@rebasepro/app 0.22.0 → 0.24.0

package/dist/auth/api.d.ts

@@ -8,7 +8,7 @@
  * here is the unauthenticated `/api/auth/config` probe used to detect
  * bootstrap mode and enabled providers before a session exists.
  */
-import type { AuthAdapterCapabilities } from "@rebasepro/types";
+import type { AuthConfigDocument } from "@rebasepro/types";
 /**
  * What `GET /api/auth/config` answers.
  *
@@ -17,7 +17,7 @@ import type { AuthAdapterCapabilities } from "@rebasepro/types";
  * this one listed an `emailServiceEnabled` flag no backend sends, and marked as
  * optional fields every backend always returns.
  */
-export type AuthConfigResponse = AuthAdapterCapabilities;
+export type AuthConfigResponse = AuthConfigDocument;
 /**
  * Cache container for `fetchAuthConfig` — holds both the inflight promise
  * (to deduplicate concurrent calls) and the cached result.

package/dist/auth/session_caches.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Empty every module-level cache that holds data read as the signed-in user:
+ * fetched records, each table's scroll position and the rows kept with it,
+ * edits parked for a layout handoff, and resolved display values (the titles
+ * on relation chips and breadcrumbs).
+ *
+ * All of them are keyed by path and id only, with no user in the key, and the
+ * views seed their first render from them — so without this the next user to
+ * sign in to the tab is shown what the last one could read. Called by both auth
+ * controllers on `SIGNED_OUT`.
+ *
+ * The local-changes backup is not cleared here: a sign-out is also how a
+ * rejected refresh token ends a session, and the backup exists for that user
+ * coming back. {@link bindSessionCachesToUser} drops it when somebody else
+ * signs in instead.
+ */
+export declare function clearSessionCaches(): void;
+/**
+ * Record that the tab now acts as `userId`. When that is not who the caches
+ * were filled for, everything goes — the session caches, and the drafts the
+ * other user left in the local-changes backup.
+ *
+ * Call it before the new user is rendered: the views read these caches in
+ * their first render, before any effect of the auth controller would run.
+ */
+export declare function bindSessionCachesToUser(userId: string): void;

