@rebasepro/server-core 0.0.1-canary.f81da60 → 0.1.0

package/app/frontend/node_modules/esbuild/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "esbuild",
+  "version": "0.21.5",
+  "description": "An extremely fast JavaScript and CSS bundler and minifier.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/evanw/esbuild.git"
+  },
+  "scripts": {
+    "postinstall": "node install.js"
+  },
+  "main": "lib/main.js",
+  "types": "lib/main.d.ts",
+  "engines": {
+    "node": ">=12"
+  },
+  "bin": {
+    "esbuild": "bin/esbuild"
+  },
+  "optionalDependencies": {
+    "@esbuild/aix-ppc64": "0.21.5",
+    "@esbuild/android-arm": "0.21.5",
+    "@esbuild/android-arm64": "0.21.5",
+    "@esbuild/android-x64": "0.21.5",
+    "@esbuild/darwin-arm64": "0.21.5",
+    "@esbuild/darwin-x64": "0.21.5",
+    "@esbuild/freebsd-arm64": "0.21.5",
+    "@esbuild/freebsd-x64": "0.21.5",
+    "@esbuild/linux-arm": "0.21.5",
+    "@esbuild/linux-arm64": "0.21.5",
+    "@esbuild/linux-ia32": "0.21.5",
+    "@esbuild/linux-loong64": "0.21.5",
+    "@esbuild/linux-mips64el": "0.21.5",
+    "@esbuild/linux-ppc64": "0.21.5",
+    "@esbuild/linux-riscv64": "0.21.5",
+    "@esbuild/linux-s390x": "0.21.5",
+    "@esbuild/linux-x64": "0.21.5",
+    "@esbuild/netbsd-x64": "0.21.5",
+    "@esbuild/openbsd-x64": "0.21.5",
+    "@esbuild/sunos-x64": "0.21.5",
+    "@esbuild/win32-arm64": "0.21.5",
+    "@esbuild/win32-ia32": "0.21.5",
+    "@esbuild/win32-x64": "0.21.5"
+  },
+  "license": "MIT"
+}

package/dist/index.es.js

@@ -1020,7 +1020,8 @@ var object_hash = { exports: {} };
     }, { buffer: 3, lYpoI2: 11 }] }, {}, [1])(1);
   });
 })(object_hash);
-const snakeCaseRegex = /[A-Z]{2,}(?=[A-Z][a-z]+[0-9]*|\b)|[A-Z]?[a-z]+[0-9]*|[A-Z]|[0-9]+/g;
+const tokenizeRegex = /[A-Z]{2,}(?=[A-Z][a-z]|\b)|[A-Z]?[a-z]+|[0-9]+(?:[a-z](?![a-z]))?|[A-Z]/g;
+const snakeCaseRegex = tokenizeRegex;
 const toSnakeCase = (str) => {
   const regExpMatchArray = str.match(snakeCaseRegex);
   if (!regExpMatchArray) return "";
@@ -3474,8 +3475,7 @@ async function loadCollectionsFromDirectory(directory) {
         const filePath = path$3.join(directory, file);
         try {
           const fileUrl = pathToFileURL(filePath).href;
-          const dynamicImport = new Function("url", "return import(url)");
-          const module = await dynamicImport(fileUrl);
+          const module = await import(fileUrl);
           if (module && module.default) {
             collections.push(module.default);
           } else {
@@ -3633,7 +3633,8 @@ const errorHandler = (err, c) => {
   console.error(`❌ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code2}: ${logMessage}`);
   const causePg = error2.cause && typeof error2.cause === "object" ? error2.cause : void 0;
   const pgErrorCode = causePg?.code || error2.code;
-  if (pgErrorCode !== "42703" && pgErrorCode !== "42P01") {
+  const suppressStack = pgErrorCode === "42703" || pgErrorCode === "42P01" || statusCode < 500 && code2 === "BAD_REQUEST";
+  if (!suppressStack) {
     console.error(error2.stack || error2);
   }
   let clientMessage = "An unexpected error occurred";
@@ -21632,15 +21633,19 @@ ZodEnum.create;
 ZodPromise.create;
 ZodOptional.create;
 ZodNullable.create;
-function createGoogleProvider(clientId) {
-  const googleClient = new src$4.OAuth2Client(clientId);
+function createGoogleProvider(config) {
+  const clientId = typeof config === "string" ? config : config.clientId;
+  const clientSecret = typeof config === "string" ? void 0 : config.clientSecret;
+  const googleClient = new src$4.OAuth2Client(clientId, clientSecret);
   return {
     id: "google",
     schema: objectType({
       idToken: stringType().min(1).optional(),
-      accessToken: stringType().min(1).optional()
-    }).refine((data) => data.idToken || data.accessToken, {
-      message: "Either idToken or accessToken is required"
+      accessToken: stringType().min(1).optional(),
+      code: stringType().min(1).optional(),
+      redirectUri: stringType().min(1).optional()
+    }).refine((data) => data.idToken || data.accessToken || data.code && data.redirectUri, {
+      message: "One of idToken, accessToken, or code+redirectUri is required"
     }),
     verify: async (payload) => {
       try {
@@ -21651,7 +21656,7 @@ function createGoogleProvider(clientId) {
           });
           const content = ticket.getPayload();
           if (!content) {
-            return null;
+            throw new Error("Google ID token payload was empty");
           }
           return {
             providerId: content.sub,
@@ -21667,12 +21672,11 @@ function createGoogleProvider(clientId) {
             }
