@rebasepro/server 0.13.1-canary.g18cfeb7 → 0.13.1-canary.g249daa1

package/dist/{auth-CtxXQYV_.js → auth-BANhRhN9.js}

@@ -2,9 +2,9 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { i as __toESM, n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
-import { S as isAnonymousUid, b as resolveClientListLimit, x as ANONYMOUS_USER_ID } from "./src-CvaxLgnM.js";
+import { S as isAnonymousUid, b as resolveClientListLimit, x as ANONYMOUS_USER_ID } from "./src-DVb5a0bp.js";
 import "./src-Ca6NhxKs.js";
-import { n as isSQLAdmin, t as revokeInternalTableSql } from "./internal-tables-57VaN3o1.js";
+import { i as isSQLAdmin, r as revokeInternalTableSql, t as createDdlBootstrapper } from "./ddl-bootstrap-Bp3mr6Td.js";
 import { t as logger } from "./logger-BYU66ENZ.js";
 import { n as errorHandler, t as ApiError } from "./errors-BpudWAVU.js";
 import { a as generateRefreshToken, c as getRefreshTokenTtlMs, f as verifyAccessToken, i as generateDownloadToken, l as hashRefreshToken, m as require_jsonwebtoken, n as configureJwt, o as getAccessTokenExpiry, p as verifyDownloadToken, r as generateAccessToken, s as getRefreshTokenExpiry, t as MAX_COOKIE_AGE_MS, u as isJwtConfigured } from "./jwt-CzeviDcB.js";
@@ -12,6 +12,8 @@ import { createHash, randomBytes, randomInt } from "node:crypto";
 import { Hono } from "hono";
 import { promisify } from "util";
 import { createCipheriv, createDecipheriv, createHash as createHash$1, createHmac, randomBytes as randomBytes$1, randomUUID as randomUUID$1, scrypt, timingSafeEqual } from "crypto";
+import path from "node:path";
+import { getConnInfo } from "@hono/node-server/conninfo";
 //#region ../types/src/controllers/storage.ts
 /**
 * Path prefix that marks an object as **public**. Files stored under this
@@ -439,6 +441,91 @@ function createApiKeyPreAuth(options) {
 	};
 }
 //#endregion
+//#region src/storage/keys.ts
+/**
+* Canonical storage keys.
+*
+* Storage is not under RLS, so a `storageAuthorize` hook is the whole access
+* control model — and a hook can only be correct if the key it is shown is the
+* key that is written. That is the invariant this module exists to hold: one
+* canonical string, computed once per request, handed to the hook, to the
+* controller, and to the download token alike.
+*
+* ## Why rejecting beats stripping
+*
+* The previous `sanitizeStorageKey` *stripped* `../` in a single pass. Two
+* things were wrong with that, and only one of them was the obvious one.
+*
+* The obvious one: a single pass is not a fixed point. `....//` contains `../`
+* at offset 2, so removing it leaves `../` behind — the sanitizer manufactured
+* the traversal it was there to remove. `users/alice/....//bob/x` came out as
+* `users/alice/../bob/x`, which a prefix hook reads as alice's (it starts with
+* `users/alice/`) and the filesystem reads as bob's. The hook approved one
+* object and the controller wrote another.
+*
+* The subtler one, and the reason this is a rewrite rather than a loop: even a
+* correct strip is a silent rewrite. A caller who asks to store at `a/../b` and
+* gets an object at `a/b` was not protected, they were misled — and every later
+* read, ownership row and audit line now refers to a path nobody chose. So a key
+* that means something other than what it says is refused (400), not repaired.
+*
+* Note what is NOT traversal under this rule: `....` is an ordinary directory
+* name, and `users/alice/....//bob/x` canonicalizes to
+* `users/alice/..../bob/x` — still comfortably inside alice's prefix, which is
+* exactly right. Only a real `..` segment is refused.
+*/
+/** Longest key accepted, in UTF-16 code units. Matches the previous cap. */
+var MAX_STORAGE_KEY_LENGTH = 1024;
+/**
+* A key that cannot be canonicalized. Carries no path back to the caller
+* beyond what they sent, so it is safe to surface as a 400 message.