package/dist/auth/types.d.ts

@@ -21,7 +21,14 @@ export type RebaseAuthController = AuthController & {
     /** Login with email and password */
     emailPasswordLogin: (email: string, password: string) => Promise<void>;
     /** Register a new user */
-    register: (email: string, password: string, displayName?: string) => Promise<void>;
+    /**
+     * Create an account. `confirmationRequired` when the backend registers
+     * confirm-first (`requireEmailVerification`): nobody is signed in until
+     * the address is confirmed.
+     */
+    register: (email: string, password: string, displayName?: string) => Promise<{
+        confirmationRequired: boolean;
+    }>;
     /** Skip login (for anonymous access if enabled) */
     skipLogin: () => void;
     /** Whether login was skipped */
@@ -36,8 +43,33 @@ export type RebaseAuthController = AuthController & {
     forgotPassword: (email: string) => Promise<void>;
     /** Reset password using token from email */
     resetPassword: (token: string, password: string) => Promise<void>;
+    /**
+     * Confirm an email address using the token from a verification email.
+     * Refused with `PROOF_REQUIRED` when the account holds a password this
+     * call does not prove: pass `password` to keep it (and sign in), or
+     * `removeUnproven` to verify without it.
+     */
+    verifyEmail: (token: string, options?: {
+        password?: string;
+        removeUnproven?: boolean;
+    }) => Promise<{
+        passwordRemoved: boolean;
+        signedIn: boolean;
+    }>;
+    /** Sign in with a magic link's token. Absent when the client cannot. */
+    magicLinkLogin?: (token: string) => Promise<void>;
     /** Change password for authenticated user */
     changePassword: (oldPassword: string, newPassword: string) => Promise<void>;
+    /** Ask to move the signed-in account to another address. Absent when the client cannot. */
+    changeEmail?: (newEmail: string) => Promise<{
+        pendingEmail: string;
+        expiresAt: string;
+    }>;
+    /** Follow an address-change link. Absent when the client cannot. */
+    confirmEmailChange?: (token: string) => Promise<{
+        email: string;
+        removedProviders: string[];
+    }>;
     /** Update user profile */
     updateProfile: (displayName?: string, photoURL?: string) => Promise<User>;
     /** Fetch active sessions */
@@ -52,6 +84,18 @@ export type RebaseAuthController = AuthController & {
     clearError: () => void;
     /** Set or clear the auth provider error */
     setAuthProviderError: (error: Error | null) => void;
+    /**
+     * Open a challenge to finish a sign-in refused with `MFA_REQUIRED`. See
+     * `AuthControllerExtended`. Absent when the client has no MFA support.
+     */
+    startMfaChallenge?: (mfaToken: string, factorId: string) => Promise<string>;
+    /**
+     * Answer that challenge; the user is signed in on success. Absent when
+     * the client has no MFA support.
+     */
+    verifyMfaChallenge?: (mfaToken: string, challengeId: string, code: string) => Promise<void>;
+    /** The scopes the signed-in user holds; `undefined` until known. */
+    heldScopes?: string[];
 };
 /**
  * Structural type for the subset of `client.auth` (from `@rebasepro/client`)
@@ -78,7 +122,24 @@ export interface ClientAuth {
     signInWithOAuth(providerId: string, payload: Record<string, unknown>): Promise<unknown>;
     resetPasswordForEmail(email: string): Promise<unknown>;
     resetPassword(token: string, password: string): Promise<unknown>;
+    /** Optional so a hand-built auth client need not implement it. */
+    verifyEmail?(token: string, options?: {
+        password?: string;
+        removeUnproven?: boolean;
+    }): Promise<unknown>;
     changePassword(oldPassword: string, newPassword: string): Promise<unknown>;
+    /** Optional so a hand-built auth client need not implement it. */
+    verifyMagicLink?(token: string): Promise<unknown>;
+    /** Optional so a hand-built auth client need not implement it. */
+    changeEmail?(newEmail: string): Promise<{
+        pendingEmail: string;
+        expiresAt: string;
+    }>;
+    /** Optional so a hand-built auth client need not implement it. */
+    confirmEmailChange?(token: string): Promise<{
+        email: string;
+        removedProviders: string[];
+    }>;
     updateUser(updates: {
         displayName?: string;
         photoURL?: string;
@@ -86,6 +147,22 @@ export interface ClientAuth {
     getSessions(): Promise<DeviceSession[]>;
     revokeSession(sessionId: string): Promise<unknown>;
     revokeAllSessions(): Promise<unknown>;
+    /**
+     * The challenge that finishes a sign-in refused with `MFA_REQUIRED`: both
+     * requests carry that refusal's `mfaToken`, and a verified one signs the
+     * user in. Optional so a hand-built auth client need not implement it;
+     * without it an account with a second factor cannot sign in here.
+     */
+    mfa?: {
+        challenge(factorId: string, options: {
+            mfaToken: string;
+        }): Promise<{
+            challengeId: string;
+        }>;
+        verifyChallenge(challengeId: string, code: string, options: {
+            mfaToken: string;
+        }): Promise<unknown>;
+    };
 }
 /**
  * Props for useRebaseAuthController hook
@@ -101,6 +178,12 @@ export interface RebaseAuthControllerProps {
             setAuthTokenGetter: (getter: () => Promise<string | null>) => void;
         };
         auth?: ClientAuth;
+        /** Read for the scopes the signed-in user holds (`GET /auth/scopes`). */
+        personalKeys?: {
+            listScopes(): Promise<{
+                held: string[];
+            }>;
+        };
     };
     /** Google OAuth client ID (optional, enables Google login) */
     googleClientId?: string;

