@rebasepro/server 0.10.0 → 0.10.1-canary.14e53ae

package/dist/init/middlewares.d.ts

@@ -3,6 +3,15 @@ import { HonoEnv } from "../api/types";
 interface MiddlewareConfig {
     maxBodySize?: number;
     compression?: boolean;
+    /**
+     * The caller already installed a CORS middleware.
+     *
+     * The framework does not install one itself, so it warns when it sees no
+     * sign of an origin policy. The bundle runtime always installs one, and a
+     * warning that is wrong in the common case is worse than no warning — it
+     * teaches people to skim past the ones that matter.
+     */
+    corsHandled?: boolean;
     csrf?: {
         origin: string | string[] | ((origin: string) => boolean);
     };

package/dist/init/storage.d.ts

@@ -3,3 +3,30 @@ export declare function initializeStorage(storageConfig: BackendStorageConfig |
     storageRegistry?: StorageRegistry;
     storageController?: StorageController;
 }>;
+/** Inputs that decide whether storage has an access-control model at all. */
+export interface StorageAccessControlState {
+    /** A `storageAuthorize` hook was configured (per-object access control). */
+    hasAuthorize: boolean;
+    /** Reads are deliberately public (`storagePublicRead: true`). */
+    publicRead: boolean;
+    /** The legacy "any authenticated user may touch any key" behaviour was
+     *  explicitly acknowledged (`storageInsecureAllowAnyAuthenticated: true`). */
+    allowAnyAuthenticated: boolean;
+}
+/**
+ * Refuse to boot storage in production with no access-control model.
+ *
+ * Storage is not under RLS and its keys share one flat namespace, so with no
+ * `storageAuthorize` hook the only thing separating two users' files is key
+ * unguessability — which a `GET /list` defeats. This is the storage analogue of
+ * the locked-by-default RLS on collections: rather than ship an allow-all
+ * default silently, make the deployment state its intent.
+ *
+ * In production a bare allow-all config is refused (throws, so the rollout
+ * fails loudly instead of serving everyone's files to everyone). Outside
+ * production it is a loud warning, so local development is not blocked.
+ *
+ * Any one of the three explicit choices — a hook, public-read, or the insecure
+ * opt-out — satisfies the guard.
+ */
+export declare function assertStorageAccessControlConfigured(state: StorageAccessControlState, isProduction: boolean): void;

package/dist/init.d.ts

@@ -306,8 +306,32 @@ export interface RebaseBackendConfig {
      *
      * Without it, any authenticated caller may read any key they can name, so
      * multi-tenant apps should treat this as required rather than optional.
+     *
+     * In production, storage refuses to boot unless one of `storageAuthorize`,
+     * {@link storagePublicRead}, or {@link storageInsecureAllowAnyAuthenticated}
+     * is set — see `assertStorageAccessControlConfigured`.
      */
     storageAuthorize?: import("./storage/types").StorageAuthorize;
+    /**
+     * Allow unauthenticated read access to stored files (default: false).
+     *
+     * Set this only when the bucket is genuinely a public, read-only CDN.
+     * Writes, deletes and listing still require authentication. Because it is a
+     * deliberate statement that reads are public, it also satisfies the
+     * production storage boot guard (see {@link storageAuthorize}).
+     */
+    storagePublicRead?: boolean;
+    /**
+     * Opt out of the storage access-control boot guard, keeping the legacy
+     * behaviour where **any** authenticated user can read, overwrite, delete or
+     * list **any** key (storage keys share one flat namespace and are not under
+     * RLS).
+     *
+     * Only safe for single-tenant apps where every signed-in user is trusted
+     * with every file. Multi-tenant apps must use `storageAuthorize` instead.
+     * Without one of these, storage refuses to boot in production.
+     */
+    storageInsecureAllowAnyAuthenticated?: boolean;
     /**
      * Entity history / audit-log configuration.
      *
@@ -381,6 +405,25 @@ export interface RebaseBackendConfig {
      * ```
      */
     callbacks?: CollectionCallbacks;
+    /**
+     * Declare that this application installs its own CORS middleware.
+     *
+     * Suppresses the "no CORS configuration detected" warning, which exists for
+     * hand-wired backends that genuinely have no origin policy.
+     */
+    corsHandled?: boolean;
+    /**
+     * The schema version this deployment serves, as recorded when it was built.
+     *
+     * Published by the contract endpoint so a client generated elsewhere can
+     * tell whether it is current. Leave unset and the runtime computes one from
+     * the live collections — correct, but it means the value moves whenever the
+     * collections do, which is exactly right for `baas` mode and slightly less
+     * useful for a built bundle that already knows its own answer.
+     */
+    schemaVersion?: string;
+    /** Runtime version reported by the contract endpoint. Informational. */
+    runtimeVersion?: string;
 }
 /**
  * Type guard to detect whether the `auth` config is an `AuthAdapter`

