@rebasepro/server 0.10.1-canary.d8d45b2 → 0.10.1-canary.ff9ccd6

package/dist/api/ast-schema-editor.d.ts

@@ -1,3 +1,13 @@
+/**
+ * Move presentation keys into the `admin` block.
+ *
+ * `ADMIN_COLLECTION_KEYS` comes from `@rebasepro/types` rather than being spelled
+ * out here, so adding a field to `AdminCollectionOptions` cannot leave this writer
+ * behind. Any such key already inside `admin` wins over a top-level copy: the
+ * nested one is what the file said, and a flat duplicate is the view model's
+ * flattening leaking back.
+ */
+export declare function nestAdminKeys(collectionData: Record<string, unknown>): Record<string, unknown>;
 export declare class AstSchemaEditor {
     private project;
     private collectionsDir;

package/dist/index.es.js

@@ -2,7 +2,7 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { _ as __toESM, a as generateRefreshToken, c as getRefreshTokenTtlMs, d as verifyAccessToken, f as verifyDownloadToken, g as __require, h as __exportAll, i as generateDownloadToken, l as hashRefreshToken, m as __commonJSMin, n as configureJwt, o as getAccessTokenExpiry, p as require_jsonwebtoken, r as generateAccessToken, s as getRefreshTokenExpiry, t as MAX_COOKIE_AGE_MS } from "./jwt-Dj7r7QX7.js";
-import { _ as EntityRelation, a as DEFAULT_DATA_SOURCE_KEY, b as RebaseApiError, c as policy, d as isPostgresCollectionConfig, f as CANONICAL_TO_REST, g as EntityReference, h as toCanonicalOp, i as DEFAULT_STORAGE_SOURCE_KEY, l as getCollectionDataPath, m as REST_TO_CANONICAL, n as serializeCollections, o as getDataSourceCapabilities, p as NULL_OPS, r as SCHEMA_VERSION_HEADER, s as isSQLAdmin, t as computeSchemaVersion, u as getDeclaredSubcollections, v as GeoPoint, x as RebaseClientError, y as Vector } from "./src-BITicbgD.js";
+import { S as RebaseClientError, _ as EntityReference, a as DEFAULT_DATA_SOURCE_KEY, b as Vector, c as policy, d as isPostgresCollectionConfig, g as toCanonicalOp, h as REST_TO_CANONICAL, i as DEFAULT_STORAGE_SOURCE_KEY, l as getCollectionDataPath, m as NULL_OPS, n as serializeCollections, o as getDataSourceCapabilities, p as CANONICAL_TO_REST, r as SCHEMA_VERSION_HEADER, s as isSQLAdmin, t as computeSchemaVersion, u as getDeclaredSubcollections, v as EntityRelation, x as RebaseApiError, y as GeoPoint } from "./src-DRUswG_w.js";
 import { t as logger } from "./logger-BYU66ENZ.js";
 import { t as nativeDynamicImport } from "./dynamic-import-Dvh-K5fl.js";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
@@ -1689,39 +1689,9 @@ policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
 		return jsonLogic;
 	});
 })))();
-//#endregion
-//#region ../common/src/util/filter-operator-resolution.ts
-/**
-* Default operators offered per property type, before engine capabilities and
-* per-property narrowing are applied. These mirror what the built-in filter
-* fields can render.
-*/
-var COMPARISON_OPS = [
-	"==",
-	"!=",
-	">",
-	">=",
-	"<",
-	"<="
-];
-var NULL_CHECK_OPS = ["is-null", "is-not-null"];
-var MEMBERSHIP_OPS = ["in", "not-in"];
-var PATTERN_OPS = [
-	"like",
-	"ilike",
-	"not-like",
-	"not-ilike"
-];
-[
-	...COMPARISON_OPS,
-	...MEMBERSHIP_OPS,
-	...PATTERN_OPS,
-	...NULL_CHECK_OPS
-], [
-	...COMPARISON_OPS,
-	...MEMBERSHIP_OPS,
-	...NULL_CHECK_OPS
-], [...COMPARISON_OPS, ...NULL_CHECK_OPS], [...NULL_CHECK_OPS], [...MEMBERSHIP_OPS, ...NULL_CHECK_OPS], [...MEMBERSHIP_OPS, ...NULL_CHECK_OPS];
+/**
+* Apply PropertyConditions to a resolved property, evaluating all JSON Logic rules.
