@rebasepro/server-postgres 0.13.1-canary.gf57a27e → 0.14.0

package/dist/PostgresBootstrapper.d.ts

@@ -89,6 +89,32 @@ export interface PostgresDriverInternals {
  * and this is the part that was wrong.
  */
 export declare function resolveDriftCheckName(col: CollectionConfig, registeredTableNames: string[]): string;
+/**
+ * Is this the local database `rebase init` scaffolds — i.e. the one case where
+ * "you are connected as a superuser" is not news?
+ *
+ * The scaffold's own `docker-compose.yml` sets `POSTGRES_USER: rebase_app`,
+ * which makes that role the cluster superuser, so the superuser advisory below
+ * was the only WARN a brand-new project ever saw and it was about a decision
+ * the tool had made for the developer.
+ *
+ * Of the two available fixes — provision a non-superuser table-owner role in
+ * the scaffold, or recognise the local shape and stay quiet — this is the
+ * second, because the first breaks the scaffold it is meant to improve: a
+ * non-superuser owner cannot `CREATE EXTENSION` (search collections need
+ * `pg_trgm`/`unaccent`, applied by `rebase db push` and again by the boot
+ * schema-ensure), so the very first `pnpm run db:push` on a scaffolded project
+ * with a search block would fail. Trading a working first run for a quieter log
+ * line is the wrong trade.
+ *
+ * The condition is deliberately narrow — a *non-production* process talking to
+ * a database on the loopback interface. A genuine production superuser
+ * connection still warns, and so does a non-production process pointed at a
+ * remote database (the usual "my dev machine writes to staging" mistake, where
+ * the advisory is exactly right). NODE_ENV alone would not do: the scaffold
+ * ships `NODE_ENV=development` and some deployments inherit it.
+ */
+export declare function isScaffoldedLocalDatabase(connectionString: string | undefined): boolean;
 /**
  * Default PostgreSQL bootstrapper.
  *

package/dist/auth/services.d.ts

@@ -287,6 +287,7 @@ export declare class PostgresAuthRepository implements AuthRepository {
         secretEncrypted: string;
     }) | null>;
     verifyMfaFactor(factorId: string): Promise<void>;
+    updateMfaFactorSecret(factorId: string, secretEncrypted: string): Promise<void>;
     deleteMfaFactor(factorId: string, uid: string): Promise<void>;
     createMfaChallenge(factorId: string, ipAddress?: string): Promise<MfaChallengeInfo>;
     getMfaChallengeById(challengeId: string): Promise<MfaChallengeInfo | null>;
@@ -296,6 +297,8 @@ export declare class PostgresAuthRepository implements AuthRepository {
     getUnusedRecoveryCodeCount(uid: string): Promise<number>;
     deleteAllRecoveryCodes(uid: string): Promise<void>;
     hasVerifiedMfaFactors(uid: string): Promise<boolean>;
+    claimMfaFactorCounter(factorId: string, counter: number): Promise<boolean>;
+    recordMfaChallengeAttempt(challengeId: string): Promise<number>;
 }
 /**
  * PostgreSQL implementation of MfaRepository.
@@ -311,10 +314,28 @@ export declare class MfaService implements MfaRepository {
     getMfaFactorById(factorId: string): Promise<(MfaFactor & {
         secretEncrypted: string;
     }) | null>;
+    /**
+     * Spend a TOTP time step, once and only once.
+     *
+     * One statement: the `WHERE` is the check, the `UPDATE` is the act, and
+     * `RETURNING` reports which of two concurrent requests carrying the same
+     * six digits won. Reading the counter and then writing it would let both
+     * pass — the exact replay this closes.
+     */
+    claimMfaFactorCounter(factorId: string, counter: number): Promise<boolean>;
     verifyMfaFactor(factorId: string): Promise<void>;
+    updateMfaFactorSecret(factorId: string, secretEncrypted: string): Promise<void>;
     deleteMfaFactor(factorId: string, uid: string): Promise<void>;
     createMfaChallenge(factorId: string, ipAddress?: string): Promise<MfaChallengeInfo>;
     getMfaChallengeById(challengeId: string): Promise<MfaChallengeInfo | null>;
+    /**
+     * Count one failed guess against a challenge and report the new total.
+     *
+     * Incremented in the database rather than in the route so that guesses
+     * arriving in parallel — the shape any real brute-force takes — cannot
+     * share a single increment.
+     */
+    recordMfaChallengeAttempt(challengeId: string): Promise<number>;
     verifyMfaChallenge(challengeId: string): Promise<void>;
     createRecoveryCodes(uid: string, codeHashes: string[]): Promise<void>;
     useRecoveryCode(uid: string, codeHash: string): Promise<boolean>;