@protobase/server 0.9.0 → 0.11.0

package/dist/better-auth/operator-provider.d.ts

@@ -1,7 +1,8 @@
 //#region src/better-auth/operator-provider.d.ts
 /**
  * The identity provider the operator's staff sign in with to sign in as people of this app: any OpenID Connect
- * provider, with this app registered as a confidential client whose redirect URI is `{baseURL}/api/auth/staff/callback`.
+ * provider, with this app registered as a confidential client whose redirect URI is `{origin}/api/auth/staff/callback`,
+ * for `baseURL` and each of the app's other `origins`.
  */
 export type OperatorProvider = {
   /** The provider's issuer URL; its settings are read from `{issuer}/.well-known/openid-configuration`. */

package/dist/better-auth/origins.d.ts

@@ -0,0 +1,4 @@
+//#region src/better-auth/origins.d.ts
+/** Where browsers read which origins may use the app's passkeys (WebAuthn Related Origin Requests). */
+export declare const webauthnPath = "/.well-known/webauthn";
+//#endregion

package/dist/better-auth/origins.js

@@ -0,0 +1,43 @@
+//#region src/better-auth/origins.ts
+const originsVariable = "PROTOBASE_ORIGINS";
+/** The comma-separated list in an environment variable, blanks left out; empty when it is unset. */
+const readList = (value) => (value ?? "").split(",").map((item) => item.trim()).filter(Boolean);
+/** The origins the platform passes in `PROTOBASE_ORIGINS`, comma separated; empty when it is unset. */
+const readOrigins = (env) => readList(env[originsVariable]);
+const originOf = (value, what) => {
+	if (!URL.canParse(value)) throw new Error(`${what} must be a URL such as https://admin.example.com, not "${value}"`);
+	const url = new URL(value);
+	if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error(`${what} must be an http or https URL, not "${value}"`);
+	return url;
+};
+/**
+* The origins the app is served on besides `baseURL`, as `https://host[:port]`, without `baseURL`'s own and without
+* repeats. Each must be a URL with the scheme of `baseURL`, since Better Auth builds every host's URLs with one scheme.
+*/
+const resolveOrigins = (baseURL, origins) => {
+	const base = originOf(baseURL, "baseURL");
+	const resolved = origins.map((origin) => {
+		const url = originOf(origin, `The origin "${origin}"`);
+		if (url.protocol !== base.protocol) throw new Error(`The origin "${origin}" must use ${base.protocol.slice(0, -1)}, like baseURL`);
+		return url.origin;
+	});
+	return [...new Set(resolved)].filter((origin) => origin !== base.origin);
+};
+/**
+* Better Auth's `baseURL` for an app on several origins: each request is answered for its own host when that is one of
+* them (its links, such as a password reset, and its passkey and sign-in callbacks then stay on that host), and for
+* `baseURL` otherwise. With no other origins it is `baseURL` itself.
+*/
+const multiHostBaseURL = (baseURL, origins) => {
+	if (origins.length === 0) return baseURL;
+	const base = new URL(baseURL);
+	return {
+		allowedHosts: [base.host, ...origins.map((origin) => new URL(origin).host)],
+		fallback: baseURL,
+		protocol: base.protocol === "https:" ? "https" : "http"
+	};
+};
+/** Where browsers read which origins may use the app's passkeys (WebAuthn Related Origin Requests). */
+const webauthnPath = "/.well-known/webauthn";
+//#endregion
+export { multiHostBaseURL, originsVariable, readList, readOrigins, resolveOrigins, webauthnPath };

