@rebasepro/server 0.13.0 → 0.13.1-canary.g06dbe5b

package/dist/init/docs.d.ts

@@ -1,4 +1,13 @@
 import { Hono } from "hono";
 import { CollectionConfig } from "@rebasepro/types";
 import { HonoEnv } from "../api/types";
-export declare function mountOpenApiDocs(app: Hono<HonoEnv>, basePath: string, enableSwagger: boolean | undefined, activeCollections: CollectionConfig[], requireAuth: boolean): Promise<void>;
+/**
+ * Serve the OpenAPI document, and Swagger UI outside production.
+ *
+ * `serverCollections` must be the collections the REST routes were generated
+ * from — the ones whose data source has a `"server"` transport — not every
+ * active collection. A direct-transport collection is served by the client
+ * against its own backend; documenting it here publishes a full set of CRUD
+ * paths that 404, with a Try-It button next to each.
+ */
+export declare function mountOpenApiDocs(app: Hono<HonoEnv>, basePath: string, enableSwagger: boolean | undefined, serverCollections: CollectionConfig[], requireAuth: boolean): Promise<void>;

package/dist/init/process-safety.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Log unhandled promise rejections instead of letting Node terminate the
+ * process.
+ *
+ * Node has terminated on an unhandled rejection since v15. Hono catches
+ * anything thrown or rejected inside an awaited handler, so the ordinary
+ * request path is covered — but a fire-and-forget `void syncToCrm(body)`, a
+ * `setTimeout(async () => …)`, or an unawaited `.then()` in one custom function
+ * rejects outside Hono's frame. The default outcome is that one project's
+ * floating promise ends the process; on the managed runtime that process is
+ * shared, so every other tenant on the pod goes with it, and the request log
+ * points nowhere because the request itself succeeded.
+ *
+ * A logged rejection is the better trade here: the process keeps serving, and
+ * the stack reaches the operator. `uncaughtException` is deliberately **not**
+ * handled — a synchronous throw that escaped every frame leaves the process in
+ * a state we cannot reason about, and swallowing it would be a worse bargain
+ * than a restart.
+ *
+ * Set `REBASE_EXIT_ON_UNHANDLED_REJECTION=1` to restore Node's default.
+ *
+ * @returns An uninstall function (used by tests), or `undefined` when nothing
+ * was installed.
+ */
+export declare function installUnhandledRejectionHandler(): (() => void) | undefined;

package/dist/init.d.ts

@@ -149,6 +149,22 @@ export interface RebaseAuthConfig {
      * ```
      */
     providers?: OAuthProvider<unknown>[];
+    /**
+     * Redirect URIs the OAuth sign-in routes will accept, for every provider.
+     *
+     * Left unset, the only check is the provider's own registered-URI match —
+     * which authorises *every* URI registered on that OAuth client, including
+     * the `localhost` entry someone added for development and the staging host
+     * nobody removed. List the origins this backend actually serves to narrow
+     * it. Compared on origin plus path; query, fragment and a trailing slash
+     * are ignored.
+     *
+     * @example
+     * ```ts
+     * auth: { allowedRedirectUris: ["https://admin.example.com/"] }
+     * ```
+     */
+    allowedRedirectUris?: string[];
     /**
      * Override specific parts of the built-in auth implementation.
      *
@@ -344,6 +360,17 @@ export interface RebaseBackendConfig {
     history?: HistoryConfig;
     enableSwagger?: boolean;
     functionsDir?: string;
+    /**
+     * Per-request ceiling for `/api/functions/*`, in milliseconds.
+     *
+     * Custom functions run code the framework did not write, and nothing else
+     * in the stack bounds it. Defaults to 30000 (or
+     * `REBASE_FUNCTIONS_TIMEOUT_MS`). `0` disables the ceiling — for a function
+     * that legitimately runs long, or a deployment whose proxy already imposes
+     * one. Timed-out requests answer 504; the handler itself cannot be
+     * cancelled, so give outbound calls an `AbortSignal`.
+     */
+    functionsTimeoutMs?: number;
     cronsDir?: string;
     /**
      * Enable/disable database persistence for cron job execution logs.

