@rebasepro/server 0.13.1-canary.gef9608c → 0.14.0

package/dist/auth/rate-limiter.d.ts

@@ -32,9 +32,23 @@ interface RateLimiterOptions {
      * appends the address it saw to `X-Forwarded-For`, so the real client IP is
      * the Nth entry from the right. Anything further left is client-supplied and
      * ignored — which is what stops a caller spoofing `X-Forwarded-For` to
-     * rotate rate-limit keys. Defaults to `TRUSTED_PROXY_HOPS` (env) or `1`.
-     * Set to `0` when the server is exposed directly (no proxy): `X-Forwarded-For`
-     * is then ignored entirely in favour of `X-Real-IP`.
+     * rotate rate-limit keys.
+     *
+     * **Defaults to `0`: no proxy is trusted, and `X-Forwarded-For` and
+     * `X-Real-IP` are both ignored in favour of the socket address.** A server
+     * cannot tell from a request whether a proxy put that header there or the
+     * caller did, so the number of hops is a deployment fact that has to be
+     * declared. It previously defaulted to `1`, and nothing in the repo ever
+     * set it — so on any directly-exposed server (`rebase dev`, a self-hosted
+     * `rebase-server`, a passthrough load balancer) one header gave every
+     * IP-keyed limiter an effective limit of one request per attacker-chosen
+     * value.
+     *
+     * Set it — via this option or `TRUSTED_PROXY_HOPS` — to the number of
+     * proxies you actually run. Behind one ingress or load balancer that is
+     * `1`. Leaving it unset behind a proxy makes every client share the
+     * proxy's address as one bucket, which the boot-time warning below tells
+     * you about the first time it happens.
      */
     trustedProxyHops?: number;
 }
@@ -54,6 +68,26 @@ export declare const defaultAuthLimiter: MiddlewareHandler<HonoEnv>;
  * 50 requests per 15 minutes per IP.
  */
 export declare const strictAuthLimiter: MiddlewareHandler<HonoEnv>;
+/**
+ * Limiter for `POST /auth/send-verification`, keyed by the authenticated user.
+ *
+ * That route had no limiter at all while every one of its email-sending
+ * siblings had one, and being authenticated is not the protection it looks
+ * like: registration does not verify the address it is given, so an attacker
+ * registers a victim's address, signs in to the account they just made, and
+ * loops the route. Each call mints a token and mails the victim.
+ *
+ * An IP limiter cannot express what is wanted here — the recipient is the
+ * quantity being protected, not the caller — so this one keys on the uid, which
+ * on this route is one-to-one with the recipient address (emails are unique per
+ * account). `strictAuthLimiter` still runs in front of it to bound the caller by
+ * IP; this bounds what any single address can be sent.
+ *
+ * Five per 15 minutes is generous for "I didn't get the email, resend it" and
+ * useless as a mail bomb. Unauthenticated requests fall back to the IP bucket so
+ * the limiter is never a no-op if it is ever mounted before the auth middleware.
+ */
+export declare const verificationEmailLimiter: MiddlewareHandler<HonoEnv>;
 /**
  * Key generator for API-key-based rate limiting.
  *
@@ -66,6 +100,14 @@ export declare function apiKeyKeyGenerator(c: Parameters<MiddlewareHandler<HonoE
 export interface DataRateLimitConfig {
     /** Turn the whole thing off — for a deployment whose proxy already does it. */
     enabled?: boolean;
+    /**
+     * Trusted reverse-proxy hops, for the IP bucket. Same meaning and same
+     * fail-safe default of 0 as {@link RateLimiterOptions.trustedProxyHops} —
+     * threaded explicitly because this limiter builds its own key generator,
+     * and before this existed the option was accepted by the surrounding
+     * limiter and then ignored for the one bucket that keys on an address.
+     */
+    trustedProxyHops?: number;
     windowMs?: number;
     /** Fallback for an API key with no `rate_limit` of its own. Default 1000. */
     apiKey?: number;
@@ -73,13 +115,28 @@ export interface DataRateLimitConfig {
     user?: number;
     /**
      * Per IP, for requests with no principal at all. Default 300.
-     * `null` disables the anonymous bucket entirely — used for routers whose
-     * anonymous traffic must not be throttled (public webhook functions).
+     * `null` disables the anonymous bucket entirely.
      */
     anonymous?: number | null;
+    /**
+     * Per IP, for anonymous requests to `/api/functions/*`. Default 3000 —
+     * deliberately far looser than {@link anonymous}, because the functions
+     * router is public by default for webhook receivers (Stripe, GitHub) whose
+     * bursts arrive from a handful of provider IPs and would trip the data
+     * API's ceiling.
+     *
+     * The looseness bounds the *value*, not the existence of the limit: this
+     * router is the one that invites anonymous callers, so it is the last one
+     * that should have no ceiling at all. `null` disables it — an explicit
+     * choice, which is what the hardcoded `anonymous: null` here used to be
+     * without any way to say otherwise.
+     */
+    anonymousFunctions?: number | null;
     /** Share counts across replicas. Defaults to this process's memory. */
     store?: RateLimitStore;
 }
+/** @see DataRateLimitConfig.anonymousFunctions */
+export declare const DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT = 3000;
 /**
  * Rate limiting for the data API.
  *