+*/
 //#endregion
 //#region ../../node_modules/.pnpm/fast-equals@6.0.0/node_modules/fast-equals/dist/es/index.mjs
 var { getOwnPropertyNames, getOwnPropertySymbols } = Object;
@@ -12888,6 +12858,7 @@ async function verifyGoogleAccessToken(accessToken, expectedClientId) {
 function createGoogleProvider(config) {
 	const clientId = typeof config === "string" ? config : config.clientId;
 	const clientSecret = typeof config === "string" ? void 0 : config.clientSecret;
+	if (!clientSecret) console.warn("[Rebase] Google provider configured without a client secret. ID-token and access-token sign-in still work, but the authorization-code flow used by the admin login button will fail. Set GOOGLE_CLIENT_SECRET to enable it.");
 	let googleClient;
 	async function getClient() {
 		if (!googleClient) {
@@ -15044,7 +15015,7 @@ function assertStorageAccessControlConfigured(state, isProduction) {
 //#region src/init/docs.ts
 async function mountOpenApiDocs(app, basePath, enableSwagger, activeCollections, requireAuth) {
 	if (enableSwagger === false || activeCollections.length === 0) return;
-	const { generateOpenApiSpec } = await import("./openapi-generator-DqSIwNLV.js");
+	const { generateOpenApiSpec } = await import("./openapi-generator-C3_pTcsb.js");
 	app.get(`${basePath}/docs`, (c) => {
 		const spec = generateOpenApiSpec(activeCollections, {
 			basePath,
@@ -15546,6 +15517,34 @@ function createAuth(transport, options) {
 		transport.setToken(null);
 		emit("SIGNED_OUT", null);
 	}
+	/**
+	* Recover from a 401 on an ordinary API request.
+	*
+	* Returns `true` when the caller should retry — we minted a fresh access
+	* token. When the refresh is rejected *fatally* (the refresh token itself
+	* is invalid, expired or revoked) this client can no longer act as the
+	* user at all, so we drop the session and emit `SIGNED_OUT`. UIs gate on
+	* that event, so they show their login screen instead of leaving the user
+	* staring at "Invalid or expired token" on every view.
+	*
+	* Transient failures (offline, 5xx, backend restarting) keep the session:
+	* the scheduled refresh backs off and retries, and the token is very
+	* likely still good once the backend answers again.
+	*/
+	async function handleUnauthorized() {
+		if (!currentSession) return false;
+		if (authFlowMode !== "cookie" && !currentSession.refreshToken) {
+			abandonSessionLocally();
+			return false;
+		}
+		try {
+			await refreshSession();
+			return true;
+		} catch (err) {
+			if (isFatalRefreshError(err)) abandonSessionLocally();
+			return false;
+		}
+	}
 	async function attemptScheduledRefresh(attempt) {
 		try {
 			await refreshSession();
@@ -16047,6 +16046,7 @@ function createAuth(transport, options) {
 		signInWithSpotify,
 		signOut,
 		refreshSession,
+		handleUnauthorized,
 		getUser,
 		findUserByEmail,
 		updateUser,
@@ -20190,14 +20190,7 @@ function createRebaseClient(options) {
 				} catch (e) {}
 				return session?.accessToken || options.token || "";
 			},
-			onUnauthorized: options.onUnauthorized || (async () => {
-				try {
-					await auth.refreshSession();
-					return true;
-				} catch (e) {
-					return false;
-				}
-			})
+			onUnauthorized: options.onUnauthorized || (() => auth.handleUnauthorized())
 		});
 		auth.onAuthStateChange((event, session) => {
 			if (!ws) return;
@@ -20207,14 +20200,7 @@ function createRebaseClient(options) {
 			}
 		});
 	}
-	if (!options.onUnauthorized) transport.setOnUnauthorized(async () => {
-		try {
-			await auth.refreshSession();
-			return true;
-		} catch (e) {
-			return false;
-		}
-	});
+	if (!options.onUnauthorized) transport.setOnUnauthorized(() => auth.handleUnauthorized());
 	/**
 	* Suggest the closest known collection key for a mistyped accessor.
