,
+			fieldName: "active_role"
+		} } },
+		user: { fields: { lastRole: {
+			type: "string",
+			required: false,
+			input: false,
+			fieldName: "last_role"
+		} } }
+	},
+	endpoints: {
+		/** `GET /role/current`: the role the session acts with, and the roles held there with their labels to switch to. */
+		currentRole: createAuthEndpoint("/role/current", {
+			method: "GET",
+			use: [sessionMiddleware]
+		}, async (ctx) => {
+			const { held, active } = await sessionRoles(ctx.context, ctx.context.session);
+			return ctx.json({
+				active: active ?? null,
+				roles: held.map((name) => ({
+					name,
+					label: definitions.labels[name] ?? name
+				}))
+			});
+		}),
+		/** `POST /role/switch` with `{ role }`, one the person holds where the session works: its next token carries that role alone. */
+		switchRole: createAuthEndpoint("/role/switch", {
+			method: "POST",
+			use: [sessionMiddleware],
+			body: z$1.object({ role: z$1.string().min(1) })
+		}, async (ctx) => {
+			const { user, session } = ctx.context.session;
+			const { held } = await sessionRoles(ctx.context, ctx.context.session);
+			if (!held.includes(ctx.body.role)) throw new APIError("FORBIDDEN", {
+				code: "ROLE_NOT_HELD",
+				message: "You do not hold this role."
+			});
+			await ctx.context.internalAdapter.updateSession(session.token, { activeRole: ctx.body.role });
+			await ctx.context.internalAdapter.updateUser(user.id, { lastRole: ctx.body.role });
+			return ctx.json({ role: ctx.body.role });
+		})
+	},
+	hooks: { before: [{
+		matcher: (ctx) => ctx.path?.startsWith("/admin/") ?? false,
+		handler: createAuthMiddleware(async (ctx) => {
+			const session = await getSessionFromCtx(ctx);
+			if (!session) return;
+			const { held, active } = await sessionRoles(ctx.context, session);
+			if (held.includes("admin") && active !== "admin") throw new APIError("FORBIDDEN", {
+				code: "ADMIN_ONLY",
+				message: "Switch to the admin role to manage users."
+			});
+		})
+	}] }
+});
+//#endregion
+export { rolesPlugin };

package/dist/better-auth/roles/session-role.js

@@ -0,0 +1,28 @@
+import { parseRoles } from "../parse-roles.js";
+import { effectiveRoles, globalRoles } from "../organizations/app-roles.js";
+import { findMember } from "../organizations/store.js";
+import { resolveActiveRole } from "./active-role.js";
+//#region src/better-auth/roles/session-role.ts
+/**
+* The roles someone holds where the session works: their roles, or with organizations their global roles and then
+* their app roles as a member of the active organization.
+*/
+const heldRoles = async (context, user, session) => {
+	if (!context.hasPlugin("organization")) return parseRoles(user.role);
+	const organizationId = session.activeOrganizationId;
+	const member = organizationId ? await findMember(context.adapter, {
+		organizationId,
+		userId: user.id
+	}) : void 0;
+	return effectiveRoles(globalRoles(user.role), member?.appRoles);
+};
+/** The roles held and the one the session acts with, as its next token carries it. */
+const sessionRoles = async (context, { user, session }) => {
+	const held = await heldRoles(context, user, session);
+	return {
+		held,
+		active: resolveActiveRole(held, [session.activeRole, user.lastRole])
+	};
+};
+//#endregion
+export { heldRoles, sessionRoles };

package/dist/better-auth/staff-sign-in-endpoints.js

@@ -36,8 +36,15 @@ const withError = (url, code) => {
 * them). The session is short and never extended, and the person's two-factor and passkey requirements do not stop it.
 */
 const staffSignInEndpoints = ({ operator, mailer }) => {
-	let client;
-	const clientOf = (context) => client ??= operatorClient(operator, `${context.baseURL}/staff/callback`);
+	const clients = /* @__PURE__ */ new Map();
+	const clientOf = (context) => {
+		const callback = `${context.baseURL}/staff/callback`;
+		const found = clients.get(callback);
+		if (found) return found;
+		const client = operatorClient(operator, callback);
+		clients.set(callback, client);
+		return client;
+	};
 	const startSession = async (ctx, started, claims) => {
 		const refusal = staffClaimsRefusal(claims, {
 			group: operator.group,

