@rebasepro/server 0.12.1-canary.g4e7bcbf → 0.12.1-canary.g52d71ee

package/dist/auth/index.d.ts

@@ -28,7 +28,7 @@ export type { AuthModuleConfig, CookieAuthConfig } from "./routes";
 export { mountMagicLinkRoutes } from "./magic-link-routes";
 export { createResetPasswordRoute } from "./reset-password-admin";
 export type { ResetPasswordRouteConfig } from "./reset-password-admin";
-export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter, createApiKeyRateLimiter, createDataRateLimiter, apiKeyKeyGenerator } from "./rate-limiter";
+export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter, createDataRateLimiter, apiKeyKeyGenerator } from "./rate-limiter";
 export type { DataRateLimitConfig } from "./rate-limiter";
 export { MemoryRateLimitStore } from "./rate-limit-store";
 export type { RateLimitStore, RateLimitDecision } from "./rate-limit-store";

package/dist/auth/rate-limiter.d.ts

@@ -98,15 +98,4 @@ export interface DataRateLimitConfig {
  * `enabled: false` rather than pay for it twice.
  */
 export declare function createDataRateLimiter(config?: DataRateLimitConfig): MiddlewareHandler<HonoEnv>;
-/**
- * Create a rate limiter specifically for API key requests.
- *
- * @deprecated Use {@link createDataRateLimiter}, which limits signed-in users
- * and anonymous callers too. This one skips every request that is not
- * API-key-authenticated, which was most of them.
- *
- * @param defaultLimit - Fallback limit when the key has no `rate_limit` set.
- * @param windowMs     - Time window in milliseconds (default: 15 minutes).
- */
-export declare function createApiKeyRateLimiter(defaultLimit?: number, windowMs?: number): MiddlewareHandler<HonoEnv>;
 export {};