+*/
+var InvalidStorageKeyError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "InvalidStorageKeyError";
+	}
+};
+/**
+* Canonicalize a caller-supplied storage key, or throw
+* {@link InvalidStorageKeyError}.
+*
+* Normalizations applied (safe, idempotent, and meaning-preserving):
+* - leading slashes removed — `/a/b` and `a/b` name the same object
+* - `.` segments and repeated slashes collapsed
+*
+* Refusals (the key means something other than what it says):
+* - any `..` segment, on either separator, at any depth
+* - null bytes
+* - keys longer than {@link MAX_STORAGE_KEY_LENGTH}
+*
+* A trailing slash is preserved: it is how the folder route marks a prefix.
+*/
+function canonicalStorageKey(rawKey) {
+	if (rawKey.includes("\0")) throw new InvalidStorageKeyError("Storage key contains a null byte.");
+	if (rawKey.length > 1024) throw new InvalidStorageKeyError(`Storage key exceeds the maximum length of ${MAX_STORAGE_KEY_LENGTH} characters.`);
+	if (rawKey.split(/[\\/]/).some((segment) => segment === "..")) throw new InvalidStorageKeyError("Storage key contains a '..' path segment. Keys must name an object directly.");
+	const withoutLeadingSlashes = rawKey.replace(/^\/+/, "");
+	if (withoutLeadingSlashes === "") return "";
+	const normalized = path.posix.normalize(withoutLeadingSlashes);
+	if (normalized === "." || normalized === "./") return "";
+	return normalized.replace(/^\.\//, "").replace(/^\/+/, "");
+}
+/**
+* Canonicalize, or return `null` when the key is not canonicalizable.
+*
+* For callers that must fail closed without an exception — the download-token
+* middleware compares a request path against a granted path, and a key it
+* cannot canonicalize simply matches nothing.
+*/
+function tryCanonicalStorageKey(rawKey) {
+	try {
+		return canonicalStorageKey(rawKey);
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region src/auth/middleware.ts
 /**
 * Hono middleware that requires a valid JWT token via Authorization header.
@@ -761,15 +848,25 @@ var fileTokenAuth = async (c, next) => {
 		if (idx < 0) return "";
 		return fullPath.substring(idx + prefix.length + 1);
 	};
+	/**
+	* Must agree with `parseBucketAndPath` in `storage/routes.ts`, because the
+	* path a token GRANTS is minted there and the path a request ASKS FOR is
+	* derived here. `/metadata` canonicalizes before signing, so a raw
+	* comparison here would 403 an otherwise-valid request for any key whose
+	* URL form is not already canonical (`a//b.txt`, `a/./b.txt`).
+	*
+	* A key that cannot be canonicalized yields null, which matches no grant —
+	* the same fail-closed answer `isPathMatch` gives a `..` segment.