package/dist/better-auth/status-route.js

@@ -1,6 +1,7 @@
 import { membershipRoles } from "./organizations/role-definitions.js";
 import { effectiveSignInPolicy } from "./sign-in-policy.js";
 import { readSignInPolicy } from "./policy-store.js";
+import { signInPasskeyDomains } from "./passkey-domain.js";
 import { hasUsers } from "./users.js";
 import { Hono } from "hono";
 //#region src/better-auth/status-route.ts
@@ -10,7 +11,8 @@ import { Hono } from "hono";
 * only those; `passwordReset` when reset mail can be sent and passwords are on, so it offers "Forgot password?" only
 * then; the ids of the `socialProviders` people can sign in with, so it offers "Continue with GitHub" when `github` is
 * one; `platformSignIn`, the id and name of the platform's provider when it is one of them; `staffSignIn`, the
-* operator provider's name, when staff can sign in as people; and with organizations, who may create them and the roles
+* operator provider's name, when staff can sign in as people; `passkeyDomains`, when people have passkeys for more than
+* one of the app's hosts, the RP IDs a passkey sign-in can ask for, the passkey domain first; and with organizations, who may create them and the roles
 * with their labels, `membership` for those a member can hold, and the roles each one's holders may also give.
 */
 const statusRoute = (auth) => {
@@ -27,6 +29,7 @@ const statusRoute = (auth) => {
 		const platform = auth.platformSignIn;
 		const platformSignIn = platform && policy.platformSignIn === "allowed" && context.socialProviders.some((provider) => provider.id === platform.provider) ? platform : void 0;
 		const socialProviders = [...auth.socialProviders, ...platformSignIn ? [platformSignIn.provider] : []];
+		const passkeyDomains = signInMethods.includes("passkey") ? await signInPasskeyDomains(context.adapter, auth.passkeyDomain, auth.origins) : [];
 		return c.json({
 			needsAdmin: !await hasUsers(auth),
 			signInMethods,
@@ -34,6 +37,7 @@ const statusRoute = (auth) => {
 			socialProviders,
 			...platformSignIn && { platformSignIn },
 			...staffSignIn && { staffSignIn },
+			...passkeyDomains.length > 1 && { passkeyDomains },
 			...auth.organizations && { organizations: {
 				create: auth.organizations.create,
 				roles: auth.roleDefinitions.names.map((name) => ({

package/dist/better-auth/tokens.d.ts

@@ -8,7 +8,8 @@ export type IssueTokenOptions = {
 export declare const maxTokenTtlSeconds: number;
 /**
  * Mints a bearer token for an existing user: signed with the JWT plugin's keys, same issuer, audience and claims
- * (`sub`, `email`, `role`) as `/api/auth/token`, so the API accepts it like a token from a browser session.
+ * (`sub`, `email`, `role`) as `/api/auth/token`, so the API accepts it like a token from a browser session. It carries
+ * the role the user last chose, else their first.
  * Host side only: there is no HTTP route for this.
  */
 export declare const issueToken: (auth: AdminAuth, options: IssueTokenOptions) => Promise<{

package/dist/better-auth/tokens.js

@@ -1,10 +1,12 @@
 import { parseRoles } from "./parse-roles.js";
+import { narrowClaims } from "./roles/active-role.js";
 //#region src/better-auth/tokens.ts
 const defaultTtlSeconds = 900;
 const maxTokenTtlSeconds = 86400;
 /**
 * Mints a bearer token for an existing user: signed with the JWT plugin's keys, same issuer, audience and claims
-* (`sub`, `email`, `role`) as `/api/auth/token`, so the API accepts it like a token from a browser session.
+* (`sub`, `email`, `role`) as `/api/auth/token`, so the API accepts it like a token from a browser session. It carries
+* the role the user last chose, else their first.
 * Host side only: there is no HTTP route for this.
 */
 const issueToken = async (auth, options) => {
@@ -21,12 +23,13 @@ const issueToken = async (auth, options) => {
 	if (!user) throw new Error(`No user with email ${options.email}`);
 	if (user.banned) throw new Error(`${options.email} is banned`);
 	const issuedAt = Math.floor(Date.now() / 1e3);
+	const { role } = narrowClaims({ role: parseRoles(user.role).join(",") }, [user.lastRole], Boolean(auth.organizations));
 	const { token } = await auth.api.signJWT({ body: { payload: {
 		iat: issuedAt,
 		exp: issuedAt + ttl,
 		sub: user.id,
 		email: user.email,
-		role: parseRoles(user.role).join(",")
+		role
 	} } });
 	return {
 		token,

package/dist/changes/actor.js

@@ -1,3 +1,5 @@
+import { runningJobs } from "../jobs/current.js";
+import { dispatchJobName } from "./capture-sql.js";
 //#region src/changes/actor.ts
 /** The setting a write transaction sets so the change capture records who wrote, when a resource has events. */
 const actorSettings = (deps, session) => {
@@ -8,5 +10,9 @@ const actorSettings = (deps, session) => {
 	};
 	return { [deps.actorSetting]: JSON.stringify(actor) };
 };
+/** After a write committed: has this process's dispatcher deliver its events now, rather than at its next poll. */
+const wakeDispatch = (deps) => {
+	if (deps.actorSetting) runningJobs()?.wake(dispatchJobName);
+};
 //#endregion
-export { actorSettings };
+export { actorSettings, wakeDispatch };

package/dist/changes/capture-schema.js

@@ -1,5 +1,5 @@
-import { changesSchema } from "./events-options.js";
 import { quoteIdent, tableSql } from "./capture-sql.js";
+import { changesSchema } from "./events-options.js";
 import { capturePlan, planSql, uncaptured } from "./capture-plan.js";
 import { sql } from "kysely";
 //#region src/changes/capture-schema.ts