package/dist/collections/entity-display-cache.d.ts

@@ -16,6 +16,7 @@ import type { EntityDisplayRole } from "@rebasepro/cms-types";
 export type EntityDisplayKey = string;
 /** The identity of one role of one record, as a cache key. */
 export declare function entityDisplayKey(path: string, entityId: string | number | undefined, role: EntityDisplayRole): EntityDisplayKey;
+export declare function getSharedEntityDisplayCache(): EntityDisplayCache;
 export declare class EntityDisplayCache {
     private readonly entries;
     private readonly listeners;

package/dist/collections/filter-operator-resolution.d.ts

@@ -55,3 +55,21 @@ export interface ResolveFilterOperatorsParams {
  * @group Models
  */
 export declare function resolveFilterOperators({ property, isArray, engine }: ResolveFilterOperatorsParams): WhereFilterOp[];
+/**
+ * Whether a property can be filtered at all — the one answer the table header
+ * and the filters dialog both give.
+ *
+ * They used to answer it with a predicate each, and disagreed: the header
+ * allowed an array only of strings, numbers, dates, references and relations;
+ * the dialog allowed an array of anything, and listed an array of maps with an
+ * empty control. The header, for its part, ignored both the developer's
+ * `filterOperators: []` and a custom `admin.Filter`.
+ *
+ * A property with a custom filter field is filterable: the developer owns that
+ * field. Otherwise it is filterable when at least one operator survives
+ * {@link resolveFilterOperators} — for an array, on its item type. A tuple
+ * array (`of: [a, b]`) has no single item type to filter by.
+ *
+ * @group Models
+ */
+export declare function isPropertyFilterable(property: Property, engine?: string): boolean;

package/dist/collections/navigation_utils.d.ts

@@ -13,8 +13,14 @@ export declare function resolveCollectionPathIds(path: string, allCollections: A
  */
 export declare function getCollectionBySlugWithin(slugOrPath: string, collections: AdminCollection[]): AdminCollection | undefined;
 /**
- * Get the subcollection combinations from a path:
- * "sites/es/locales" => ["sites/es/locales", "sites"]
+ * Every leading run of whole segments of a path, longest first: the
+ * candidates for the collection the path starts with.
+ * "sites/es/locales" => ["sites/es/locales", "sites/es", "sites"]
+ *
+ * Every length, not only the odd ones. A slug may contain slashes, so
+ * `content/podcasts/abc123/episodes` starts with the two-segment collection
+ * `content/podcasts`, and a path's own segment count says nothing about where
+ * its first collection ends.
  * @param subpaths
  */
 export declare function getCollectionPathsCombinations(subpaths: string[]): string[];

package/dist/collections/property_presentation.d.ts

@@ -3,23 +3,20 @@
  *
  * These read a property's admin block — `readOnly`, `disabled.hidden`, the
  * declarative `conditions` — and lived in `@rebasepro/common`, which is on the
- * backend's dependency path. Nothing in core ever called them: `isReadOnly` and
- * `isHidden` are used only by the panel, and `applyPropertyConditions` has no
- * production caller at all.
+ * backend's dependency path. Nothing in core ever called them: `isReadOnly`,
+ * `isHidden` and `applyPropertyConditions` are the panel's alone.
  *
- * That last one is worth knowing about rather than assuming: the collection editor
- * has a whole Conditions UI, `serializable_utils` persists what it writes, and
- * `BaseProperty.conditions` documents itself as "evaluated at runtime like property
- * builders" — but the evaluator below is reached only from its own tests. It lives
- * here because here is where it would be called from once it is wired up.
+ * `applyPropertyConditions` is called by the record form, through
+ * `resolveFormProperty`, both where a field is laid out and where the form is
+ * judged on save — so a rule the collection editor writes hides, disables and
+ * requires what it says it does, and a field it hides is not held against the
+ * save. Until that was wired, the evaluator was reached only from its own tests.
  *
- * The one part of `conditions` that *is* applied is the literal case:
- * `hidden`/`readOnly`/`disabled` stated as a plain boolean rather than as a rule.
- * A literal needs no context, so `isHidden`/`isReadOnly`/`isDisabled` can answer
- * it directly, and those three gates are consulted everywhere a field is laid
- * out. A *rule* still is not evaluated anywhere in production — the split is
- * deliberate, not an oversight: it is the difference between a condition that
- * needs an entity to be evaluated against and one that does not.
+ * A condition may also be a literal: `hidden`/`readOnly`/`disabled` stated as a
+ * plain boolean rather than as a rule. A literal needs no context, so
+ * `isHidden`/`isReadOnly`/`isDisabled` answer it directly, and those three
+ * gates are consulted everywhere a field is laid out — including places with
+ * no entity to evaluate a rule against.
  */
 import type { ConditionContext, Property } from "@rebasepro/types";
 export declare function isReadOnly(property: Property): boolean;

