@rebasepro/server 0.13.0 → 0.13.1-canary.gcd6689e

package/dist/{admin_block-CcSGdH7M.js → admin_block-EmIHae6X.js}

@@ -44,6 +44,7 @@ var ADMIN_COLLECTION_KEYS = [
 	"defaultSize",
 	"defaultViewMode",
 	"disableDefaultActions",
+	"display",
 	"enabledViews",
 	"entityActions",
 	"entityViews",
@@ -121,4 +122,4 @@ var ADMIN_PROPERTY_KEYS = [
 //#endregion
 export { ADMIN_PROPERTY_KEYS as n, ADMIN_COLLECTION_KEYS as t };
 
-//# sourceMappingURL=admin_block-CcSGdH7M.js.map
+//# sourceMappingURL=admin_block-EmIHae6X.js.map

package/dist/admin_block-EmIHae6X.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin_block-EmIHae6X.js","names":[],"sources":["../../types/src/types/admin_block.ts"],"sourcesContent":["/**\n * The keys of a collection's admin block, as data.\n *\n * There is no *type* for the block in this package any more, and that is the point:\n * `admin` is not declared on `BaseCollectionConfig` or on any property here, so a\n * BaaS install cannot even write one. `@rebasepro/admin-types` adds the field back by\n * declaration merging, which is why installing it is what makes the admin surface\n * appear.\n *\n * The *list* still has to live here, because three runtime consumers need it and two\n * of them are core — see below.\n */\n\n/**\n * Every key that belongs inside a collection's `admin` block, as data.\n *\n * The type that describes these fields is `AdminCollectionOptions` in\n * `@rebasepro/admin-types`, and it is erased at build time — but three runtime\n * consumers need the list, and two of them are core:\n *\n * - `serializeCollections`, to drop the block from the contract\n * - the ts-morph schema editor in `@rebasepro/server`, which rewrites collection\n *   files on disk from the admin panel and has to know where each key goes. A key\n *   missing from this list gets written to the *top level* of the file, where the\n *   backend ignores it and the panel never finds it again.\n * - the `collections-admin-block` codemod\n *\n * `@rebasepro/admin-types` re-exports this and asserts it names only real option\n * keys; the count is pinned by a test there.\n *\n * @group Models\n */\nexport const ADMIN_COLLECTION_KEYS = [\n    \"Actions\",\n    \"additionalFields\",\n    \"alwaysApplyDefaultValues\",\n    \"components\",\n    \"defaultEntityAction\",\n    \"defaultFilter\",\n    \"defaultSelectedView\",\n    \"defaultSize\",\n    \"defaultViewMode\",\n    \"disableDefaultActions\",\n    \"display\",\n    \"enabledViews\",\n    \"entityActions\",\n    \"entityViews\",\n    \"exportable\",\n    \"filterPresets\",\n    \"fixedFilter\",\n    \"form\",\n    \"formAutoSave\",\n    \"formView\",\n    \"group\",\n    \"hideFromNavigation\",\n    \"hideIdFromCollection\",\n    \"hideIdFromForm\",\n    \"icon\",\n    \"includeJsonView\",\n    \"inlineEditing\",\n    \"kanban\",\n    \"listProperties\",\n    \"localChangesBackup\",\n    \"openEntityMode\",\n    \"orderProperty\",\n    \"pagination\",\n    \"previewProperties\",\n    \"propertiesOrder\",\n    \"selectionController\",\n    \"selectionEnabled\",\n    \"sideDialogWidth\",\n    \"sort\",\n    \"titleProperty\"\n] as const;\n\n/** A key of a collection's `admin` block. @group Models */\nexport type AdminCollectionKey = typeof ADMIN_COLLECTION_KEYS[number];\n\n/**\n * Every key that belongs inside a *property's* `admin` block, as data.\n *\n * The union of `AdminPropertyOptions` and its per-type extensions\n * (`AdminStringOptions`, `AdminArrayOptions`, …) in `@rebasepro/admin-types`.\n * It lives here for the same reason {@link ADMIN_COLLECTION_KEYS} does: the\n * runtime consumers are core packages that the BaaS guard forbids from\n * importing `@rebasepro/admin-types`. Here it is the boot-time collection\n * validator in `@rebasepro/server`, which has to tell \"you left `readOnly` at\n * the top of the property, where nothing reads it\" apart from \"you invented a\n * key we have never heard of\".\n *\n * `@rebasepro/admin-types` re-exports this and asserts it names only real\n * option keys.\n *\n * @group Models\n */\nexport const ADMIN_PROPERTY_KEYS = [\n    \"canAddElements\",\n    \"clearable\",\n    \"columnWidth\",\n    \"customProps\",\n    \"disabled\",\n    \"expanded\",\n    \"Field\",\n    \"Filter\",\n    \"filterOperators\",\n    \"fixedFilter\",\n    \"hideFromCollection\",\n    \"includeEntityLink\",\n    \"includeId\",\n    \"markdown\",\n    \"minimalistView\",\n    \"multiline\",\n    \"Preview\",\n    \"previewAsTag\",\n    \"previewProperties\",\n    \"readOnly\",\n    \"sortable\",\n    \"span\",\n    \"spreadChildren\",\n    \"urlPreview\",\n    \"widget\",\n] as const;\n\n/** A key of a property's `admin` block. @group Models */\nexport type AdminPropertyKey = typeof ADMIN_PROPERTY_KEYS[number];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,IAAa,wBAAwB;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;;;;;;;;;;;;;;;;;AAsBA,IAAa,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ"}