package/dist/better-auth/passkey-domain.js

@@ -0,0 +1,41 @@
+//#region src/better-auth/passkey-domain.ts
+const passkeyDomainVariable = "PROTOBASE_PASSKEY_DOMAIN";
+/** The passkey domain the platform passes in `PROTOBASE_PASSKEY_DOMAIN`; `undefined` when it is unset. */
+const readPasskeyDomain = (env) => env["PROTOBASE_PASSKEY_DOMAIN"]?.trim() || void 0;
+/** The host names of the app's origins, which are the RP IDs its passkeys can have, without repeats. */
+const passkeyHosts = (origins) => [...new Set(origins.map((origin) => new URL(origin).hostname))];
+/**
+* The RP ID new passkeys get: `domain` when given, which must be the host of one of the app's origins, and otherwise
+* the host of the first, `baseURL`'s.
+*/
+const resolvePasskeyDomain = (domain, origins) => {
+	const hosts = passkeyHosts(origins);
+	if (domain === void 0) return hosts[0];
+	const host = domain.toLowerCase();
+	if (!hosts.includes(host)) throw new Error(`The passkey domain "${domain}" must be the host of one of the app's origins: ${hosts.join(", ")}`);
+	return host;
+};
+/**
+* The RP IDs a passkey sign-in may ask the browser for, which asks for one at a time: the passkey domain, then each
+* other host of the app that a passkey was made for (passkeys made before they kept their RP ID count for the host of
+* `baseURL`, the first). On one origin that is the passkey domain alone, read without a query.
+*/
+const signInPasskeyDomains = async (adapter, domain, origins) => {
+	const hosts = passkeyHosts(origins);
+	const others = hosts.filter((host) => host !== domain);
+	if (others.length === 0) return [domain];
+	const held = await Promise.all(others.map(async (host) => {
+		const where = (host === hosts[0] ? [host, null] : [host]).map((value) => ({
+			field: "rpID",
+			value,
+			connector: "OR"
+		}));
+		return await adapter.count({
+			model: "passkey",
+			where
+		}) > 0;
+	}));
+	return [domain, ...others.filter((_, index) => held[index])];
+};
+//#endregion
+export { passkeyDomainVariable, passkeyHosts, readPasskeyDomain, resolvePasskeyDomain, signInPasskeyDomains };

