@rebasepro/app 0.21.2-canary.g1ea48be → 0.23.0

package/dist/auth/session_caches.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Empty every module-level cache that holds data read as the signed-in user:
+ * fetched records, each table's scroll position and the rows kept with it,
+ * edits parked for a layout handoff, and resolved display values (the titles
+ * on relation chips and breadcrumbs).
+ *
+ * All of them are keyed by path and id only, with no user in the key, and the
+ * views seed their first render from them — so without this the next user to
+ * sign in to the tab is shown what the last one could read. Called by both auth
+ * controllers on `SIGNED_OUT`.
+ *
+ * The local-changes backup is not cleared here: a sign-out is also how a
+ * rejected refresh token ends a session, and the backup exists for that user
+ * coming back. {@link bindSessionCachesToUser} drops it when somebody else
+ * signs in instead.
+ */
+export declare function clearSessionCaches(): void;
+/**
+ * Record that the tab now acts as `userId`. When that is not who the caches
+ * were filled for, everything goes — the session caches, and the drafts the
+ * other user left in the local-changes backup.
+ *
+ * Call it before the new user is rendered: the views read these caches in
+ * their first render, before any effect of the auth controller would run.
+ */
+export declare function bindSessionCachesToUser(userId: string): void;

package/dist/auth/types.d.ts

@@ -36,6 +36,8 @@ export type RebaseAuthController = AuthController & {
     forgotPassword: (email: string) => Promise<void>;
     /** Reset password using token from email */
     resetPassword: (token: string, password: string) => Promise<void>;
+    /** Confirm an email address using the token from a verification email */
+    verifyEmail: (token: string) => Promise<void>;
     /** Change password for authenticated user */
     changePassword: (oldPassword: string, newPassword: string) => Promise<void>;
     /** Update user profile */
@@ -52,6 +54,16 @@ export type RebaseAuthController = AuthController & {
     clearError: () => void;
     /** Set or clear the auth provider error */
     setAuthProviderError: (error: Error | null) => void;
+    /**
+     * Open a challenge to finish a sign-in refused with `MFA_REQUIRED`. See
+     * `AuthControllerExtended`. Absent when the client has no MFA support.
+     */
+    startMfaChallenge?: (mfaToken: string, factorId: string) => Promise<string>;
+    /**
+     * Answer that challenge; the user is signed in on success. Absent when
+     * the client has no MFA support.
+     */
+    verifyMfaChallenge?: (mfaToken: string, challengeId: string, code: string) => Promise<void>;
 };
 /**
  * Structural type for the subset of `client.auth` (from `@rebasepro/client`)
@@ -78,6 +90,8 @@ export interface ClientAuth {
     signInWithOAuth(providerId: string, payload: Record<string, unknown>): Promise<unknown>;
     resetPasswordForEmail(email: string): Promise<unknown>;
     resetPassword(token: string, password: string): Promise<unknown>;
+    /** Optional so a hand-built auth client need not implement it. */
+    verifyEmail?(token: string): Promise<unknown>;
     changePassword(oldPassword: string, newPassword: string): Promise<unknown>;
     updateUser(updates: {
         displayName?: string;
@@ -86,6 +100,22 @@ export interface ClientAuth {
     getSessions(): Promise<DeviceSession[]>;
     revokeSession(sessionId: string): Promise<unknown>;
     revokeAllSessions(): Promise<unknown>;
+    /**
+     * The challenge that finishes a sign-in refused with `MFA_REQUIRED`: both
+     * requests carry that refusal's `mfaToken`, and a verified one signs the
+     * user in. Optional so a hand-built auth client need not implement it;
+     * without it an account with a second factor cannot sign in here.
+     */
+    mfa?: {
+        challenge(factorId: string, options: {
+            mfaToken: string;
+        }): Promise<{
+            challengeId: string;
+        }>;
+        verifyChallenge(challengeId: string, code: string, options: {
+            mfaToken: string;
+        }): Promise<unknown>;
+    };
 }
 /**
  * Props for useRebaseAuthController hook

package/dist/collections/entity-display-cache.d.ts

@@ -16,6 +16,7 @@ import type { EntityDisplayRole } from "@rebasepro/cms-types";
 export type EntityDisplayKey = string;
 /** The identity of one role of one record, as a cache key. */
 export declare function entityDisplayKey(path: string, entityId: string | number | undefined, role: EntityDisplayRole): EntityDisplayKey;
+export declare function getSharedEntityDisplayCache(): EntityDisplayCache;
 export declare class EntityDisplayCache {
     private readonly entries;
     private readonly listeners;

package/dist/components/LoginView/email-link.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The links the backend puts in its auth emails, as the login view reads them.
+ *
+ * The server builds them from the configured frontend URL:
+ * `<frontend>/reset-password?token=…` for a forgotten password, an admin's
+ * "send reset email" and every invitation, and `<frontend>/verify-email?token=…`
+ * to confirm an address. The frontend URL may carry a base path (`/admin`), so
+ * the action is the *last* path segment, not the whole path.
+ */
+export type EmailLinkAction = {
+    kind: "reset-password";
+    token: string;
+} | {
+    kind: "verify-email";
+    token: string;
+};
+export declare function readEmailLinkAction(location: {
+    pathname: string;
+    search: string;
+}): EmailLinkAction | null;
+/**
+ * Where the app lives: the link's own address without the action segment and
+ * its token. `/admin/reset-password?token=…` becomes `/admin/`.
+ */
+export declare function appAddressOfEmailLink(location: {
+    origin: string;
+    pathname: string;
+}): string;

