@rebasepro/server 0.13.0 → 0.13.1-canary.g249daa1

package/dist/storage/keys.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Canonical storage keys.
+ *
+ * Storage is not under RLS, so a `storageAuthorize` hook is the whole access
+ * control model — and a hook can only be correct if the key it is shown is the
+ * key that is written. That is the invariant this module exists to hold: one
+ * canonical string, computed once per request, handed to the hook, to the
+ * controller, and to the download token alike.
+ *
+ * ## Why rejecting beats stripping
+ *
+ * The previous `sanitizeStorageKey` *stripped* `../` in a single pass. Two
+ * things were wrong with that, and only one of them was the obvious one.
+ *
+ * The obvious one: a single pass is not a fixed point. `....//` contains `../`
+ * at offset 2, so removing it leaves `../` behind — the sanitizer manufactured
+ * the traversal it was there to remove. `users/alice/....//bob/x` came out as
+ * `users/alice/../bob/x`, which a prefix hook reads as alice's (it starts with
+ * `users/alice/`) and the filesystem reads as bob's. The hook approved one
+ * object and the controller wrote another.
+ *
+ * The subtler one, and the reason this is a rewrite rather than a loop: even a
+ * correct strip is a silent rewrite. A caller who asks to store at `a/../b` and
+ * gets an object at `a/b` was not protected, they were misled — and every later
+ * read, ownership row and audit line now refers to a path nobody chose. So a key
+ * that means something other than what it says is refused (400), not repaired.
+ *
+ * Note what is NOT traversal under this rule: `....` is an ordinary directory
+ * name, and `users/alice/....//bob/x` canonicalizes to
+ * `users/alice/..../bob/x` — still comfortably inside alice's prefix, which is
+ * exactly right. Only a real `..` segment is refused.
+ */
+/** Longest key accepted, in UTF-16 code units. Matches the previous cap. */
+export declare const MAX_STORAGE_KEY_LENGTH = 1024;
+/**
+ * A key that cannot be canonicalized. Carries no path back to the caller
+ * beyond what they sent, so it is safe to surface as a 400 message.
+ */
+export declare class InvalidStorageKeyError extends Error {
+    constructor(message: string);
+}
+/**
+ * Canonicalize a caller-supplied storage key, or throw
+ * {@link InvalidStorageKeyError}.
+ *
+ * Normalizations applied (safe, idempotent, and meaning-preserving):
+ * - leading slashes removed — `/a/b` and `a/b` name the same object
+ * - `.` segments and repeated slashes collapsed
+ *
+ * Refusals (the key means something other than what it says):
+ * - any `..` segment, on either separator, at any depth
+ * - null bytes
+ * - keys longer than {@link MAX_STORAGE_KEY_LENGTH}
+ *
+ * A trailing slash is preserved: it is how the folder route marks a prefix.
+ */
+export declare function canonicalStorageKey(rawKey: string): string;
+/**
+ * Canonicalize, or return `null` when the key is not canonicalizable.
+ *
+ * For callers that must fail closed without an exception — the download-token
+ * middleware compares a request path against a granted path, and a key it
+ * cannot canonicalize simply matches nothing.
+ */
+export declare function tryCanonicalStorageKey(rawKey: string): string | null;

package/dist/utils/logging.d.ts

@@ -3,7 +3,3 @@
  * Call this early in your application to set up proper logging levels
  */
 export declare function configureLogLevel(logLevel?: string): void;
-/**
- * Reset console methods to their original state
- */
-export declare function resetConsole(): void;

package/dist/utils/sql.d.ts

@@ -1,27 +1,32 @@
 import { SQL } from "drizzle-orm";
 /**
- * Returns a SQL chunk calling `auth.uid()` — the current user's ID.
- * This is a PostgreSQL RLS helper function created in the `auth` schema
+ * Returns a SQL chunk calling `rebase.uid()` — the current user's ID.
+ * This is a PostgreSQL RLS helper function created in the `rebase` schema
  * that reads `app.uid` set per-transaction by `withAuth()`.
  *
+ * The function moved from `auth.uid()` to `rebase.uid()` in 1.0 — `auth` is
+ * Supabase's schema, and taking it meant Rebase could not be pointed at a
+ * database that already had one. Use this helper rather than writing the call
+ * by hand and the move costs you nothing.
+ *
  * @example
  * sql`${table.uid} = ${authUid()}`
  */
 export declare const authUid: () => SQL;
 /**
- * Returns a SQL chunk calling `auth.roles()` — the current user's roles
+ * Returns a SQL chunk calling `rebase.roles()` — the current user's roles
  * as a comma-separated string.
  * Reads `app.user_roles` set per-transaction by `withAuth()`.
  *
  * @example
- * sql`auth.roles() ~ 'admin'`
+ * sql`${authRoles()} ~ 'admin'`
  */
 export declare const authRoles: () => SQL;
 /**
- * Returns a SQL chunk calling `auth.jwt()` — the full JWT claims as JSONB.
+ * Returns a SQL chunk calling `rebase.jwt()` — the full JWT claims as JSONB.
  * Reads `app.jwt` set per-transaction by `withAuth()`.
  *
  * @example
- * sql`auth.jwt()->>'sub'`
+ * sql`${authJwt()}->>'sub'`
  */
 export declare const authJwt: () => SQL;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server",
   "type": "module",
-  "version": "0.13.0",
+  "version": "0.13.1-canary.g249daa1",
   "description": "Database-Agnostic Backend Core for Rebase",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -44,10 +44,10 @@
     "jsonwebtoken": "^9.0.3",
     "ws": "^8.21.1",
     "zod": "^4.4.3",
-    "@rebasepro/client": "0.13.0",
-    "@rebasepro/common": "0.13.0",
-    "@rebasepro/types": "0.13.0",
-    "@rebasepro/utils": "0.13.0"
+    "@rebasepro/client": "0.13.1-canary.g249daa1",
+    "@rebasepro/common": "0.13.1-canary.g249daa1",
+    "@rebasepro/types": "0.13.1-canary.g249daa1",
+    "@rebasepro/utils": "0.13.1-canary.g249daa1"
   },
   "devDependencies": {
     "@jest/globals": "^30.4.1",
@@ -57,7 +57,7 @@
     "@types/nodemailer": "^8.0.1",
     "@types/ws": "^8.18.1",
     "cross-env": "^10.1.0",
-    "hono": "^4.12.27",
+    "hono": "^4.13.0",
     "jest": "^30.4.2",
     "ts-jest": "29.4.12",
     "typescript": "^6.0.3",