           });
           if (!res.ok) {
-            console.error("Google userinfo request failed:", res.status);
-            return null;
+            throw new Error(`Google userinfo request failed with status ${res.status}`);
           }
           const info = await res.json();
           if (!info.sub || !info.email) {
-            return null;
+            throw new Error("Google userinfo response missing sub or email");
           }
           return {
             providerId: info.sub,
@@ -21681,10 +21685,73 @@ function createGoogleProvider(clientId) {
             photoUrl: info.picture || null
           };
         }
-        return null;
+        if (payload.code && payload.redirectUri) {
+          if (!clientSecret) {
+            throw new Error("Google authorization code flow requires clientSecret. Configure GOOGLE_CLIENT_SECRET in your environment.");
+          }
+          const tokenResponse = await fetch("https://oauth2.googleapis.com/token", {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/x-www-form-urlencoded"
+            },
+            body: new URLSearchParams({
+              code: payload.code,
+              client_id: clientId,
+              client_secret: clientSecret,
+              redirect_uri: payload.redirectUri,
+              grant_type: "authorization_code"
+            })
+          });
+          if (!tokenResponse.ok) {
+            const errorBody = await tokenResponse.text();
+            throw new Error(`Google token exchange failed (${tokenResponse.status}): ${errorBody}`);
+          }
+          const tokenData = await tokenResponse.json();
+          if (tokenData.error) {
+            throw new Error(`Google token exchange error: ${tokenData.error} – ${tokenData.error_description || "no details"}`);
+          }
+          if (tokenData.id_token) {
+            const ticket = await googleClient.verifyIdToken({
+              idToken: tokenData.id_token,
+              audience: clientId
+            });
+            const content = ticket.getPayload();
+            if (!content) {
+              throw new Error("Google ID token payload was empty after code exchange");
+            }
+            return {
+              providerId: content.sub,
+              email: content.email || "",
+              displayName: content.name || null,
+              photoUrl: content.picture || null
+            };
+          }
+          if (tokenData.access_token) {
+            const userInfoRes = await fetch("https://www.googleapis.com/oauth2/v3/userinfo", {
+              headers: {
+                Authorization: `Bearer ${tokenData.access_token}`
+              }
+            });
+            if (!userInfoRes.ok) {
+              throw new Error(`Google userinfo request failed after code exchange (${userInfoRes.status})`);
+            }
+            const info = await userInfoRes.json();
+            if (!info.sub || !info.email) {
+              return null;
+            }
+            return {
+              providerId: info.sub,
+              email: info.email,
+              displayName: info.name || null,
+              photoUrl: info.picture || null
+            };
+          }
+          throw new Error("Google token exchange returned neither id_token nor access_token");
+        }
+        throw new Error("No valid Google credential provided (expected idToken, accessToken, or code+redirectUri)");
       } catch (error2) {
-        console.error("Failed to verify Google token:", error2);
-        return null;
+        console.error("Google OAuth verification failed:", error2);
+        throw error2;
       }
     }
   };
@@ -22892,7 +22959,11 @@ function createAuthRoutes(config) {
       passwordHash,
       displayName: displayName || void 0
     });
-    if (config.defaultRole) {
+    const existingUsers = await authRepo.listUsers();
+    const isFirstUser = existingUsers.length === 1 && existingUsers[0].id === user.id;
+    if (isFirstUser) {
+      await authRepo.setUserRoles(user.id, ["admin"]);
+    } else if (config.defaultRole) {
       await authRepo.assignDefaultRole(user.id, config.defaultRole);
     }
     const {
@@ -22933,7 +23004,13 @@ function createAuthRoutes(config) {
     for (const provider of config.oauthProviders) {
       router.post(`/${provider.id}`, defaultAuthLimiter, async (c) => {
         const payload = parseBody2(provider.schema, await c.req.json());
-        const externalUser = await provider.verify(payload);
+        let externalUser;
+        try {
+          externalUser = await provider.verify(payload);
