@rebasepro/server 0.12.1-canary.gf5f1d39 → 0.13.0

package/dist/admin_block-CcSGdH7M.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin_block-CcSGdH7M.js","names":[],"sources":["../../types/src/types/admin_block.ts"],"sourcesContent":["/**\n * The keys of a collection's admin block, as data.\n *\n * There is no *type* for the block in this package any more, and that is the point:\n * `admin` is not declared on `BaseCollectionConfig` or on any property here, so a\n * BaaS install cannot even write one. `@rebasepro/admin-types` adds the field back by\n * declaration merging, which is why installing it is what makes the admin surface\n * appear.\n *\n * The *list* still has to live here, because three runtime consumers need it and two\n * of them are core — see below.\n */\n\n/**\n * Every key that belongs inside a collection's `admin` block, as data.\n *\n * The type that describes these fields is `AdminCollectionOptions` in\n * `@rebasepro/admin-types`, and it is erased at build time — but three runtime\n * consumers need the list, and two of them are core:\n *\n * - `serializeCollections`, to drop the block from the contract\n * - the ts-morph schema editor in `@rebasepro/server`, which rewrites collection\n *   files on disk from the admin panel and has to know where each key goes. A key\n *   missing from this list gets written to the *top level* of the file, where the\n *   backend ignores it and the panel never finds it again.\n * - the `collections-admin-block` codemod\n *\n * `@rebasepro/admin-types` re-exports this and asserts it names only real option\n * keys; the count is pinned by a test there.\n *\n * @group Models\n */\nexport const ADMIN_COLLECTION_KEYS = [\n    \"Actions\",\n    \"additionalFields\",\n    \"alwaysApplyDefaultValues\",\n    \"components\",\n    \"defaultEntityAction\",\n    \"defaultFilter\",\n    \"defaultSelectedView\",\n    \"defaultSize\",\n    \"defaultViewMode\",\n    \"disableDefaultActions\",\n    \"enabledViews\",\n    \"entityActions\",\n    \"entityViews\",\n    \"exportable\",\n    \"filterPresets\",\n    \"fixedFilter\",\n    \"form\",\n    \"formAutoSave\",\n    \"formView\",\n    \"group\",\n    \"hideFromNavigation\",\n    \"hideIdFromCollection\",\n    \"hideIdFromForm\",\n    \"icon\",\n    \"includeJsonView\",\n    \"inlineEditing\",\n    \"kanban\",\n    \"listProperties\",\n    \"localChangesBackup\",\n    \"openEntityMode\",\n    \"orderProperty\",\n    \"pagination\",\n    \"previewProperties\",\n    \"propertiesOrder\",\n    \"selectionController\",\n    \"selectionEnabled\",\n    \"sideDialogWidth\",\n    \"sort\",\n    \"titleProperty\"\n] as const;\n\n/** A key of a collection's `admin` block. @group Models */\nexport type AdminCollectionKey = typeof ADMIN_COLLECTION_KEYS[number];\n\n/**\n * Every key that belongs inside a *property's* `admin` block, as data.\n *\n * The union of `AdminPropertyOptions` and its per-type extensions\n * (`AdminStringOptions`, `AdminArrayOptions`, …) in `@rebasepro/admin-types`.\n * It lives here for the same reason {@link ADMIN_COLLECTION_KEYS} does: the\n * runtime consumers are core packages that the BaaS guard forbids from\n * importing `@rebasepro/admin-types`. Here it is the boot-time collection\n * validator in `@rebasepro/server`, which has to tell \"you left `readOnly` at\n * the top of the property, where nothing reads it\" apart from \"you invented a\n * key we have never heard of\".\n *\n * `@rebasepro/admin-types` re-exports this and asserts it names only real\n * option keys.\n *\n * @group Models\n */\nexport const ADMIN_PROPERTY_KEYS = [\n    \"canAddElements\",\n    \"clearable\",\n    \"columnWidth\",\n    \"customProps\",\n    \"disabled\",\n    \"expanded\",\n    \"Field\",\n    \"Filter\",\n    \"filterOperators\",\n    \"fixedFilter\",\n    \"hideFromCollection\",\n    \"includeEntityLink\",\n    \"includeId\",\n    \"markdown\",\n    \"minimalistView\",\n    \"multiline\",\n    \"Preview\",\n    \"previewAsTag\",\n    \"previewProperties\",\n    \"readOnly\",\n    \"sortable\",\n    \"span\",\n    \"spreadChildren\",\n    \"urlPreview\",\n    \"widget\",\n] as const;\n\n/** A key of a property's `admin` block. @group Models */\nexport type AdminPropertyKey = typeof ADMIN_PROPERTY_KEYS[number];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,IAAa,wBAAwB;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;;;;;;;;;;;;;;;;;AAsBA,IAAa,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ"}