package/dist/auth/registration-policy.d.ts

@@ -55,3 +55,34 @@ export declare function isRegistrationOpen(policy: RegistrationPolicy): boolean;
  * on whether the table is empty, so now go and look".
  */
 export declare function isSteadyStateRegistrationOpen(policy: Omit<RegistrationPolicy, "needsSetup">): boolean;
+/**
+ * Whether `POST /auth/anonymous` may mint a user.
+ *
+ * Anonymous sign-in *is* registration: it inserts a `users` row and assigns
+ * `defaultRole` exactly as `POST /auth/register` does. It simply never asked.
+ * Both anonymous routes were mounted unconditionally and consulted none of the
+ * gates above, so a backend with `allowRegistration: false` **and**
+ * `disableSelfRegistration: true` — the documented hard kill switch — still
+ * handed a permanent account to any caller in two unauthenticated requests:
+ * `POST /auth/anonymous` for the row and the session, then
+ * `POST /auth/anonymous/link` to put an email and password on it.
+ *
+ * Two terms, because the two questions are genuinely different:
+ *
+ *   - `allowAnonymous` is the feature switch, and it is **opt-in**. There was no
+ *     key at all before, so a deployment could not turn anonymous auth off even
+ *     after finding it on; defaulting it to `true` here would keep that hole
+ *     open for everyone who never learns the key exists.
+ *   - `disableSelfRegistration` still wins over it. Its docstring calls it a
+ *     hard kill switch that blocks "self-registration outright", and an account
+ *     created without credentials is still an account created by the public.
+ *     An operator who sets both gets the kill switch they asked for.
+ *
+ * `allowRegistration` deliberately does **not** gate this. A public read-mostly
+ * app that wants anonymous sessions but no sign-up forms is a real deployment,
+ * and `allowAnonymous: true` says so precisely.
+ */
+export declare function isAnonymousAuthOpen(policy: {
+    allowAnonymous?: boolean;
+    disableSelfRegistration?: boolean;
+}): boolean;

package/dist/auth/rls-scope.d.ts

@@ -12,6 +12,31 @@
  * @module
  */
 import type { DataDriver } from "@rebasepro/types";
+/**
+ * The identity the trusted server plane runs as: `rebase.dataAsAdmin`, and any
+ * caller presenting the service key.
+ *
+ * Naming it makes the privilege legible, because it is narrower than it reads.
+ * This is **not** an RLS bypass — a driver scoped with it is an
+ * `AuthenticatedPostgresBackendDriver`, so every statement runs in a
+ * transaction that has done `SET LOCAL ROLE rebase_user` with
+ * `app.uid = 'service'`, and policies are evaluated. Two consequences worth
+ * knowing before you write a policy:
+ *
+ * - It passes the default policies through their `rolesOverlap(['admin'])`
+ *   arm — the same arm an application user holding the `admin` role passes.
+ * - `policy.serverContext()` compiles to `auth.uid() IS NULL` and is therefore
+ *   **false** for it. A collection with `disableDefaultPolicies: true` whose
+ *   only rule is `serverContext()` denies these writes (42501) and returns
+ *   zero rows for these reads.
+ *
+ * The true bypass is `rebase.sql()`, which runs on the owner connection and
+ * never goes near `withAuth`.
+ */
+export declare const SERVICE_IDENTITY: {
+    uid: string;
+    roles: string[];
+};
 /**
  * Scope a DataDriver via `withAuth()` for RLS.
  *