package/dist/better-auth/passkey-plugin.js

@@ -0,0 +1,151 @@
+import { pluginNames } from "./snake-case-names.js";
+import { APIError, createAuthEndpoint, getSessionFromCtx } from "better-auth/api";
+import { setSessionCookie } from "better-auth/cookies";
+import * as z$1 from "zod";
+import { PASSKEY_ERROR_CODES, passkey } from "@better-auth/passkey";
+import { generateAuthenticationOptions, verifyAuthenticationResponse } from "@simplewebauthn/server";
+import { generateRandomString } from "better-auth/crypto";
+//#region src/better-auth/passkey-plugin.ts
+const challengeCookie = "better-auth-passkey";
+const challengeSeconds = 300;
+const unknownDomain = {
+	code: "UNKNOWN_PASSKEY_DOMAIN",
+	message: "This app has no passkeys for that domain."
+};
+const decodeBase64 = (value) => Uint8Array.from(atob(value), (char) => char.charCodeAt(0));
+/**
+* Better Auth's passkeys, with an RP ID kept per passkey. New passkeys are made for the passkey domain; each keeps the
+* RP ID it was made with, so changing the passkey domain breaks none. A sign-in asks the browser for passkeys of one RP
+* ID, `?rpId=` or the passkey domain, and checks the passkey it gets against its own. On an app with several origins,
+* browsers let each origin use the passkeys of the others through `/.well-known/webauthn` (Related Origin Requests).
+*/
+const passkeyPlugin = ({ domain, hosts, formerDomain }) => {
+	const base = passkey({
+		schema: pluginNames.passkey,
+		rpID: domain
+	});
+	const rpIDOf = (stored) => stored.rpID ?? formerDomain;
+	/** `GET /passkey/generate-authenticate-options?rpId=`: what the browser needs to ask for a passkey of that RP ID. */
+	const generatePasskeyAuthenticationOptions = createAuthEndpoint("/passkey/generate-authenticate-options", {
+		method: "GET",
+		query: z$1.object({ rpId: z$1.string().optional() }).optional()
+	}, async (ctx) => {
+		const rpID = ctx.query?.rpId?.toLowerCase() ?? domain;
+		if (!hosts.includes(rpID)) throw new APIError("BAD_REQUEST", unknownDomain);
+		const session = await getSessionFromCtx(ctx);
+		const passkeys = (session ? await ctx.context.adapter.findMany({
+			model: "passkey",
+			where: [{
+				field: "userId",
+				value: session.user.id
+			}]
+		}) : []).filter((stored) => rpIDOf(stored) === rpID);
+		const options = await generateAuthenticationOptions({
+			rpID,
+			userVerification: "preferred",
+			...passkeys.length > 0 && { allowCredentials: passkeys.map((stored) => ({
+				id: stored.credentialID,
+				...stored.transports && { transports: stored.transports.split(",") }
+			})) }
+		});
+		const token = generateRandomString(32);
+		const cookie = ctx.context.createAuthCookie(challengeCookie);
+		await ctx.setSignedCookie(cookie.name, token, ctx.context.secret, {
+			...cookie.attributes,
+			maxAge: challengeSeconds
+		});
+		await ctx.context.internalAdapter.createVerificationValue({
+			identifier: token,
+			value: JSON.stringify({
+				type: "authentication",
+				expectedChallenge: options.challenge,
+				userData: { id: session?.user.id ?? "" }
+			}),
+			expiresAt: new Date(Date.now() + challengeSeconds * 1e3)
+		});
+		return ctx.json(options);
+	});
+	/** `POST /passkey/verify-authentication`: checks the browser's answer against the passkey's own RP ID and signs in. */
+	const verifyPasskeyAuthentication = createAuthEndpoint("/passkey/verify-authentication", {
+		method: "POST",
+		body: z$1.object({ response: z$1.record(z$1.any(), z$1.any()) })
+	}, async (ctx) => {
+		const origin = ctx.headers?.get("origin");
+		if (!origin) throw new APIError("BAD_REQUEST", { message: "origin missing" });
+		const response = ctx.body.response;
+		const cookie = ctx.context.createAuthCookie(challengeCookie);
+		const token = await ctx.getSignedCookie(cookie.name, ctx.context.secret);
+		if (!token) throw new APIError("BAD_REQUEST", PASSKEY_ERROR_CODES.CHALLENGE_NOT_FOUND);
+		const challenge = await ctx.context.internalAdapter.consumeVerificationValue(token);
+		if (!challenge) throw new APIError("BAD_REQUEST", PASSKEY_ERROR_CODES.CHALLENGE_NOT_FOUND);
+		const { type, expectedChallenge } = JSON.parse(challenge.value);
+		if (type !== "authentication") throw new APIError("BAD_REQUEST", PASSKEY_ERROR_CODES.CHALLENGE_NOT_FOUND);
+		const stored = await ctx.context.adapter.findOne({
+			model: "passkey",
+			where: [{
+				field: "credentialID",
+				value: response.id
+			}]
+		});
+		if (!stored) throw new APIError("UNAUTHORIZED", PASSKEY_ERROR_CODES.PASSKEY_NOT_FOUND);
+		const verification = await verifyAuthenticationResponse({
+			response,
+			expectedChallenge,
+			expectedOrigin: origin,
+			expectedRPID: rpIDOf(stored),
+			credential: {
+				id: stored.credentialID,
+				publicKey: decodeBase64(stored.publicKey),
+				counter: stored.counter,
+				...stored.transports && { transports: stored.transports.split(",") }
+			},
+			requireUserVerification: false
+		}).catch((error) => {
+			ctx.context.logger.error("Failed to verify the passkey", error);
+		});
+		if (!verification?.verified) throw new APIError("UNAUTHORIZED", PASSKEY_ERROR_CODES.AUTHENTICATION_FAILED);
+		await ctx.context.adapter.update({
+			model: "passkey",
+			where: [{
+				field: "id",
+				value: stored.id
+			}],
+			update: { counter: verification.authenticationInfo.newCounter }
+		});
+		const session = await ctx.context.internalAdapter.createSession(stored.userId);
+		if (!session) throw new APIError("INTERNAL_SERVER_ERROR", PASSKEY_ERROR_CODES.UNABLE_TO_CREATE_SESSION);
+		const user = await ctx.context.internalAdapter.findUserById(stored.userId);
+		if (!user) throw new APIError("INTERNAL_SERVER_ERROR", PASSKEY_ERROR_CODES.USER_NOT_FOUND);
+		await setSessionCookie(ctx, {
+			session,
+			user
+		});
+		return ctx.json({
+			session,
+			user
+		});
+	});
+	return {
+		...base,
+		endpoints: {
+			...base.endpoints,
+			generatePasskeyAuthenticationOptions,
+			verifyPasskeyAuthentication
+		},
+		schema: { passkey: {
+			...base.schema.passkey,
+			fields: {
+				...base.schema.passkey.fields,
+				rpID: {
+					type: "string",
+					required: false,
+					fieldName: "rp_id",
+					input: false,
+					defaultValue: () => domain
+				}
+			}
+		} }
+	};
+};
+//#endregion
+export { passkeyPlugin };