+	*/
 	const parseBucketPath = (filePath) => {
 		const parts = filePath.split("/");
 		if (parts.length > 1 && parts[0].toLowerCase() === "default") return {
 			bucket: "default",
-			resolvedPath: parts.slice(1).join("/")
+			resolvedPath: tryCanonicalStorageKey(parts.slice(1).join("/"))
 		};
 		return {
 			bucket: "default",
-			resolvedPath: filePath
+			resolvedPath: tryCanonicalStorageKey(filePath)
 		};
 	};
 	const bearerToken = extractBearerToken(authHeader);
@@ -779,7 +876,8 @@ var fileTokenAuth = async (c, next) => {
 			const rawPath = extractWildcard(c);
 			if (rawPath) {
 				const { bucket, resolvedPath } = parseBucketPath(decodeURIComponent(rawPath));
-				if (isPathMatch(`${bucket}/${resolvedPath}`, payload.path)) {
+				const requestedFullPath = resolvedPath === null ? null : `${bucket}/${resolvedPath}`;
+				if (requestedFullPath !== null && isPathMatch(requestedFullPath, payload.path)) {
 					c.set("user", {
 						uid: "download-token",
 						roles: ["reader"]
@@ -803,7 +901,8 @@ var fileTokenAuth = async (c, next) => {
 			const rawPath = extractWildcard(c);
 			if (rawPath) {
 				const { bucket, resolvedPath } = parseBucketPath(decodeURIComponent(rawPath));
-				if (isPathMatch(`${bucket}/${resolvedPath}`, payload.path)) {
+				const requestedFullPath = resolvedPath === null ? null : `${bucket}/${resolvedPath}`;
+				if (requestedFullPath !== null && isPathMatch(requestedFullPath, payload.path)) {
 					c.set("user", {
 						uid: "download-token",
 						roles: ["reader"]
@@ -1437,11 +1536,11 @@ async function finalizeAdminUserCreation(entity, clearPassword, ctx) {
 		await ctx.authRepo.createPasswordResetToken(entity.id, tokenHash, expiresAt);
 		const setPasswordUrl = `${ctx.emailConfig?.resetPasswordUrl || ""}/reset-password?token=${token}`;
 		const appName = ctx.emailConfig?.appName || "Rebase";
-		const templateFn = ctx.emailConfig?.templates?.passwordReset;
+		const templateFn = ctx.emailConfig?.templates?.userInvitation;
 		const emailContent = templateFn ? templateFn(setPasswordUrl, {
 			email: entity.values.email,
 			displayName: entity.values.displayName
-		}) : getPasswordResetTemplate(setPasswordUrl, {
+		}) : getUserInvitationTemplate(setPasswordUrl, {
 			email: entity.values.email,
 			displayName: entity.values.displayName
 		}, appName);
@@ -1670,7 +1769,23 @@ function createRateLimiter(options = {}) {
 	};
 }
 /**
-* Default key generator: extract client IP from standard headers.
+* The address the socket is actually connected to, or `undefined` on a runtime
+* that cannot say. Unforgeable, unlike every header below.
+*
+* `getConnInfo` is Node-specific and throws elsewhere, so the failure is
+* swallowed: a runtime without connection info falls back to the shared bucket,
+* which is a availability trade the caller cannot exploit.
+*/
+function socketAddress(c) {
+	try {
+		return getConnInfo(c).remote.address;
+	} catch {
+		return;
+	}
+}
+/**
+* Default key generator: the client's address, from the most trustworthy source
+* this deployment has.
 *
 * `X-Forwarded-For` is a client-writable header; only the entries appended by
 * trusted reverse proxies can be believed. With `trustedProxyHops` proxies in
@@ -1679,8 +1794,20 @@ function createRateLimiter(options = {}) {
 * client-supplied and must be ignored. This is what prevents a caller from
 * spoofing `X-Forwarded-For` to spread its requests across many rate-limit keys.
 *
-* With `trustedProxyHops === 0` (server exposed directly, no proxy),
-* `X-Forwarded-For` is not trusted at all and `X-Real-IP` is used instead.
+* `X-Real-IP` is the *same* kind of header and needs the same rule, which it
+* did not have: it was read unconditionally, including under
+* `trustedProxyHops === 0` — the mode whose entire meaning is "no proxy is in
+* front of me". With no proxy there, nothing writes `X-Real-IP` except the
+* caller, so the key was theirs to choose: one header per request bought an
+* unlimited number of buckets, and the limiters on login, registration and
+* password reset counted to one. The reasoning had been done carefully for one
+* spelling of a proxy header and not carried to its twin.
+*
+* So `X-Real-IP` is now believed only where a proxy is declared to exist. With
+* none, the connection's own address is used — unforgeable, and available
+* because the server runs on `@hono/node-server`. `"unknown"` is the last
+* resort only, and it is a single shared bucket by design: better that
+* anonymous callers throttle each other than that any of them throttles nobody.