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          throw ApiError.unauthorized(`${provider.id} login failed: ${msg}`, "OAUTH_ERROR");
+        }
         if (!externalUser) {
           throw ApiError.unauthorized(`Invalid ${provider.id} credentials`, "INVALID_TOKEN");
         }
@@ -22957,7 +23034,11 @@ function createAuthRoutes(config) {
             await authRepo.linkUserIdentity(user.id, provider.id, externalUser.providerId, {
               email: externalUser.email
             });
-            if (config.defaultRole) {
+            const allUsers = await authRepo.listUsers();
+            const isFirstUser = allUsers.length === 1 && allUsers[0].id === user.id;
+            if (isFirstUser) {
+              await authRepo.setUserRoles(user.id, ["admin"]);
+            } else if (config.defaultRole) {
               await authRepo.assignDefaultRole(user.id, config.defaultRole);
             }
             sendWelcomeEmail({
@@ -24950,20 +25031,21 @@ function createAuth(transport, options2) {
       refreshToken: session.refreshToken
     };
   }
-  async function signInWithGoogle(idToken) {
+  async function signInWithGoogle(tokenOrPayload) {
     const fetchFn = getFetch();
+    const body = typeof tokenOrPayload === "string" ? {
+      idToken: tokenOrPayload
+    } : tokenOrPayload;
     const res = await fetchFn(authUrl("/google"), {
       method: "POST",
       headers: {
         "Content-Type": "application/json"
       },
-      body: JSON.stringify({
-        idToken
-      })
+      body: JSON.stringify(body)
     });
-    const body = await res.json().catch(() => ({}));
-    if (!res.ok) throwApiError(res.status, body, res.statusText);
-    const session = handleAuthResponse(body, "SIGNED_IN");
+    const responseBody = await res.json().catch(() => ({}));
+    if (!res.ok) throwApiError(res.status, responseBody, res.statusText);
+    const session = handleAuthResponse(responseBody, "SIGNED_IN");
     return {
       user: session.user,
       accessToken: session.accessToken,
@@ -25625,6 +25707,25 @@ function createCollectionClient(transport, slug, ws) {
   };
   return client;
 }
+function createFunctionsClient(transport) {
+  return {
+    async invoke(name2, payload, options2) {
+      const method = options2?.method ?? "POST";
+      const subPath = options2?.path ? `/${options2.path.replace(/^\//, "")}` : "";
+      const routePath = `/functions/${encodeURIComponent(name2)}${subPath}`;
+      const init = {
+        method
+      };
+      if (payload !== void 0 && method !== "GET") {
+        init.body = JSON.stringify(payload);
+      }
+      if (options2?.headers) {
+        init.headers = options2.headers;
+      }
+      return transport.request(routePath, init);
+    }
+  };
+}
 function createStorage(transport) {
   const urlsCache = /* @__PURE__ */ new Map();
   async function putObject({
@@ -25758,6 +25859,7 @@ function createRebaseClient(options2) {
   const admin = createAdmin(transport, options2.admin);
   const cron = createCron(transport, options2.cron);
   const storage = createStorage(transport);
+  const functions = createFunctionsClient(transport);
   let ws;
   if (!options2.onUnauthorized) {
     transport.setOnUnauthorized(async () => {
@@ -25796,6 +25898,7 @@ function createRebaseClient(options2) {
     auth,
     admin,
     cron,
+    functions,
     storage,
     ws,
     setToken: transport.setToken,
@@ -37123,7 +37226,7 @@ async function _initializeRebaseBackend(config) {
       const {
         createGoogleProvider: createGoogleProvider2
       } = await import("./index-DXVBFp5V.js");
-      oauthProviders.push(createGoogleProvider2(config.auth.google.clientId));
+      oauthProviders.push(createGoogleProvider2(config.auth.google));
     }
     if (config.auth.linkedin?.clientId && config.auth.linkedin?.clientSecret) {
       const {
@@ -37324,6 +37427,13 @@ async function _initializeRebaseBackend(config) {
   }
   _initRebase(serverClient);
   logger.info("Rebase singleton initialized");
+  if (defaultDriverResult.internals) {
+    const internals = defaultDriverResult.internals;
+    const driver = internals.driver;
+    if (driver && "client" in driver) {
+      driver.client = serverClient;
+    }
+  }
   if (config.functionsDir) {
     const {
       loadFunctionsFromDirectory: loadFunctionsFromDirectory2
@@ -48194,7 +48304,9 @@ class RebaseApiServer {
    * Setup Hono middleware
    */
   setupMiddleware() {
-    this.router.use("/*", secureHeaders());
+    this.router.use("/*", secureHeaders({
+      crossOriginOpenerPolicy: "same-origin-allow-popups"
+    }));
     if (this.config.cors) {
       const origin = this.config.cors.origin;
       this.router.use("/*", cors({