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
 export * from "./interfaces";
-export { configureJwt, generateAccessToken, verifyAccessToken, generateRefreshToken, hashRefreshToken, getRefreshTokenExpiry, getAccessTokenExpiry, generateDownloadToken, verifyDownloadToken } from "./jwt";
+export { configureJwt, isJwtConfigured, generateAccessToken, verifyAccessToken, generateRefreshToken, hashRefreshToken, getRefreshTokenExpiry, getAccessTokenExpiry, generateDownloadToken, verifyDownloadToken } from "./jwt";
 export type { JwtConfig, AccessTokenPayload, DownloadTokenPayload } from "./jwt";
 export { hashPassword, verifyPassword, validatePasswordStrength } from "./password";
 export { safeCompare } from "./crypto-utils";

package/dist/auth/jwt.d.ts

@@ -30,6 +30,18 @@ export interface AccessTokenPayload {
  * Validates the secret strength to prevent deployment with default/weak secrets.
  */
 export declare function configureJwt(config: JwtConfig): void;
+/**
+ * Has this server been given a JWT secret?
+ *
+ * False on every backend that authenticates through an adapter — Firebase,
+ * Clerk, anything with its own tokens — because nothing calls
+ * {@link configureJwt} there. Signing paths still throw when it is false, since
+ * asking for a token from a server that cannot mint one is a mistake worth
+ * hearing about. Paths whose contract is *"tolerate the absence of auth"* must
+ * ask first: `optionalAuth` crashing a request because this backend does not do
+ * JWT is a 500 on a route that had already decided anonymous was acceptable.
+ */
+export declare function isJwtConfigured(): boolean;
 /**
  * Generate an access token (short-lived, 1 hour by default)
  */