package/dist/components/ConnectionLostBanner.d.ts

@@ -0,0 +1,31 @@
+import React from "react";
+import type { RealtimeConnectionState } from "@rebasepro/types";
+/**
+ * The realtime connection's state, re-rendering on every change.
+ *
+ * `undefined` when there is no client, or it was built without realtime —
+ * there is no connection to describe.
+ *
+ * @group Hooks and utilities
+ */
+export declare function useRealtimeConnectionState(): RealtimeConnectionState | undefined;
+export interface ConnectionLostBannerProps {
+    className?: string;
+}
+/**
+ * Says that live updates have stopped, while they have.
+ *
+ * Shown once the realtime client reports the connection `disconnected`: the
+ * socket has been down for longer than a blip, so tables, boards and open
+ * records are showing what they last received and nothing else will arrive
+ * until it is back. They keep their data rather than turning into errors — this
+ * banner is how the user learns it may be out of date. It disappears by itself
+ * when the connection returns, and every live view then refreshes.
+ *
+ * A brief drop (`reconnecting`) shows nothing: a deploy blips every socket for
+ * a second or two, and a banner that flashes on each one teaches people to
+ * ignore it.
+ *
+ * @group Components
+ */
+export declare function ConnectionLostBanner({ className }: ConnectionLostBannerProps): React.JSX.Element | null;

package/dist/components/LoginView/email-link.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The links the backend puts in its auth emails, as the login view reads them.
+ *
+ * The server builds them from the configured frontend URL:
+ * `<frontend>/reset-password?token=…` for a forgotten password, an admin's
+ * "send reset email" and every invitation, `<frontend>/verify-email?token=…`
+ * to confirm an address, `<frontend>/confirm-email-change?token=…` to move an
+ * account to a new one, and `<frontend>/auth/magic-link?token=…` to sign in.
+ * The frontend URL may carry a base path (`/admin`), so the action is read off
+ * the *end* of the path, not the whole path.
+ */
+export type EmailLinkAction = {
+    kind: "reset-password";
+    token: string;
+} | {
+    kind: "verify-email";
+    token: string;
+} | {
+    kind: "confirm-email-change";
+    token: string;
+} | {
+    kind: "magic-link";
+    token: string;
+};
+export declare function readEmailLinkAction(location: {
+    pathname: string;
+    search: string;
+}): EmailLinkAction | null;
+/**
+ * Where the app lives: the link's own address without the action's path and
+ * its token. `/admin/reset-password?token=…` becomes `/admin/`, and
+ * `/admin/auth/magic-link?token=…` too.
+ */
+export declare function appAddressOfEmailLink(location: {
+    origin: string;
+    pathname: string;
+}): string;

package/dist/components/LoginView/index.d.ts

@@ -1,2 +1,4 @@
 export { LoginView } from "./LoginView.js";
 export type { LoginViewProps } from "./LoginView.js";
+export { readEmailLinkAction } from "./email-link.js";
+export type { EmailLinkAction } from "./email-link.js";