package/dist/better-auth/roles/active-role.js

@@ -0,0 +1,26 @@
+import { parseRoles } from "../parse-roles.js";
+import { noGlobalRole } from "../organizations/role-definitions.js";
+import { globalRoles } from "../organizations/app-roles.js";
+//#region src/better-auth/roles/active-role.ts
+/**
+* The one role someone acts with: the first of `wanted` they hold (the session's active role, then the one they last
+* chose), else the first role they hold. `undefined` for someone without a role.
+*/
+const resolveActiveRole = (held, wanted) => wanted.find((name) => typeof name === "string" && held.includes(name)) ?? held[0];
+/**
+* The claims narrowed to the active role (`resolveActiveRole`), so the token carries that role alone: in `role` when it
+* is held globally, in `app_roles` when held as a member, in both when both. Unchanged for someone without a role.
+*/
+const narrowClaims = (claims, wanted, organizations) => {
+	const global = organizations ? globalRoles(claims.role) : parseRoles(claims.role);
+	const membership = claims.app_roles ?? [];
+	const active = resolveActiveRole([.../* @__PURE__ */ new Set([...global, ...membership])], wanted);
+	if (active === void 0) return claims;
+	return {
+		...claims,
+		role: global.includes(active) ? active : noGlobalRole,
+		...claims.app_roles && { app_roles: membership.includes(active) ? [active] : [] }
+	};
+};
+//#endregion
+export { narrowClaims, resolveActiveRole };