package/dist/{auth-B9AJsH3u.js → auth-CuC9M2x6.js}

@@ -2,8 +2,8 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { i as __toESM, n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
+import { _ as ANONYMOUS_USER_ID, v as isAnonymousUid } from "./src-Cum9kox5.js";
 import "./src-_qQ3RNCK.js";
-import { n as isAnonymousUid, t as ANONYMOUS_USER_ID } from "./policy-B5d-asZT.js";
 import { t as isSQLAdmin } from "./backend-CIxN4FVm.js";
 import { t as logger } from "./logger-BYU66ENZ.js";
 import { n as errorHandler, t as ApiError } from "./errors-CgkCzoj7.js";
@@ -61,6 +61,39 @@ function isPublicStoragePath(path) {
 	return p.startsWith("public/") || p.startsWith(`default/public/`);
 }
 //#endregion
+//#region ../common/src/util/email.ts
+/**
+* Email normalization — one implementation, because the database enforces it.
+*
+* `ensureAuthTablesExist` puts a `UNIQUE INDEX ON users (lower(email))` on the
+* auth table. That index decides what "the same address" means, and it does not
+* trim: to Postgres, `' foo@bar.com'` and `'foo@bar.com'` are two addresses and
+* both may exist. So every write that reaches the column has to agree with
+* every read, exactly, or the two disagree in the one direction that matters —
+* a row that exists and cannot be found.
+*
+* That is not hypothetical. The lookup path trimmed and the admin create paths
+* did not, so a user created through `POST /api/data/users` or
+* `POST /api/auth/admin/users` with a stray space was stored untrimmed,
+* survived the unique index alongside the real address, and was unreachable by
+* login forever after. The HTTP auth routes were unaffected only because Zod's
+* `.email()` happens to reject surrounding whitespace — a guard on a different
+* layer, for a different reason, that the admin paths do not sit behind.
+*
+* It lives in `common` because `server`, `server-postgres` and `server-mongo`
+* all write this column and must agree exactly, and `common` is the only
+* package all three already depend on.
+*/
+/**
+* Canonical form of an email address: trimmed, lower-cased.
+*
+* Non-strings pass through untouched, so this is safe to apply to a value out
+* of a partial update payload whose type is not known yet.
+*/
+function normalizeEmail(email) {
+	return typeof email === "string" ? email.trim().toLowerCase() : email;
+}
+//#endregion
 //#region src/auth/api-keys/api-key-permission-guard.ts
 /**
 * Map an HTTP method string to an `ApiKeyOperation`.
@@ -1399,7 +1432,7 @@ async function prepareAdminUserValues(body, ctx) {
 	const passwordHash = await resolvedHooks.hashPassword(clearPassword);
 	const values = { ...body };
 	values.passwordHash = passwordHash;
-	if (values.email) values.email = values.email.toLowerCase();
+	if (values.email) values.email = normalizeEmail(values.email);
 	values.emailVerified = true;
 	delete values.password;
 	return {
@@ -1744,28 +1777,6 @@ function createDataRateLimiter(config = {}) {
 		}
 	});
 }
-/**
-* Create a rate limiter specifically for API key requests.
-*
-* @deprecated Use {@link createDataRateLimiter}, which limits signed-in users
-* and anonymous callers too. This one skips every request that is not
-* API-key-authenticated, which was most of them.
-*
-* @param defaultLimit - Fallback limit when the key has no `rate_limit` set.
-* @param windowMs     - Time window in milliseconds (default: 15 minutes).
-*/
-function createApiKeyRateLimiter(defaultLimit = 1e3, windowMs = 900 * 1e3) {
-	return createRateLimiter({
-		windowMs,
-		message: "API key rate limit exceeded, please try again later.",
-		keyGenerator: apiKeyKeyGenerator,
-		resolveLimit: (c) => {
-			const apiKey = c.get("apiKey");
-			if (!apiKey) return null;
-			return apiKey.rate_limit ?? defaultLimit;
-		}
-	});
-}
 //#endregion
 //#region ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/core.js
 var _a$1;
@@ -6254,7 +6265,7 @@ function mountSessionRoutes(opts) {
 	if (config.allowUserLookup) router.post("/find-user", defaultAuthLimiter, requireAuth, async (c) => {
 		if (!c.get("user")) throw ApiError.unauthorized("Not authenticated");
 		const { email } = parseBody(findUserSchema, await c.req.json());
-		const user = await authRepo.getUserByEmail(email.toLowerCase());
+		const user = await authRepo.getUserByEmail(normalizeEmail(email));
 		return c.json({ user: user ? {
 			uid: user.id,
 			displayName: user.displayName ?? null,
@@ -6362,10 +6373,10 @@ function mountSessionRoutes(opts) {
 		const { email, password } = parseBody(linkSchema, await c.req.json());