package/dist/components/LoginView/mfa-required.d.ts

@@ -0,0 +1,33 @@
+import type { AuthControllerExtended, MfaFactorSummary } from "@rebasepro/cms-types";
+/**
+ * A sign-in that is waiting for its second factor.
+ *
+ * The server refuses the first factor of an account with MFA enrolled with
+ * `401 MFA_REQUIRED`, and puts in `details` what the second step needs: a
+ * pending token, good for five minutes and for the two challenge routes only,
+ * and the factors the account can answer with.
+ */
+export interface PendingMfaSignIn {
+    mfaToken: string;
+    factors: MfaFactorSummary[];
+}
+/**
+ * The pending sign-in an `MFA_REQUIRED` refusal describes, or `null` for any
+ * other error — including an `MFA_REQUIRED` without the token or a factor to
+ * answer with, which no code step could finish.
+ */
+export declare function readMfaRequired(error: unknown): PendingMfaSignIn | null;
+/** Whether this controller can take a sign-in through its second step. */
+export declare function canAnswerMfa(authController: AuthControllerExtended): boolean;
+/**
+ * What a refused challenge means for the code step.
+ *
+ * - `invalid-code`: the code was wrong; the same challenge takes another.
+ * - `exhausted`: the challenge has had its five attempts; the next code needs
+ *   a new one.
+ * - `expired`: the sign-in itself is over. The pending token lasts five
+ *   minutes from the password, and once it has lapsed both routes refuse the
+ *   caller as unauthenticated; a challenge that lapsed, or a sign-in revoked
+ *   meanwhile, ends the same way. Only a new sign-in gets a new token.
+ */
+export declare function classifyMfaRefusal(error: unknown): "invalid-code" | "exhausted" | "expired" | "other";

package/dist/components/UserSelectPopover.d.ts

@@ -28,6 +28,19 @@ export interface UserSelectPopoverProps {
      * Whether users are currently loading.
      */
     loading?: boolean;
+    /**
+     * Called with the search text each time it changes (debounced), for a
+     * parent that searches its users on a server rather than passing them all
+     * in `users`. The list is still filtered here by the same text.
+     */
+    onSearchTextChange?: (searchText: string) => void;
+    /**
+     * For a parent that lists only the first page of a server search: how many
+     * users that search matched in all. Leave it out when `users` holds every
+     * match. When set, the header counts the listed users against it and a
+     * notice says the others are not listed.
+     */
+    totalCount?: number;
     /**
      * The current user (displayed as the "self" option at the top).
      */
@@ -60,4 +73,4 @@ export interface UserSelectPopoverProps {
  *
  * @group Components
  */
-export declare function UserSelectPopover({ selectedUser, onUserSelected, users, loading, currentUser, defaultLabel, renderLimit, className, size }: UserSelectPopoverProps): React.JSX.Element;
+export declare function UserSelectPopover({ selectedUser, onUserSelected, users, loading, onSearchTextChange, totalCount, currentUser, defaultLabel, renderLimit, className, size }: UserSelectPopoverProps): React.JSX.Element;

package/dist/components/common/useDataTableController.d.ts

@@ -42,4 +42,4 @@ export type DataTableControllerProps<M extends Record<string, any> = any> = {
  * @param fixedFilterFromProps
  * @param updateUrl
  */
-export declare function useDataTableController<M extends Record<string, any> = any, USER extends User = User>({ path, collection, scrollRestoration, entitiesDisplayedFirst, lastDeleteTimestamp: _lastDeleteTimestamp, fixedFilter: fixedFilterFromProps, updateUrl }: DataTableControllerProps<M>): EntityTableController<M>;
+export declare function useDataTableController<M extends Record<string, any> = any, USER extends User = User>({ path, collection, scrollRestoration, entitiesDisplayedFirst, lastDeleteTimestamp, fixedFilter: fixedFilterFromProps, updateUrl }: DataTableControllerProps<M>): EntityTableController<M>;

package/dist/components/common/useScrollRestoration.d.ts

@@ -1,4 +1,11 @@
 import { Entity, FilterValues } from "@rebasepro/types";
+/**
+ * Forget every collection's scroll position and the rows kept with it.
+ *
+ * The rows are what the signed-in user was allowed to read, and a table seeds
+ * its first render from them, so they must not outlive that user's session.
+ */
+export declare function clearCollectionScrollCache(): void;
 export type ScrollRestorationController = {
     getCollectionScroll: (path: string, filters?: FilterValues<any>) => {
         scrollOffset: number;