package/dist/better-auth/roles/roles-plugin.js

@@ -0,0 +1,73 @@
+import "../organizations/role-definitions.js";
+import { sessionRoles } from "./session-role.js";
+import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
+import * as z$1 from "zod";
+//#region src/better-auth/roles/roles-plugin.ts
+/**
+* Switching the role a session acts with, as switching its organization: the session keeps it, and its tokens carry it
+* alone (see `narrowClaims`), so the API, the views and the menu follow it. The user keeps the last one chosen, for
+* their next session. Better Auth's admin endpoints refuse a superuser acting with another role.
+*/
+const rolesPlugin = ({ definitions }) => ({
+	id: "protobase-roles",
+	schema: {
+		session: { fields: { activeRole: {
+			type: "string",
+			required: false,
+			input: false,
+			fieldName: "active_role"
+		} } },
+		user: { fields: { lastRole: {
+			type: "string",
+			required: false,
+			input: false,
+			fieldName: "last_role"
+		} } }
+	},
+	endpoints: {
+		/** `GET /role/current`: the role the session acts with, and the roles held there with their labels to switch to. */
+		currentRole: createAuthEndpoint("/role/current", {
+			method: "GET",
+			use: [sessionMiddleware]
+		}, async (ctx) => {
+			const { held, active } = await sessionRoles(ctx.context, ctx.context.session);
+			return ctx.json({
+				active: active ?? null,
+				roles: held.map((name) => ({
+					name,
+					label: definitions.labels[name] ?? name
+				}))
+			});
+		}),
+		/** `POST /role/switch` with `{ role }`, one the person holds where the session works: its next token carries that role alone. */
+		switchRole: createAuthEndpoint("/role/switch", {
+			method: "POST",
+			use: [sessionMiddleware],
+			body: z$1.object({ role: z$1.string().min(1) })
+		}, async (ctx) => {
+			const { user, session } = ctx.context.session;
+			const { held } = await sessionRoles(ctx.context, ctx.context.session);
+			if (!held.includes(ctx.body.role)) throw new APIError("FORBIDDEN", {
+				code: "ROLE_NOT_HELD",
+				message: "You do not hold this role."
+			});
+			await ctx.context.internalAdapter.updateSession(session.token, { activeRole: ctx.body.role });
+			await ctx.context.internalAdapter.updateUser(user.id, { lastRole: ctx.body.role });
+			return ctx.json({ role: ctx.body.role });
+		})
+	},
+	hooks: { before: [{
+		matcher: (ctx) => ctx.path?.startsWith("/admin/") ?? false,
+		handler: createAuthMiddleware(async (ctx) => {
+			const session = await getSessionFromCtx(ctx);
+			if (!session) return;
+			const { held, active } = await sessionRoles(ctx.context, session);
+			if (held.includes("admin") && active !== "admin") throw new APIError("FORBIDDEN", {
+				code: "ADMIN_ONLY",
+				message: "Switch to the admin role to manage users."
+			});
+		})
+	}] }
+});
+//#endregion
+export { rolesPlugin };

package/dist/better-auth/roles/session-role.js

@@ -0,0 +1,28 @@
+import { parseRoles } from "../parse-roles.js";
+import { effectiveRoles, globalRoles } from "../organizations/app-roles.js";
+import { findMember } from "../organizations/store.js";
+import { resolveActiveRole } from "./active-role.js";
+//#region src/better-auth/roles/session-role.ts
+/**
+* The roles someone holds where the session works: their roles, or with organizations their global roles and then
+* their app roles as a member of the active organization.
+*/
+const heldRoles = async (context, user, session) => {
+	if (!context.hasPlugin("organization")) return parseRoles(user.role);
+	const organizationId = session.activeOrganizationId;
+	const member = organizationId ? await findMember(context.adapter, {
+		organizationId,
+		userId: user.id
+	}) : void 0;
+	return effectiveRoles(globalRoles(user.role), member?.appRoles);
+};
+/** The roles held and the one the session acts with, as its next token carries it. */
+const sessionRoles = async (context, { user, session }) => {
+	const held = await heldRoles(context, user, session);
+	return {
+		held,
+		active: resolveActiveRole(held, [session.activeRole, user.lastRole])
+	};
+};
+//#endregion
+export { heldRoles, sessionRoles };

package/dist/better-auth/staff-sign-in-endpoints.js

@@ -36,8 +36,15 @@ const withError = (url, code) => {
 * them). The session is short and never extended, and the person's two-factor and passkey requirements do not stop it.
 */
 const staffSignInEndpoints = ({ operator, mailer }) => {
-	let client;
-	const clientOf = (context) => client ??= operatorClient(operator, `${context.baseURL}/staff/callback`);
+	const clients = /* @__PURE__ */ new Map();
+	const clientOf = (context) => {
+		const callback = `${context.baseURL}/staff/callback`;
+		const found = clients.get(callback);
+		if (found) return found;
+		const client = operatorClient(operator, callback);
+		clients.set(callback, client);
+		return client;
+	};
 	const startSession = async (ctx, started, claims) => {
 		const refusal = staffClaimsRefusal(claims, {
 			group: operator.group,