package/dist/{auth-CuC9M2x6.js → auth-ByFdJcuM.js}

@@ -7,7 +7,7 @@ import "./src-_qQ3RNCK.js";
 import { t as isSQLAdmin } from "./backend-CIxN4FVm.js";
 import { t as logger } from "./logger-BYU66ENZ.js";
 import { n as errorHandler, t as ApiError } from "./errors-CgkCzoj7.js";
-import { a as generateRefreshToken, c as getRefreshTokenTtlMs, d as verifyAccessToken, f as verifyDownloadToken, i as generateDownloadToken, l as hashRefreshToken, n as configureJwt, o as getAccessTokenExpiry, p as require_jsonwebtoken, r as generateAccessToken, s as getRefreshTokenExpiry, t as MAX_COOKIE_AGE_MS } from "./jwt-DD6EtpGj.js";
+import { a as generateRefreshToken, c as getRefreshTokenTtlMs, f as verifyAccessToken, i as generateDownloadToken, l as hashRefreshToken, m as require_jsonwebtoken, n as configureJwt, o as getAccessTokenExpiry, p as verifyDownloadToken, r as generateAccessToken, s as getRefreshTokenExpiry, t as MAX_COOKIE_AGE_MS, u as isJwtConfigured } from "./jwt-CzeviDcB.js";
 import { createHash, randomBytes, randomInt } from "node:crypto";
 import { Hono } from "hono";
 import { promisify } from "util";
@@ -551,7 +551,7 @@ var requireAdmin = async (c, next) => {
 var optionalAuth = async (c, next) => {
 	if (c.get("user")) return next();
 	const token = extractBearerToken(c.req.header("authorization"));
-	if (token !== void 0) {
+	if (token !== void 0 && isJwtConfigured()) {
 		const payload = verifyAccessToken(token);
 		if (payload) c.set("user", payload);
 	}
@@ -561,6 +561,7 @@ var optionalAuth = async (c, next) => {
 * Extract user from token - for WebSocket authentication
 */
 function extractUserFromToken(token) {
+	if (!isJwtConfigured()) return null;
 	return verifyAccessToken(token);
 }
 /**
@@ -711,7 +712,7 @@ function createAuthMiddleware(options) {
 var queryTokenAuth = async (c, next) => {
 	if (extractBearerToken(c.req.header("authorization")) !== void 0) return next();
 	const queryToken = c.req.query("token");
-	if (queryToken) {
+	if (queryToken && isJwtConfigured()) {
 		const payload = verifyAccessToken(queryToken);
 		if (payload) c.set("user", payload);
 	}
@@ -6168,7 +6169,7 @@ function mountSessionRoutes(opts) {
 		clearRefreshCookie(c, config.cookieAuth);
 		const accessToken = extractBearerToken(c.req.header("authorization"));
 		if (ops.afterLogout && accessToken !== void 0) {
-			const { verifyAccessToken } = await import("./jwt-DD6EtpGj.js").then((n) => n.u);
+			const { verifyAccessToken } = await import("./jwt-CzeviDcB.js").then((n) => n.d);
 			const payload = verifyAccessToken(accessToken);
 			if (payload) ops.afterLogout(payload.uid).catch((err) => {
 				logger.error("[AuthHooks] afterLogout error", { error: err instanceof Error ? err.message : err });
@@ -8939,6 +8940,7 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	hashToken: () => hashToken,
 	httpMethodToOperation: () => httpMethodToOperation,
 	isApiKeyToken: () => isApiKeyToken,
+	isJwtConfigured: () => isJwtConfigured,
 	isOperationAllowed: () => isOperationAllowed,
 	mountMagicLinkRoutes: () => mountMagicLinkRoutes,
 	optionalAuth: () => optionalAuth,
@@ -8958,4 +8960,4 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 //#endregion
 export { httpMethodToOperation as $, getEmailVerificationTemplate as A, optionalAuth as B, createDataRateLimiter as C, validatePasswordStrength as D, hashPassword as E, createAdapterAuthMiddleware as F, createApiKeyPreAuth as G, queryTokenAuth as H, createAuthMiddleware as I, isApiKeyToken as J, createFunctionApiKeyGuard as K, createRequireAuth as L, getPasswordResetTemplate as M, getUserInvitationTemplate as N, verifyPassword as O, getWelcomeEmailTemplate as P, scopeDataDriver as Q, extractUserFromToken as R, _coercedNumber as S, resolveAuthHooks as T, requireAdmin as U, publicObjectAuth as V, requireAuth as W, extractBearerToken as X, validateApiKey as Y, safeCompare as Z, createBuiltinAuthAdapter as _, createSpotifyProvider as a, object as b, createGitLabProvider as c, createFacebookProvider as d, isOperationAllowed as et, createAppleProvider as f, createGoogleProvider as g, createLinkedinProvider as h, createApiKeyStore as i, resolveClientListLimit as it, getMagicLinkTemplate as j, generateSecurePassword as k, createDiscordProvider as l, createGitHubProvider as m, createCustomAuthAdapter as n, isPublicStoragePath as nt, createSlackProvider as o, createMicrosoftProvider as p, createStorageApiKeyGuard as q, createApiKeyRoutes as r, MAX_LIST_LIMIT as rt, createBitbucketProvider as s, auth_exports as t, PUBLIC_STORAGE_PREFIX as tt, createTwitterProvider as u, ZodNumber as v, MemoryRateLimitStore as w, string as x, _enum as y, fileTokenAuth as z };
 
-//# sourceMappingURL=auth-CuC9M2x6.js.map
+//# sourceMappingURL=auth-ByFdJcuM.js.map