package/dist/auth/routes.d.ts

@@ -18,8 +18,23 @@ export interface AuthModuleConfig {
     defaultRole?: string;
     /** Optional array of OAuth providers */
     oauthProviders?: OAuthProvider<unknown>[];
+    /**
+     * Redirect URIs the OAuth routes will accept, for every provider.
+     *
+     * Left unset, the only check is the provider's own registered-URI match,
+     * which authorises every URI registered on that OAuth client. Compared on
+     * origin plus path; query and fragment are ignored, as is a trailing slash.
+     */
+    allowedRedirectUris?: string[];
     /** When true, blocks all self-registration regardless of `allowRegistration`. */
     disableSelfRegistration?: boolean;
+    /**
+     * Opt-in: allow `POST /auth/anonymous` to mint a user without credentials.
+     *
+     * Off by default. See {@link isAnonymousAuthOpen} for why this is opt-in
+     * rather than opt-out, and why `disableSelfRegistration` overrides it.
+     */
+    allowAnonymous?: boolean;
     /**
      * Auth hooks for customizing password hashing, credential
      * verification, lifecycle hooks, etc.

package/dist/auth/slack-oauth.d.ts

@@ -1,4 +1,5 @@
 import type { OAuthProvider } from "./interfaces";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
 /**
  * Creates a Slack OAuth Provider integration (OAuth 2.0 / "Sign in with Slack").
  * Uses the OpenID Connect flow with the "openid,email,profile" scopes.
@@ -6,7 +7,4 @@ import type { OAuthProvider } from "./interfaces";
 export declare function createSlackProvider(config: {
     clientId: string;
     clientSecret: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-}>;
+}): OAuthProvider<OAuthCodeFlowPayload>;

package/dist/auth/spotify-oauth.d.ts

@@ -1,4 +1,5 @@
 import type { OAuthProvider } from "./interfaces";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
 /**
  * Creates a Spotify OAuth Provider integration.
  * Uses the authorization code flow with the "user-read-email" scope.
@@ -6,7 +7,4 @@ import type { OAuthProvider } from "./interfaces";
 export declare function createSpotifyProvider(config: {
     clientId: string;
     clientSecret: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-}>;
+}): OAuthProvider<OAuthCodeFlowPayload>;

package/dist/auth/token-revocation.d.ts

@@ -0,0 +1,38 @@
+import type { AuthRepository } from "./interfaces";
+import type { AccessTokenPayload } from "./jwt";
+/**
+ * Has this access token been revoked?
+ *
+ * `logout`, `change-password`, `reset-password` and `DELETE /auth/sessions` all
+ * stamp a `tokensValidAfter` watermark on the user. Every one of them also
+ * deletes refresh-token rows, which is what made the gap easy to miss: the
+ * session really is gone, and the *refresh* path really does check the
+ * watermark — so signing out looked like it worked.
+ *
+ * The access token was untouched. It is a bearer credential that nothing
+ * consulted a database about, so it stayed valid for its full lifetime after
+ * every one of those actions. "Sign out everywhere" left the stolen token
+ * working; so did changing your password because you thought it had leaked.
+ *
+ * The watermark had exactly one read in the repository, on refresh. This adds
+ * the other one.
+ *
+ * ## Cost
+ *
+ * One indexed lookup per request, on the paths that already make one. The
+ * adapter re-reads roles for every authenticated request; the admin routes now
+ * do too. Both call this with the row they were already fetching in mind — a
+ * repository that wants to serve both from one query is free to cache
+ * internally, but nothing here assumes it.
+ *
+ * ## Failure
+ *
+ * Fails **open**, deliberately, and this is the one place in the auth stack
+ * where that is right. The watermark is an extra revocation signal layered over
+ * a token that has already been verified — signature, expiry and purpose all
+ * checked. Refusing every request when the database is unreachable would turn a
+ * transient outage into a total sign-out of an entire deployment, and the
+ * attacker this protects against needs to have already stolen a live token. The
+ * failure is logged at warn so it is visible rather than silent.
+ */
+export declare function isAccessTokenRevoked(authRepo: Pick<AuthRepository, "getTokensValidAfter">, payload: Pick<AccessTokenPayload, "uid" | "iat">): Promise<boolean>;

package/dist/auth/twitter-oauth.d.ts

@@ -1,4 +1,5 @@
 import type { OAuthProvider } from "./interfaces";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
 /**
  * Creates a Twitter/X OAuth 2.0 Provider integration.
  *
@@ -11,8 +12,4 @@ import type { OAuthProvider } from "./interfaces";
 export declare function createTwitterProvider(config: {
     clientId: string;
     clientSecret: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-    codeVerifier: string;
-}>;
+}): OAuthProvider<OAuthCodeFlowPayload>;