package/dist/admin_block-CcSGdH7M.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"admin_block-CcSGdH7M.js","names":[],"sources":["../../types/src/types/admin_block.ts"],"sourcesContent":["/**\n * The keys of a collection's admin block, as data.\n *\n * There is no *type* for the block in this package any more, and that is the point:\n * `admin` is not declared on `BaseCollectionConfig` or on any property here, so a\n * BaaS install cannot even write one. `@rebasepro/admin-types` adds the field back by\n * declaration merging, which is why installing it is what makes the admin surface\n * appear.\n *\n * The *list* still has to live here, because three runtime consumers need it and two\n * of them are core — see below.\n */\n\n/**\n * Every key that belongs inside a collection's `admin` block, as data.\n *\n * The type that describes these fields is `AdminCollectionOptions` in\n * `@rebasepro/admin-types`, and it is erased at build time — but three runtime\n * consumers need the list, and two of them are core:\n *\n * - `serializeCollections`, to drop the block from the contract\n * - the ts-morph schema editor in `@rebasepro/server`, which rewrites collection\n *   files on disk from the admin panel and has to know where each key goes. A key\n *   missing from this list gets written to the *top level* of the file, where the\n *   backend ignores it and the panel never finds it again.\n * - the `collections-admin-block` codemod\n *\n * `@rebasepro/admin-types` re-exports this and asserts it names only real option\n * keys; the count is pinned by a test there.\n *\n * @group Models\n */\nexport const ADMIN_COLLECTION_KEYS = [\n    \"Actions\",\n    \"additionalFields\",\n    \"alwaysApplyDefaultValues\",\n    \"components\",\n    \"defaultEntityAction\",\n    \"defaultFilter\",\n    \"defaultSelectedView\",\n    \"defaultSize\",\n    \"defaultViewMode\",\n    \"disableDefaultActions\",\n    \"enabledViews\",\n    \"entityActions\",\n    \"entityViews\",\n    \"exportable\",\n    \"filterPresets\",\n    \"fixedFilter\",\n    \"form\",\n    \"formAutoSave\",\n    \"formView\",\n    \"group\",\n    \"hideFromNavigation\",\n    \"hideIdFromCollection\",\n    \"hideIdFromForm\",\n    \"icon\",\n    \"includeJsonView\",\n    \"inlineEditing\",\n    \"kanban\",\n    \"listProperties\",\n    \"localChangesBackup\",\n    \"openEntityMode\",\n    \"orderProperty\",\n    \"pagination\",\n    \"previewProperties\",\n    \"propertiesOrder\",\n    \"selectionController\",\n    \"selectionEnabled\",\n    \"sideDialogWidth\",\n    \"sort\",\n    \"titleProperty\"\n] as const;\n\n/** A key of a collection's `admin` block. @group Models */\nexport type AdminCollectionKey = typeof ADMIN_COLLECTION_KEYS[number];\n\n/**\n * Every key that belongs inside a *property's* `admin` block, as data.\n *\n * The union of `AdminPropertyOptions` and its per-type extensions\n * (`AdminStringOptions`, `AdminArrayOptions`, …) in `@rebasepro/admin-types`.\n * It lives here for the same reason {@link ADMIN_COLLECTION_KEYS} does: the\n * runtime consumers are core packages that the BaaS guard forbids from\n * importing `@rebasepro/admin-types`. Here it is the boot-time collection\n * validator in `@rebasepro/server`, which has to tell \"you left `readOnly` at\n * the top of the property, where nothing reads it\" apart from \"you invented a\n * key we have never heard of\".\n *\n * `@rebasepro/admin-types` re-exports this and asserts it names only real\n * option keys.\n *\n * @group Models\n */\nexport const ADMIN_PROPERTY_KEYS = [\n    \"canAddElements\",\n    \"clearable\",\n    \"columnWidth\",\n    \"customProps\",\n    \"disabled\",\n    \"expanded\",\n    \"Field\",\n    \"Filter\",\n    \"filterOperators\",\n    \"fixedFilter\",\n    \"hideFromCollection\",\n    \"includeEntityLink\",\n    \"includeId\",\n    \"markdown\",\n    \"minimalistView\",\n    \"multiline\",\n    \"Preview\",\n    \"previewAsTag\",\n    \"previewProperties\",\n    \"readOnly\",\n    \"sortable\",\n    \"span\",\n    \"spreadChildren\",\n    \"urlPreview\",\n    \"widget\",\n] as const;\n\n/** A key of a property's `admin` block. @group Models */\nexport type AdminPropertyKey = typeof ADMIN_PROPERTY_KEYS[number];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,IAAa,wBAAwB;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;;;;;;;;;;;;;;;;;AAsBA,IAAa,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ"}