 */
 function defaultKeyGenerator(c, trustedProxyHops = resolveTrustedProxyHops()) {
 	if (trustedProxyHops > 0) {
@@ -1689,8 +1816,10 @@ function defaultKeyGenerator(c, trustedProxyHops = resolveTrustedProxyHops()) {
 			const ips = forwardedFor.split(",").map((s) => s.trim()).filter(Boolean);
 			if (ips.length > 0) return ips[Math.max(0, ips.length - trustedProxyHops)];
 		}
+		const realIp = c.req.header("x-real-ip");
+		if (realIp) return realIp;
 	}
-	return c.req.header("x-real-ip") || "unknown";
+	return socketAddress(c) ?? "unknown";
 }
 /**
 * Pre-configured rate limiter for general auth endpoints (login, register).
@@ -8570,45 +8699,45 @@ function createApiKeyStore(driver) {
 		return;
 	}
 	const exec = (sqlText, options) => admin.executeSql(sqlText, options?.params ? { params: options.params } : void 0);
+	const ddl = createDdlBootstrapper(exec, "api-key-store");
 	return {
 		async ensureTable() {
-			try {
-				await exec("CREATE SCHEMA IF NOT EXISTS rebase");
-				await exec(`
-                    CREATE TABLE IF NOT EXISTS ${TABLE} (
-                        id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                        name TEXT NOT NULL,
-                        key_prefix TEXT NOT NULL,
-                        key_hash TEXT NOT NULL UNIQUE,
-                        permissions JSONB NOT NULL DEFAULT '[]'::jsonb,
-                        admin BOOLEAN NOT NULL DEFAULT FALSE,
-                        rate_limit INTEGER,
-                        created_by TEXT NOT NULL,
-                        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-                        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-                        last_used_at TIMESTAMPTZ,
-                        expires_at TIMESTAMPTZ,
-                        revoked_at TIMESTAMPTZ
-                    )
-                `);
-				await exec(`
-                    CREATE INDEX IF NOT EXISTS idx_api_keys_hash
-                    ON ${TABLE}(key_hash)
-                `);
-				await exec(`
-                    CREATE INDEX IF NOT EXISTS idx_api_keys_prefix
-                    ON ${TABLE}(key_prefix)
-                `);
-				await exec(`
-                    ALTER TABLE ${TABLE}
-                    ADD COLUMN IF NOT EXISTS admin BOOLEAN NOT NULL DEFAULT FALSE
-                `);
-				await exec(revokeInternalTableSql("rebase", "api_keys"));
-				logger.info("✅ API keys table ready");
-			} catch (err) {
-				logger.error("❌ Failed to create API keys table", { error: err });
-				logger.warn("⚠️ Continuing without API keys support.");
+			await ddl.ensureObject("Creating schema rebase", "CREATE SCHEMA IF NOT EXISTS rebase");
+			await ddl.ensureObject(`Creating ${TABLE}`, `
+                CREATE TABLE IF NOT EXISTS ${TABLE} (
+                    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+                    name TEXT NOT NULL,
+                    key_prefix TEXT NOT NULL,
+                    key_hash TEXT NOT NULL UNIQUE,
+                    permissions JSONB NOT NULL DEFAULT '[]'::jsonb,
+                    admin BOOLEAN NOT NULL DEFAULT FALSE,
+                    rate_limit INTEGER,
+                    created_by TEXT NOT NULL,
+                    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+                    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+                    last_used_at TIMESTAMPTZ,
+                    expires_at TIMESTAMPTZ,
+                    revoked_at TIMESTAMPTZ
+                )
+            `);
+			await ddl.ensureObject("Creating idx_api_keys_hash", `
+                CREATE INDEX IF NOT EXISTS idx_api_keys_hash
+                ON ${TABLE}(key_hash)
+            `);
+			await ddl.ensureObject("Creating idx_api_keys_prefix", `
+                CREATE INDEX IF NOT EXISTS idx_api_keys_prefix