 	* Uses edit-distance-1 and prefix matching — no external dependency.
@@ -20952,7 +20938,7 @@ async function _initializeRebaseBackend(config) {
 	if (schemaEditorEnabled && config.collectionsDir) {
 		let editorModule;
 		try {
-			editorModule = await import("./schema-editor-routes-D3ef8zu1.js");
+			editorModule = await import("./schema-editor-routes-CF-g0gVN.js");
 		} catch (err) {
 			if (err?.code === "ERR_MODULE_NOT_FOUND") logger.warn("Schema Editor disabled: its dependency ts-morph is not installed. Run `npm install ts-morph@28.0.0` to enable it.");
 			else throw err;
@@ -22461,8 +22447,11 @@ var DEV_PORT_FILENAME = ".rebase-dev-port";
 * Try to `listen` on `startPort`. If the port is busy (`EADDRINUSE`), increment
 * and retry up to `maxAttempts` times.
 *
-* When a port file already exists (written by a previous run), the saved port
-* is tried first to maintain port affinity across tsx watch restarts.
+* When a port file written by a previous run exists *and that run asked for the
+* same `startPort`*, the port it landed on is tried first, so tsx watch restarts
+* keep the address the frontend was configured with. A different `startPort` means
+* the configuration changed and the file is ignored — an explicitly requested port
+* is never overridden by a stale one.
 *
 * Resolves with the port that was actually bound.
 *
@@ -22490,8 +22479,10 @@ function listenWithPortRetry(server, startPort, options) {
 	if (portFileDir) try {
 		const portFile = path.join(portFileDir, DEV_PORT_FILENAME);
 		if (fs.existsSync(portFile)) {
-			const saved = parseInt(fs.readFileSync(portFile, "utf-8").trim(), 10);
-			if (saved > 0 && saved < 65536 && saved !== startPort) affinityPort = saved;
+			const [savedRaw, requestedRaw] = fs.readFileSync(portFile, "utf-8").trim().split(/\s+/);
+			const saved = parseInt(savedRaw, 10);
+			const requestedThen = requestedRaw === void 0 ? NaN : parseInt(requestedRaw, 10);
+			if (saved > 0 && saved < 65536 && saved !== startPort && (Number.isNaN(requestedThen) || requestedThen === startPort)) affinityPort = saved;
 		}
 	} catch {}
 	return new Promise((resolve, reject) => {
@@ -22509,24 +22500,29 @@ function listenWithPortRetry(server, startPort, options) {
 			}
 			const port = portsToTry[index];
 			attempt++;
-			const onError = (err) => {
-				if (err.code === "EADDRINUSE") {
-					server.removeListener("error", onError);
-					tryNext(index + 1);
-				} else reject(err);
-			};
-			server.once("error", onError);
-			server.listen(port, host, () => {
-				server.removeListener("error", onError);
+			const onListening = () => {
+				cleanup();
 				if (portFileDir) {
 					try {
 						const portFile = path.join(portFileDir, DEV_PORT_FILENAME);
-						fs.writeFileSync(portFile, String(port), "utf-8");
+						fs.writeFileSync(portFile, `${port} ${startPort}`, "utf-8");
 					} catch {}
 					writeStateFile(portFileDir, port, options?.serviceKey);
 				}
 				resolve(port);
-			});
+			};
+			const onError = (err) => {
+				cleanup();
+				if (err.code === "EADDRINUSE") tryNext(index + 1);
+				else reject(err);
+			};
+			function cleanup() {
+				server.removeListener("listening", onListening);
+				server.removeListener("error", onError);
+			}
+			server.once("error", onError);
+			server.once("listening", onListening);
+			server.listen(port, host);
 		}
 		tryNext(0);
 	});