package/dist/api/rest/write-validation.d.ts

@@ -20,3 +20,25 @@ export declare function assertKnownWriteFields(values: Record<string, unknown>,
     rowIndex?: number;
     extraKnownFields?: readonly string[];
 }): void;
+/**
+ * Narrow response rows to the fields the caller asked for.
+ *
+ * `?fields=id,title` is documented in the generated OpenAPI — "Comma-separated
+ * list of fields to return (field selection)" — and it is the first thing shown
+ * on every endpoint in the API Explorer. It was parsed into `options.fields`
+ * and then read by nothing at all: no driver referenced it, and every request
+ * came back with every column. A caller asking for two fields of a `posts` row
+ * still received its whole `content`.
+ *
+ * This shapes the *response*, which is what the parameter says it does; it is
+ * not a column pushdown, so it saves bandwidth rather than database work.
+ *
+ * `id` always survives. Rows are addressed by it everywhere above this layer —
+ * the admin table, realtime reconciliation, the offline cache — and a row that
+ * arrives without one is not a smaller row, it is an unusable one. Asking for
+ * `fields=title` and being unable to open the record you clicked is a worse
+ * answer than one extra key.
+ */
+export declare function projectResponseFields<T extends Record<string, unknown>>(rows: T[], fields: readonly string[] | undefined, collection: CollectionConfig, options?: {
+    include?: readonly string[];
+}): T[];

package/dist/auth/bearer-token.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Parsing of the `Authorization: Bearer <token>` header.
+ *
+ * Its own module rather than a helper inside `middleware.ts`, because the
+ * API-key middleware needs it too and `middleware.ts` already imports from
+ * there — putting it in either one would close an import cycle.
+ *
+ * @module
+ */
+/**
+ * Pull the token out of an `Authorization: Bearer <token>` header.
+ *
+ * RFC 7235 §2.1 makes the auth-scheme name case-insensitive, and plenty of
+ * clients send `bearer` — HTTP libraries that lower-case what they emit,
+ * hand-written curl, proxies that normalise headers. Matching `"Bearer "`
+ * exactly turned those into a 401 that, from the caller's side, is
+ * indistinguishable from a rejected token; people spend an afternoon
+ * regenerating credentials that were fine. Only the scheme is folded — the
+ * token itself is returned byte-for-byte.
+ *
+ * Returns `undefined` when there is no header or it names another scheme.
+ * That is deliberately distinct from an empty token (`Bearer ` with nothing
+ * after it), which callers still route into verification so it fails as a bad
+ * token rather than as a missing header.
+ */
+export declare function extractBearerToken(authHeader: string | undefined | null): string | undefined;