+                ON ${TABLE}(key_prefix)
+            `);
+			await ddl.ensureObject(`Adding ${TABLE}.admin`, `
+                ALTER TABLE ${TABLE}
+                ADD COLUMN IF NOT EXISTS admin BOOLEAN NOT NULL DEFAULT FALSE
+            `);
+			if (!await ddl.isReadable(TABLE)) {
+				logger.error(`❌ [api-key-store] ${TABLE} is unavailable — every API-key authenticated request will be rejected on this instance, and the table could not be taken back off the end-user role.`);
+				return;
 			}
+			await ddl.step("Revoking end-user access to api_keys", () => exec(revokeInternalTableSql("rebase", "api_keys")));
+			logger.info("✅ API keys table ready");
 		},
 		async createApiKey(request, createdBy) {
 			const plaintext = generateApiKey();
@@ -8937,6 +9066,6 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	verifyPassword: () => verifyPassword
 });
 //#endregion
-export { httpMethodToOperation as $, getEmailVerificationTemplate as A, optionalAuth as B, createDataRateLimiter as C, validatePasswordStrength as D, hashPassword as E, createAdapterAuthMiddleware as F, createApiKeyPreAuth as G, queryTokenAuth as H, createAuthMiddleware as I, isApiKeyToken as J, createFunctionApiKeyGuard as K, createRequireAuth as L, getPasswordResetTemplate as M, getUserInvitationTemplate as N, verifyPassword as O, getWelcomeEmailTemplate as P, scopeDataDriver as Q, extractUserFromToken as R, _coercedNumber as S, resolveAuthHooks as T, requireAdmin as U, publicObjectAuth as V, requireAuth as W, extractBearerToken as X, validateApiKey as Y, safeCompare as Z, createBuiltinAuthAdapter as _, createSpotifyProvider as a, object as b, createGitLabProvider as c, createFacebookProvider as d, isOperationAllowed as et, createAppleProvider as f, createGoogleProvider as g, createLinkedinProvider as h, createApiKeyStore as i, getMagicLinkTemplate as j, generateSecurePassword as k, createDiscordProvider as l, createGitHubProvider as m, createCustomAuthAdapter as n, isPublicStoragePath as nt, createSlackProvider as o, createMicrosoftProvider as p, createStorageApiKeyGuard as q, createApiKeyRoutes as r, createBitbucketProvider as s, auth_exports as t, PUBLIC_STORAGE_PREFIX as tt, createTwitterProvider as u, ZodNumber as v, MemoryRateLimitStore as w, string as x, _enum as y, fileTokenAuth as z };
+export { safeCompare as $, getEmailVerificationTemplate as A, optionalAuth as B, createDataRateLimiter as C, validatePasswordStrength as D, hashPassword as E, createAdapterAuthMiddleware as F, InvalidStorageKeyError as G, queryTokenAuth as H, createAuthMiddleware as I, createFunctionApiKeyGuard as J, canonicalStorageKey as K, createRequireAuth as L, getPasswordResetTemplate as M, getUserInvitationTemplate as N, verifyPassword as O, getWelcomeEmailTemplate as P, extractBearerToken as Q, extractUserFromToken as R, _coercedNumber as S, resolveAuthHooks as T, requireAdmin as U, publicObjectAuth as V, requireAuth as W, isApiKeyToken as X, createStorageApiKeyGuard as Y, validateApiKey as Z, createBuiltinAuthAdapter as _, createSpotifyProvider as a, object as b, createGitLabProvider as c, createFacebookProvider as d, scopeDataDriver as et, createAppleProvider as f, createGoogleProvider as g, createLinkedinProvider as h, createApiKeyStore as i, isPublicStoragePath as it, getMagicLinkTemplate as j, generateSecurePassword as k, createDiscordProvider as l, createGitHubProvider as m, createCustomAuthAdapter as n, isOperationAllowed as nt, createSlackProvider as o, createMicrosoftProvider as p, createApiKeyPreAuth as q, createApiKeyRoutes as r, PUBLIC_STORAGE_PREFIX as rt, createBitbucketProvider as s, auth_exports as t, httpMethodToOperation as tt, createTwitterProvider as u, ZodNumber as v, MemoryRateLimitStore as w, string as x, _enum as y, fileTokenAuth as z };
 
-//# sourceMappingURL=auth-CtxXQYV_.js.map
+//# sourceMappingURL=auth-BANhRhN9.js.map