package/dist/{jwt-B3zjddCa.js → jwt-Dj7r7QX7.js}

@@ -4165,6 +4165,7 @@ var require_jsonwebtoken = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region src/auth/jwt.ts
 var jwt_exports = /* @__PURE__ */ __exportAll({
+	MAX_COOKIE_AGE_MS: () => MAX_COOKIE_AGE_MS,
 	configureJwt: () => configureJwt,
 	generateAccessToken: () => generateAccessToken,
 	generateDownloadToken: () => generateDownloadToken,
@@ -4172,6 +4173,7 @@ var jwt_exports = /* @__PURE__ */ __exportAll({
 	getAccessTokenExpiry: () => getAccessTokenExpiry,
 	getAccessTokenExpiryMs: () => getAccessTokenExpiryMs,
 	getRefreshTokenExpiry: () => getRefreshTokenExpiry,
+	getRefreshTokenTtlMs: () => getRefreshTokenTtlMs,
 	hashRefreshToken: () => hashRefreshToken,
 	verifyAccessToken: () => verifyAccessToken,
 	verifyDownloadToken: () => verifyDownloadToken
@@ -4180,7 +4182,7 @@ var import_jsonwebtoken = /* @__PURE__ */ __toESM(require_jsonwebtoken(), 1);
 var jwtConfig = {
 	secret: "",
 	accessExpiresIn: "1h",
-	refreshExpiresIn: "30d"
+	refreshExpiresIn: "400d"
 };
 /**
 * Configure JWT settings - call this during initialization.
@@ -4306,30 +4308,40 @@ function hashRefreshToken(token) {
 	return createHash("sha256").update(token).digest("hex");
 }
 /**
-* Calculate refresh token expiration date
+* The longest a cookie can live. Chrome (since 104) and RFC 6265bis silently
+* rewrite any `Max-Age` beyond 400 days down to 400 days, so promising a
+* browser more is not a stricter policy — it is a policy that differs from
+* what is actually enforced, which is worse than knowing the ceiling.
 */
-function getRefreshTokenExpiry() {
-	const match = (jwtConfig.refreshExpiresIn || "30d").match(/^(\d+)([dhms])$/);
-	if (!match) return new Date(Date.now() + 720 * 60 * 60 * 1e3);
+var MAX_COOKIE_AGE_MS = 400 * 24 * 60 * 60 * 1e3;
+/** Fallback when `refreshExpiresIn` is unset or unparseable. */
+var DEFAULT_REFRESH_TTL_MS = MAX_COOKIE_AGE_MS;
+/**
+* How long a refresh token is valid for, in milliseconds.
+*
+* Every rotation issues a token with a fresh TTL, so this is a sliding window:
+* a user who visits at all keeps their session indefinitely, and one who
+* disappears loses it this long after their last visit. That is what both
+* Firebase and Supabase do by default, and it is the behaviour people mean
+* when they say they expect to still be signed in.
+*/
+function getRefreshTokenTtlMs() {
+	const match = jwtConfig.refreshExpiresIn?.match(/^(\d+)([dhms])$/);
+	if (!match) return DEFAULT_REFRESH_TTL_MS;
 	const value = parseInt(match[1], 10);
-	const unit = match[2];
-	let ms;
-	switch (unit) {
-		case "d":
-			ms = value * 24 * 60 * 60 * 1e3;
-			break;
-		case "h":
-			ms = value * 60 * 60 * 1e3;
-			break;
-		case "m":
-			ms = value * 60 * 1e3;
-			break;
-		case "s":
-			ms = value * 1e3;
-			break;
-		default: ms = 720 * 60 * 60 * 1e3;
+	switch (match[2]) {
+		case "d": return value * 24 * 60 * 60 * 1e3;
+		case "h": return value * 60 * 60 * 1e3;
+		case "m": return value * 60 * 1e3;
+		case "s": return value * 1e3;
+		default: return DEFAULT_REFRESH_TTL_MS;
 	}
-	return new Date(Date.now() + ms);
+}
+/**
+* Calculate refresh token expiration date
+*/
+function getRefreshTokenExpiry() {
+	return new Date(Date.now() + getRefreshTokenTtlMs());
 }
 /**
 * Generate a short-lived download token scoped to a specific file path or prefix
@@ -4363,6 +4375,6 @@ function verifyDownloadToken(token) {
 	}
 }
 //#endregion
-export { getAccessTokenExpiry as a, jwt_exports as c, require_jsonwebtoken as d, __commonJSMin as f, __toESM as h, generateRefreshToken as i, verifyAccessToken as l, __require as m, generateAccessToken as n, getRefreshTokenExpiry as o, __exportAll as p, generateDownloadToken as r, hashRefreshToken as s, configureJwt as t, verifyDownloadToken as u };
+export { __toESM as _, generateRefreshToken as a, getRefreshTokenTtlMs as c, verifyAccessToken as d, verifyDownloadToken as f, __require as g, __exportAll as h, generateDownloadToken as i, hashRefreshToken as l, __commonJSMin as m, configureJwt as n, getAccessTokenExpiry as o, require_jsonwebtoken as p, generateAccessToken as r, getRefreshTokenExpiry as s, MAX_COOKIE_AGE_MS as t, jwt_exports as u };
 
-//# sourceMappingURL=jwt-B3zjddCa.js.map
+//# sourceMappingURL=jwt-Dj7r7QX7.js.map