 		const passwordValidation = ops.validatePasswordStrength(password);
 		if (!passwordValidation.valid) throw ApiError.badRequest(passwordValidation.errors.join(". "), "WEAK_PASSWORD");
-		if (await authRepo.getUserByEmail(email.toLowerCase())) throw ApiError.conflict("Email already registered", "EMAIL_EXISTS");
+		if (await authRepo.getUserByEmail(normalizeEmail(email))) throw ApiError.conflict("Email already registered", "EMAIL_EXISTS");
 		const passwordHash = await ops.hashPassword(password);
 		const updatedUser = await authRepo.updateUser(user.id, {
-			email: email.toLowerCase(),
+			email: normalizeEmail(email),
 			passwordHash,
 			isAnonymous: false
 		});
@@ -6641,7 +6652,7 @@ function createAuthRoutes(config) {
 		if (await authRepo.getUserByEmail(email)) throw ApiError.conflict("Email already registered", "EMAIL_EXISTS");
 		const passwordHash = await ops.hashPassword(password);
 		let createData = {
-			email: email.toLowerCase(),
+			email: normalizeEmail(email),
 			passwordHash,
 			displayName: displayName || void 0
 		};
@@ -6733,7 +6744,7 @@ function createAuthRoutes(config) {
 					});
 				} else {
 					user = await authRepo.createUser({
-						email: externalUser.email.toLowerCase(),
+						email: normalizeEmail(externalUser.email),
 						displayName: externalUser.displayName || void 0,
 						photoUrl: externalUser.photoUrl || void 0
 					});
@@ -7307,7 +7318,7 @@ function createAdminUsersRoute(config) {
 		const body = await c.req.json();
 		const { email, roles } = body;
 		if (!email) throw ApiError.badRequest("Email is required");
-		if (await authRepo.getUserByEmail(email.toLowerCase())) throw ApiError.conflict("A user with this email already exists");
+		if (await authRepo.getUserByEmail(normalizeEmail(email))) throw ApiError.conflict("A user with this email already exists");
 		const prepResult = await prepareAdminUserValues(body, {
 			authRepo,
 			emailService,
@@ -7346,7 +7357,7 @@ function createAdminUsersRoute(config) {
 		const { password, email, displayName, roles } = await c.req.json();
 		if (!await authRepo.getUserById(uid)) throw ApiError.notFound("User not found");
 		const updates = {};
-		if (email !== void 0) updates.email = email.toLowerCase();
+		if (email !== void 0) updates.email = normalizeEmail(email);
 		if (displayName !== void 0) updates.displayName = displayName;
 		if (password) {
 			const validation = ops.validatePasswordStrength(password);
@@ -8891,7 +8902,6 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	apiKeyKeyGenerator: () => apiKeyKeyGenerator,
 	configureJwt: () => configureJwt,
 	createAdapterAuthMiddleware: () => createAdapterAuthMiddleware,
-	createApiKeyRateLimiter: () => createApiKeyRateLimiter,
 	createApiKeyRoutes: () => createApiKeyRoutes,
 	createApiKeyStore: () => createApiKeyStore,
 	createAppleProvider: () => createAppleProvider,
@@ -8948,4 +8958,4 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 //#endregion
 export { httpMethodToOperation as $, getEmailVerificationTemplate as A, optionalAuth as B, createDataRateLimiter as C, validatePasswordStrength as D, hashPassword as E, createAdapterAuthMiddleware as F, createApiKeyPreAuth as G, queryTokenAuth as H, createAuthMiddleware as I, isApiKeyToken as J, createFunctionApiKeyGuard as K, createRequireAuth as L, getPasswordResetTemplate as M, getUserInvitationTemplate as N, verifyPassword as O, getWelcomeEmailTemplate as P, scopeDataDriver as Q, extractUserFromToken as R, _coercedNumber as S, resolveAuthHooks as T, requireAdmin as U, publicObjectAuth as V, requireAuth as W, extractBearerToken as X, validateApiKey as Y, safeCompare as Z, createBuiltinAuthAdapter as _, createSpotifyProvider as a, object as b, createGitLabProvider as c, createFacebookProvider as d, isOperationAllowed as et, createAppleProvider as f, createGoogleProvider as g, createLinkedinProvider as h, createApiKeyStore as i, resolveClientListLimit as it, getMagicLinkTemplate as j, generateSecurePassword as k, createDiscordProvider as l, createGitHubProvider as m, createCustomAuthAdapter as n, isPublicStoragePath as nt, createSlackProvider as o, createMicrosoftProvider as p, createStorageApiKeyGuard as q, createApiKeyRoutes as r, MAX_LIST_LIMIT as rt, createBitbucketProvider as s, auth_exports as t, PUBLIC_STORAGE_PREFIX as tt, createTwitterProvider as u, ZodNumber as v, MemoryRateLimitStore as w, string as x, _enum as y, fileTokenAuth as z };
 
-//# sourceMappingURL=auth-B9AJsH3u.js.map
+//# sourceMappingURL=auth-CuC9M2x6.js.map