package/dist/better-auth/status-route.js

@@ -1,6 +1,7 @@
 import { membershipRoles } from "./organizations/role-definitions.js";
 import { effectiveSignInPolicy } from "./sign-in-policy.js";
 import { readSignInPolicy } from "./policy-store.js";
+import { signInPasskeyDomains } from "./passkey-domain.js";
 import { hasUsers } from "./users.js";
 import { Hono } from "hono";
 //#region src/better-auth/status-route.ts
@@ -10,7 +11,8 @@ import { Hono } from "hono";
 * only those; `passwordReset` when reset mail can be sent and passwords are on, so it offers "Forgot password?" only
 * then; the ids of the `socialProviders` people can sign in with, so it offers "Continue with GitHub" when `github` is
 * one; `platformSignIn`, the id and name of the platform's provider when it is one of them; `staffSignIn`, the
-* operator provider's name, when staff can sign in as people; and with organizations, who may create them and the roles
+* operator provider's name, when staff can sign in as people; `passkeyDomains`, when people have passkeys for more than
+* one of the app's hosts, the RP IDs a passkey sign-in can ask for, the passkey domain first; and with organizations, who may create them and the roles
 * with their labels, `membership` for those a member can hold, and the roles each one's holders may also give.
 */
 const statusRoute = (auth) => {
@@ -27,6 +29,7 @@ const statusRoute = (auth) => {
 		const platform = auth.platformSignIn;
 		const platformSignIn = platform && policy.platformSignIn === "allowed" && context.socialProviders.some((provider) => provider.id === platform.provider) ? platform : void 0;
 		const socialProviders = [...auth.socialProviders, ...platformSignIn ? [platformSignIn.provider] : []];
+		const passkeyDomains = signInMethods.includes("passkey") ? await signInPasskeyDomains(context.adapter, auth.passkeyDomain, auth.origins) : [];
 		return c.json({
 			needsAdmin: !await hasUsers(auth),
 			signInMethods,
@@ -34,6 +37,7 @@ const statusRoute = (auth) => {
 			socialProviders,
 			...platformSignIn && { platformSignIn },
 			...staffSignIn && { staffSignIn },
+			...passkeyDomains.length > 1 && { passkeyDomains },
 			...auth.organizations && { organizations: {
 				create: auth.organizations.create,
 				roles: auth.roleDefinitions.names.map((name) => ({

package/dist/better-auth/tokens.d.ts

@@ -8,7 +8,8 @@ export type IssueTokenOptions = {
 export declare const maxTokenTtlSeconds: number;
 /**
  * Mints a bearer token for an existing user: signed with the JWT plugin's keys, same issuer, audience and claims
- * (`sub`, `email`, `role`) as `/api/auth/token`, so the API accepts it like a token from a browser session.
+ * (`sub`, `email`, `role`) as `/api/auth/token`, so the API accepts it like a token from a browser session. It carries
+ * the role the user last chose, else their first.
  * Host side only: there is no HTTP route for this.
  */
 export declare const issueToken: (auth: AdminAuth, options: IssueTokenOptions) => Promise<{

package/dist/better-auth/tokens.js

@@ -1,10 +1,12 @@
 import { parseRoles } from "./parse-roles.js";
+import { narrowClaims } from "./roles/active-role.js";
 //#region src/better-auth/tokens.ts
 const defaultTtlSeconds = 900;
 const maxTokenTtlSeconds = 86400;
 /**
 * Mints a bearer token for an existing user: signed with the JWT plugin's keys, same issuer, audience and claims
-* (`sub`, `email`, `role`) as `/api/auth/token`, so the API accepts it like a token from a browser session.
+* (`sub`, `email`, `role`) as `/api/auth/token`, so the API accepts it like a token from a browser session. It carries
+* the role the user last chose, else their first.
 * Host side only: there is no HTTP route for this.
 */
 const issueToken = async (auth, options) => {
@@ -21,12 +23,13 @@ const issueToken = async (auth, options) => {
 	if (!user) throw new Error(`No user with email ${options.email}`);
 	if (user.banned) throw new Error(`${options.email} is banned`);
 	const issuedAt = Math.floor(Date.now() / 1e3);
+	const { role } = narrowClaims({ role: parseRoles(user.role).join(",") }, [user.lastRole], Boolean(auth.organizations));
 	const { token } = await auth.api.signJWT({ body: { payload: {
 		iat: issuedAt,
 		exp: issuedAt + ttl,
 		sub: user.id,
 		email: user.email,
-		role: parseRoles(user.role).join(",")
+		role
 	} } });
 	return {
 		token,