package/dist/components/email-change-message.d.ts

@@ -0,0 +1,6 @@
+/**
+ * What the settings screen and the link's screen say about a refused address
+ * change: the codes a person can act on get the panel's own, translated words,
+ * and anything else keeps the server's message.
+ */
+export declare function emailChangeErrorMessage(error: unknown, t: (key: string) => string): string;

package/dist/components/index.d.ts

@@ -13,3 +13,4 @@ export * from "./UserDisplay.js";
 export * from "./LoginView/index.js";
 export * from "./RebaseAuth.js";
 export * from "./SchemaDriftBanner.js";
+export * from "./ConnectionLostBanner.js";

package/dist/contexts/CollectionResolverContext.d.ts

@@ -5,6 +5,12 @@ import React from "react";
 export type CollectionResolver = (slug: string) => {
     properties?: Record<string, unknown>;
 } | undefined;
+/**
+ * Translate the path a collection is addressed by into the path its driver
+ * stores it under — `fs_diagnosis` into `diagnosis`, for a Firestore collection
+ * that declares `path: "diagnosis"`. See `EntityDataOptions.resolveDataPath`.
+ */
+export type DataPathResolver = (path: string) => string | undefined;
 /**
  * Lets the layer that owns the collections hand a resolver *up* to the data
  * layer, which needs a collection's primary keys to give its rows an address.
@@ -15,9 +21,13 @@ export type CollectionResolver = (slug: string) => {
  * prop without giving every headless BaaS app a collections argument it has no
  * use for.
  *
+ * The same layer knows where each collection is stored, so it hands up the
+ * data-path translation alongside: a direct driver has to be given a
+ * collection's declared `path`, and only the registry knows it.
+ *
  * Registration is a ref write, so it is safe to call during render — and it has
  * to be. The views that fetch rows are *below* the registrar, and child effects
  * run before parent effects, so registering in an effect would bind after the
  * first page of rows had already been converted.
  */
-export declare const CollectionResolverRegistrationContext: React.Context<(resolver: CollectionResolver | undefined) => void>;
+export declare const CollectionResolverRegistrationContext: React.Context<(resolver: CollectionResolver | undefined, resolveDataPath?: DataPathResolver) => void>;

package/dist/core/PluginLifecycleManager.d.ts

@@ -2,16 +2,24 @@ import type { RebasePlugin, RebaseContext } from "@rebasepro/cms-types";
 /**
  * Render-less component that manages plugin lifecycle hooks.
  *
- * - Calls `lifecycle.onMount(context)` when plugins mount.
- * - Calls `lifecycle.onUnmount()` when plugins unmount.
- * - Subscribes to auth state changes and calls `lifecycle.onAuthStateChange`.
+ * - Calls `lifecycle.onMount(context)` once, the first time auth is ready.
+ * - Calls `lifecycle.onAuthStateChange(user)` on every change of user after
+ *   that — `null` on sign-out, the new user on the next sign-in.
+ * - Calls `lifecycle.onUnmount()` when the Rebase tree unmounts.
+ *
+ * Mounted for as long as there are plugins, signed in or not. It used to be
+ * mounted only while a user was signed in, so a sign-out unmounted it and the
+ * next sign-in mounted a fresh one — `onAuthStateChange` could never see the
+ * user change, and never fired.
  *
  * Mount this component inside the Rebase tree, below PluginProviderStack,
  * so that the RebaseContext is fully available.
  *
  * @internal
  */
-export declare function PluginLifecycleManager({ plugins, context }: {
+export declare function PluginLifecycleManager({ plugins, context, authReady }: {
     plugins: RebasePlugin[];
     context: RebaseContext;
+    /** Signed in, or sign-in skipped: what `onMount` waits for. */
+    authReady: boolean;
 }): null;