package/dist/{jwt-DD6EtpGj.js → jwt-Cuq6MwNy.js}

@@ -2,7 +2,7 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { i as __toESM, n as __exportAll, r as __require, t as __commonJSMin } from "./rolldown-runtime-DSJWtz9O.js";
-import { t as logger } from "./logger-BYU66ENZ.js";
+import { t as logger } from "./logger-DfvF_8r-.js";
 import { createHash, randomBytes } from "crypto";
 //#region ../../node_modules/.pnpm/safe-buffer@5.2.1/node_modules/safe-buffer/index.js
 var require_safe_buffer = /* @__PURE__ */ __commonJSMin(((exports, module) => {
@@ -2275,7 +2275,7 @@ var require_verify = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var validateAsymmetricKey = require_validateAsymmetricKey();
 	var PS_SUPPORTED = require_psSupported();
 	var jws = require_jws();
-	var { KeyObject: KeyObject$1, createSecretKey: createSecretKey$1, createPublicKey } = __require("crypto");
+	var { KeyObject: KeyObject$1, createSecretKey: createSecretKey$1, createPublicKey: createPublicKey$1 } = __require("crypto");
 	var PUB_KEY_ALGS = [
 		"RS256",
 		"RS384",
@@ -2343,7 +2343,7 @@ var require_verify = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			if (hasSignature && !secretOrPublicKey) return done(new JsonWebTokenError("secret or public key must be provided"));
 			if (!hasSignature && !options.algorithms) return done(new JsonWebTokenError("please specify \"none\" in \"algorithms\" to verify unsigned tokens"));
 			if (secretOrPublicKey != null && !(secretOrPublicKey instanceof KeyObject$1)) try {
-				secretOrPublicKey = createPublicKey(secretOrPublicKey);
+				secretOrPublicKey = createPublicKey$1(secretOrPublicKey);
 			} catch (_) {
 				try {
 					secretOrPublicKey = createSecretKey$1(typeof secretOrPublicKey === "string" ? Buffer.from(secretOrPublicKey) : secretOrPublicKey);
@@ -4150,17 +4150,21 @@ var require_jsonwebtoken = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#region src/auth/jwt.ts
 var jwt_exports = /* @__PURE__ */ __exportAll({
 	MAX_COOKIE_AGE_MS: () => MAX_COOKIE_AGE_MS,
+	MFA_PENDING_PURPOSE: () => MFA_PENDING_PURPOSE,
 	configureJwt: () => configureJwt,
 	generateAccessToken: () => generateAccessToken,
 	generateDownloadToken: () => generateDownloadToken,
+	generateMfaPendingToken: () => generateMfaPendingToken,
 	generateRefreshToken: () => generateRefreshToken,
 	getAccessTokenExpiry: () => getAccessTokenExpiry,
 	getAccessTokenExpiryMs: () => getAccessTokenExpiryMs,
 	getRefreshTokenExpiry: () => getRefreshTokenExpiry,
 	getRefreshTokenTtlMs: () => getRefreshTokenTtlMs,
 	hashRefreshToken: () => hashRefreshToken,
+	isJwtConfigured: () => isJwtConfigured,
 	verifyAccessToken: () => verifyAccessToken,
-	verifyDownloadToken: () => verifyDownloadToken
+	verifyDownloadToken: () => verifyDownloadToken,
+	verifyMfaPendingToken: () => verifyMfaPendingToken
 });
 var import_jsonwebtoken = /* @__PURE__ */ __toESM(require_jsonwebtoken(), 1);
 var jwtConfig = {
@@ -4202,6 +4206,20 @@ function configureJwt(config) {
 	};
 }
 /**
+* Has this server been given a JWT secret?
+*
+* False on every backend that authenticates through an adapter — Firebase,
+* Clerk, anything with its own tokens — because nothing calls
+* {@link configureJwt} there. Signing paths still throw when it is false, since
+* asking for a token from a server that cannot mint one is a mistake worth
+* hearing about. Paths whose contract is *"tolerate the absence of auth"* must
+* ask first: `optionalAuth` crashing a request because this backend does not do