package/dist/check-shell.js

@@ -1,4 +1,4 @@
-import { navRecentErrors } from "@protobase/schema";
+import { bottomBarErrors, navRecentErrors } from "@protobase/schema";
 //#region src/check-shell.ts
 /** Fails at startup when a sidebar group or a user menu entry does not fit the resources, instead of on the first page load. */
 const checkShell = (registry, views, userMenu, pages = []) => {
@@ -13,5 +13,14 @@ const checkShell = (registry, views, userMenu, pages = []) => {
 		if (item.kind === "page" && !pages.includes(item.page)) throw new Error(`User menu: page "${item.page}" does not exist`);
 	}
 };
+/** Fails at startup when a bottom bar names a resource, page or role the app does not have, or bars share a role. */
+const checkBottomBars = (registry, bars, pages, roles) => {
+	const errors = bottomBarErrors(bars, {
+		resources: registry.entries.map((entry) => entry.name),
+		pages,
+		...roles && { roles }
+	});
+	if (errors.length > 0) throw new Error(errors.join("; "));
+};
 //#endregion
-export { checkShell };
+export { checkBottomBars, checkShell };

package/dist/check-views.js

@@ -1,5 +1,7 @@
 import { relatedErrors } from "./view-related.js";
+import { addressErrors, addressPlaceholders, appHrefError, displayFields, fieldRefsIn, hrefPlaceholders } from "@protobase/schema";
 //#region src/check-views.ts
+const linkFields = (run) => run?.kind !== "link" ? [] : "to" in run ? addressPlaceholders(run.to) : hrefPlaceholders(run.href);
 const sensitiveErrors = (view, model) => {
 	const sensitive = (name) => Boolean(model.fields[name]?.sensitive);
 	return [
@@ -10,11 +12,12 @@ const sensitiveErrors = (view, model) => {
 			...(view.list?.sort ?? []).map(([name]) => name),
 			...view.list?.search ?? []
 		]],
+		["a list display", (view.list?.displays ?? []).flatMap(displayFields)],
 		["a filter", view.filters.map((widget) => widget.field)],
 		["the chart", view.chart ? [view.chart.field] : []],
 		["the sidebar", view.layout.flatMap((item) => item.kind === "sidebar" ? item.fields : [])],
 		["the recent records", view.nav?.recent ? [view.nav.recent.status] : []],
-		["an action", view.actions.flatMap((action) => action.run?.kind === "update" ? Object.keys(action.run.values) : action.run?.kind === "link" ? [...action.run.href.matchAll(/\{(\w+)\}/g)].map((match) => match[1]) : [])]
+		["an action", view.actions.flatMap((action) => action.run?.kind === "update" ? Object.keys(action.run.values) : linkFields(action.run))]
 	].flatMap(([place, names]) => [...new Set(names.filter(sensitive))].map((name) => `sensitive field "${name}" cannot be in ${place}`));
 };
 const valueLabelErrors = (view, model) => Object.entries(view.fields).flatMap(([name, hints]) => {
@@ -23,20 +26,40 @@ const valueLabelErrors = (view, model) => Object.entries(view.fields).flatMap(([
 	if (field?.type !== "enum") return [`value labels of "${name}" need an enum field`];
 	return Object.keys(hints.valueLabels).filter((value) => !field.enumValues?.includes(value)).map((value) => `value label "${value}" is not a value of "${name}"`);
 });
+const linkErrors = (view, model, models, pages) => view.actions.flatMap(({ name, run }) => {
+	if (run?.kind !== "link") return [];
+	if ("href" in run) {
+		const error = appHrefError(run.href);
+		return error ? [`action "${name}": ${error}`] : [];
+	}
+	return addressErrors(run.to, {
+		models,
+		pages,
+		source: model
+	}).map((error) => `action "${name}": ${error}`);
+});
+const unknownFieldErrors = (view, model) => {
+	const unknown = (names, what) => names.filter((name) => !Object.hasOwn(model.fields, name)).map((name) => `${what} names field "${name}", which ${model.name} does not have`);
+	return [...(view.list?.displays ?? []).flatMap((display) => unknown(displayFields(display), `display "${display.name}"`)), ...view.layout.flatMap((item) => item.kind === "custom" ? unknown(fieldRefsIn(item.props), `custom section ${item.component}`) : [])];
+};
 /**
-* Fails at startup when a view uses a sensitive field where it would show empty, labels values its enum does not have,
-* or has a related section that does not fit the resources.
+* Fails at startup when a view uses a sensitive field where it would show empty, a display or custom section names a
+* field the resource does not have, labels values its enum does not have,
+* has a related section that does not fit the resources, or a link to an address the app does not have.
 */
-const checkViews = (registry, views) => {
+const checkViews = (registry, views, pages = []) => {
 	const models = Object.fromEntries(registry.entries.map((entry) => [entry.name, entry.model]));
+	const pageNames = new Set(pages);
 	const problems = views.flatMap((view) => {
 		const model = models[view.resource];
 		if (!model) return [];
 		const related = view.layout.flatMap((item) => item.kind === "related" ? relatedErrors(item, view.resource, models).map((error) => `related "${item.title}": ${error}`) : []);
 		return [
 			...sensitiveErrors(view, model),
+			...unknownFieldErrors(view, model),
 			...valueLabelErrors(view, model),
-			...related
+			...related,
+			...linkErrors(view, model, models, pageNames)
 		].map((problem) => `View "${view.resource}": ${problem}`);
 	});
 	if (problems.length > 0) throw new Error(`The views do not match the resources:\n${problems.map((problem) => `  - ${problem}`).join("\n")}`);