package/dist/auth/index.d.ts

@@ -28,7 +28,7 @@ export type { AuthModuleConfig, CookieAuthConfig } from "./routes";
 export { mountMagicLinkRoutes } from "./magic-link-routes";
 export { createResetPasswordRoute } from "./reset-password-admin";
 export type { ResetPasswordRouteConfig } from "./reset-password-admin";
-export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter, createApiKeyRateLimiter, createDataRateLimiter, apiKeyKeyGenerator } from "./rate-limiter";
+export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter, createDataRateLimiter, apiKeyKeyGenerator } from "./rate-limiter";
 export type { DataRateLimitConfig } from "./rate-limiter";
 export { MemoryRateLimitStore } from "./rate-limit-store";
 export type { RateLimitStore, RateLimitDecision } from "./rate-limit-store";

package/dist/auth/middleware.d.ts

@@ -3,6 +3,8 @@ import { DataDriver } from "@rebasepro/types";
 import { AccessTokenPayload } from "./jwt";
 import type { HonoEnv } from "../api/types";
 import type { ApiKeyStore } from "./api-keys/api-key-store";
+import { extractBearerToken } from "./bearer-token";
+export { extractBearerToken };
 /**
  * Result from a custom auth validator.
  * - `false`/`null`/`undefined` = not authenticated

package/dist/auth/rate-limiter.d.ts

@@ -98,15 +98,4 @@ export interface DataRateLimitConfig {
  * `enabled: false` rather than pay for it twice.
  */
 export declare function createDataRateLimiter(config?: DataRateLimitConfig): MiddlewareHandler<HonoEnv>;
-/**
- * Create a rate limiter specifically for API key requests.
- *
- * @deprecated Use {@link createDataRateLimiter}, which limits signed-in users
- * and anonymous callers too. This one skips every request that is not
- * API-key-authenticated, which was most of them.
- *
- * @param defaultLimit - Fallback limit when the key has no `rate_limit` set.
- * @param windowMs     - Time window in milliseconds (default: 15 minutes).
- */
-export declare function createApiKeyRateLimiter(defaultLimit?: number, windowMs?: number): MiddlewareHandler<HonoEnv>;
 export {};

package/dist/auth/require-auth.d.ts

@@ -0,0 +1,39 @@
+import type { AuthAdapter } from "@rebasepro/types";
+import type { RebaseAuthConfig } from "../init";
+/**
+ * Whether the `auth` config is an `AuthAdapter` (it can verify a request) or a
+ * plain `RebaseAuthConfig`. Lives here rather than in `init.ts` so this module
+ * stays free of it; `init.ts` re-exports it under its original name.
+ */
+export declare function isAuthAdapter(auth: RebaseAuthConfig | AuthAdapter): auth is AuthAdapter;
+/**
+ * Does this server require an authenticated caller?
+ *
+ * One predicate, because there are two enforcement points — the HTTP data
+ * routes and the realtime socket — and they used to compute it separately. The
+ * socket's copy read
+ *
+ * ```ts
+ * authConfig?.requireAuth !== false && !!authConfig?.jwtSecret
+ * ```
+ *
+ * which differs from this in two ways, both of them open. With no auth config
+ * at all it returned `false` while the HTTP side returned `true`, so a server
+ * that answered 401 to every `/api/data` read served the same rows over the
+ * socket. And an explicit `requireAuth: true` was ANDed away whenever the
+ * credential came from an adapter rather than a local `jwtSecret` — asking for
+ * authentication was what switched it off.
+ *
+ * It is worth stating why that is worse than an ordinary missing check: the
+ * socket seeds each session with `authenticated: !requireAuth`, so a `false`
+ * here does not skip a gate, it marks every client that connects as already
+ * past it.
+ *
+ * Its own module rather than a helper in `init.ts` so the drivers can import it
+ * without pulling the backend entry point in behind it.
+ *
+ * - an `AuthAdapter` always implies auth is required (secure by default)
+ * - a `RebaseAuthConfig` is honoured, and only an explicit `false` opens it
+ * - no auth configuration at all defaults to required
+ */
+export declare function resolveRequireAuth(auth?: RebaseAuthConfig | AuthAdapter): boolean;