+* JWT is a 500 on a route that had already decided anonymous was acceptable.
+*/
+function isJwtConfigured() {
+	return Boolean(jwtConfig.secret);
+}
+/**
 * Generate an access token (short-lived, 1 hour by default)
 */
 function generateAccessToken(uid, roles, aal = "aal1", customClaims) {
@@ -4209,8 +4227,8 @@ function generateAccessToken(uid, roles, aal = "aal1", customClaims) {
 	const payload = {
 		uid,
 		roles,
-		aal,
-		...customClaims
+		...customClaims,
+		aal
 	};
 	return import_jsonwebtoken.default.sign(payload, jwtConfig.secret, {
 		expiresIn: jwtConfig.accessExpiresIn,
@@ -4328,6 +4346,50 @@ function getRefreshTokenExpiry() {
 	return new Date(Date.now() + getRefreshTokenTtlMs());
 }
 /**
+* The `purpose` claim carried by a credential that stands between "first factor
+* accepted" and "session issued".
+*
+* A pre-auth token is NOT a session and must never be usable as one:
+* {@link verifyAccessToken} refuses any token carrying a `purpose`, so this
+* value cannot authenticate a request no matter which route it is presented to.
+* The only thing that reads it is the MFA challenge pair, which exchanges it —
+* plus a second factor — for a real session.
+*/
+var MFA_PENDING_PURPOSE = "mfa-pending";
+/**
+* Mint the short-lived credential handed back with an `MFA_REQUIRED` response.
+*
+* Short-lived on purpose: it is the window in which a caller who has proven the
+* first factor may present the second, not a session to be carried around. Five
+* minutes matches the challenge TTL.
+*/
+function generateMfaPendingToken(uid, expiresInSeconds = 300) {
+	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
+	return import_jsonwebtoken.default.sign({
+		purpose: MFA_PENDING_PURPOSE,
+		uid
+	}, jwtConfig.secret, {
+		expiresIn: expiresInSeconds,
+		algorithm: "HS256"
+	});
+}
+/**
+* Verify a pre-auth token and return the user it was minted for.
+*
+* Returns `null` for anything else — including a perfectly valid *access*
+* token, which must not be interchangeable with this one in either direction.
+*/
+function verifyMfaPendingToken(token) {
+	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
+	try {
+		const decoded = import_jsonwebtoken.default.verify(token, jwtConfig.secret, { algorithms: ["HS256"] });
+		if (decoded.purpose !== "mfa-pending" || !decoded.uid) return null;
+		return { uid: decoded.uid };
+	} catch {
+		return null;
+	}
+}
+/**
 * Generate a short-lived download token scoped to a specific file path or prefix
 */
 function generateDownloadToken(path, expiresInSeconds = 300) {
@@ -4359,6 +4421,6 @@ function verifyDownloadToken(token) {
 	}
 }
 //#endregion
-export { generateRefreshToken as a, getRefreshTokenTtlMs as c, verifyAccessToken as d, verifyDownloadToken as f, generateDownloadToken as i, hashRefreshToken as l, configureJwt as n, getAccessTokenExpiry as o, require_jsonwebtoken as p, generateAccessToken as r, getRefreshTokenExpiry as s, MAX_COOKIE_AGE_MS as t, jwt_exports as u };
+export { generateMfaPendingToken as a, getRefreshTokenExpiry as c, isJwtConfigured as d, jwt_exports as f, require_jsonwebtoken as g, verifyMfaPendingToken as h, generateDownloadToken as i, getRefreshTokenTtlMs as l, verifyDownloadToken as m, configureJwt as n, generateRefreshToken as o, verifyAccessToken as p, generateAccessToken as r, getAccessTokenExpiry as s, MAX_COOKIE_AGE_MS as t, hashRefreshToken as u };
 
-//# sourceMappingURL=jwt-DD6EtpGj.js.map
+//# sourceMappingURL=jwt-Cuq6MwNy.js.map