package/dist/components/LoginView/mfa-required.d.ts

@@ -0,0 +1,33 @@
+import type { AuthControllerExtended, MfaFactorSummary } from "@rebasepro/cms-types";
+/**
+ * A sign-in that is waiting for its second factor.
+ *
+ * The server refuses the first factor of an account with MFA enrolled with
+ * `401 MFA_REQUIRED`, and puts in `details` what the second step needs: a
+ * pending token, good for five minutes and for the two challenge routes only,
+ * and the factors the account can answer with.
+ */
+export interface PendingMfaSignIn {
+    mfaToken: string;
+    factors: MfaFactorSummary[];
+}
+/**
+ * The pending sign-in an `MFA_REQUIRED` refusal describes, or `null` for any
+ * other error — including an `MFA_REQUIRED` without the token or a factor to
+ * answer with, which no code step could finish.
+ */
+export declare function readMfaRequired(error: unknown): PendingMfaSignIn | null;
+/** Whether this controller can take a sign-in through its second step. */
+export declare function canAnswerMfa(authController: AuthControllerExtended): boolean;
+/**
+ * What a refused challenge means for the code step.
+ *
+ * - `invalid-code`: the code was wrong; the same challenge takes another.
+ * - `exhausted`: the challenge has had its five attempts; the next code needs
+ *   a new one.
+ * - `expired`: the sign-in itself is over. The pending token lasts five
+ *   minutes from the password, and once it has lapsed both routes refuse the
+ *   caller as unauthenticated; a challenge that lapsed, or a sign-in revoked
+ *   meanwhile, ends the same way. Only a new sign-in gets a new token.
+ */
+export declare function classifyMfaRefusal(error: unknown): "invalid-code" | "exhausted" | "expired" | "other";

package/dist/components/common/useDataTableController.d.ts

@@ -42,4 +42,4 @@ export type DataTableControllerProps<M extends Record<string, any> = any> = {
  * @param fixedFilterFromProps
  * @param updateUrl
  */
-export declare function useDataTableController<M extends Record<string, any> = any, USER extends User = User>({ path, collection, scrollRestoration, entitiesDisplayedFirst, lastDeleteTimestamp: _lastDeleteTimestamp, fixedFilter: fixedFilterFromProps, updateUrl }: DataTableControllerProps<M>): EntityTableController<M>;
+export declare function useDataTableController<M extends Record<string, any> = any, USER extends User = User>({ path, collection, scrollRestoration, entitiesDisplayedFirst, lastDeleteTimestamp, fixedFilter: fixedFilterFromProps, updateUrl }: DataTableControllerProps<M>): EntityTableController<M>;

package/dist/components/common/useScrollRestoration.d.ts

@@ -1,4 +1,11 @@
 import { Entity, FilterValues } from "@rebasepro/types";
+/**
+ * Forget every collection's scroll position and the rows kept with it.
+ *
+ * The rows are what the signed-in user was allowed to read, and a table seeds
+ * its first render from them, so they must not outlive that user's session.
+ */
+export declare function clearCollectionScrollCache(): void;
 export type ScrollRestorationController = {
     getCollectionScroll: (path: string, filters?: FilterValues<any>) => {
         scrollOffset: number;

package/dist/core/PluginLifecycleManager.d.ts

@@ -2,16 +2,24 @@ import type { RebasePlugin, RebaseContext } from "@rebasepro/cms-types";
 /**
  * Render-less component that manages plugin lifecycle hooks.
  *
- * - Calls `lifecycle.onMount(context)` when plugins mount.
- * - Calls `lifecycle.onUnmount()` when plugins unmount.
- * - Subscribes to auth state changes and calls `lifecycle.onAuthStateChange`.
+ * - Calls `lifecycle.onMount(context)` once, the first time auth is ready.
+ * - Calls `lifecycle.onAuthStateChange(user)` on every change of user after
+ *   that — `null` on sign-out, the new user on the next sign-in.
+ * - Calls `lifecycle.onUnmount()` when the Rebase tree unmounts.
+ *
+ * Mounted for as long as there are plugins, signed in or not. It used to be
+ * mounted only while a user was signed in, so a sign-out unmounted it and the
+ * next sign-in mounted a fresh one — `onAuthStateChange` could never see the
+ * user change, and never fired.
  *
  * Mount this component inside the Rebase tree, below PluginProviderStack,
  * so that the RebaseContext is fully available.
  *
  * @internal
  */
-export declare function PluginLifecycleManager({ plugins, context }: {
+export declare function PluginLifecycleManager({ plugins, context, authReady }: {
     plugins: RebasePlugin[];
     context: RebaseContext;
+    /** Signed in, or sign-in skipped: what `onMount` waits for. */
+    authReady: boolean;
 }): null;

package/dist/hooks/data/useStableFilterValues.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The same filter object for as long as its contents stay the same.
+ *
+ * Callers write filters inline — the hooks guide does — so every render hands
+ * a data hook a new object. Used as an effect dependency by identity, that
+ * re-subscribed on every render, and every delivery rendered again: a
+ * subscribe loop against the server for as long as the component was mounted.
+ */
+export declare function useStableFilterValues<T>(filterValues: T): T;