package/dist/create-admin.d.ts

@@ -8,7 +8,7 @@ import { FilesOptions } from "./files/options.js";
 import { ResourceSource } from "./resource-source.js";
 import { FunctionSource } from "./functions/define-function.js";
 import { AdminOptions } from "./admin-options.js";
-import { UserMenuSource } from "@protobase/schema";
+import { BottomBarSource, UserMenuSource } from "@protobase/schema";
 import { Db } from "@protobase/query";
 //#region src/create-admin.d.ts
 export type CreateAdminInput = {
@@ -16,6 +16,8 @@ export type CreateAdminInput = {
   views?: ViewSource[];
   /** The `userMenu(...)` export of the config module: pages under the signed-in user in the sidebar. */
   userMenu?: UserMenuSource;
+  /** The `bottomBar(...)` exports of the config module, in order: tabs on phones for the roles each names. */
+  bottomBars?: BottomBarSource[];
   /** Composed pages (`page()` from @protobase/layout), served by /meta and checked against the resources here. */
   pages?: PageSource[];
   db: Db;
@@ -28,7 +30,7 @@ export type CreateAdminInput = {
   files?: FilesOptions;
   /** Where the changes that resources' events are raised from are captured (see `EventsOptions`). */
   events?: EventsOptions;
-  /** The app's jobs (see `defineJob`): with any, or a resource with events, admins get the failed jobs page (`failedJobs`). */
+  /** The app's jobs (see `defineJob`): with any, or a resource with events, admins get the failed jobs page (`failed_jobs`). */
   jobs?: JobDefinition[];
   /** Where the resources' events are delivered (`subscription(...)` exports of the config module). */
   subscriptions?: SubscriptionDefinition[];
@@ -37,5 +39,5 @@ export type CreateAdminInput = {
   options?: AdminOptions;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, db, authenticate, auth, functions, files: filesOptions, events, jobs, subscriptions, webhooks: webhooksOptions, options }: CreateAdminInput) => Admin;
+export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, files: filesOptions, events, jobs, subscriptions, webhooks: webhooksOptions, options }: CreateAdminInput) => Admin;
 //#endregion