@rebasepro/server 0.13.1-canary.gf57a27e → 0.14.0

package/dist/init/docs.d.ts

@@ -1,4 +1,13 @@
 import { Hono } from "hono";
 import { CollectionConfig } from "@rebasepro/types";
 import { HonoEnv } from "../api/types";
-export declare function mountOpenApiDocs(app: Hono<HonoEnv>, basePath: string, enableSwagger: boolean | undefined, activeCollections: CollectionConfig[], requireAuth: boolean): Promise<void>;
+/**
+ * Serve the OpenAPI document, and Swagger UI outside production.
+ *
+ * `serverCollections` must be the collections the REST routes were generated
+ * from — the ones whose data source has a `"server"` transport — not every
+ * active collection. A direct-transport collection is served by the client
+ * against its own backend; documenting it here publishes a full set of CRUD
+ * paths that 404, with a Try-It button next to each.
+ */
+export declare function mountOpenApiDocs(app: Hono<HonoEnv>, basePath: string, enableSwagger: boolean | undefined, serverCollections: CollectionConfig[], requireAuth: boolean): Promise<void>;

package/dist/init/process-safety.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Log unhandled promise rejections instead of letting Node terminate the
+ * process.
+ *
+ * Node has terminated on an unhandled rejection since v15. Hono catches
+ * anything thrown or rejected inside an awaited handler, so the ordinary
+ * request path is covered — but a fire-and-forget `void syncToCrm(body)`, a
+ * `setTimeout(async () => …)`, or an unawaited `.then()` in one custom function
+ * rejects outside Hono's frame. The default outcome is that one project's
+ * floating promise ends the process; on the managed runtime that process is
+ * shared, so every other tenant on the pod goes with it, and the request log
+ * points nowhere because the request itself succeeded.
+ *
+ * A logged rejection is the better trade here: the process keeps serving, and
+ * the stack reaches the operator. `uncaughtException` is deliberately **not**
+ * handled — a synchronous throw that escaped every frame leaves the process in
+ * a state we cannot reason about, and swallowing it would be a worse bargain
+ * than a restart.
+ *
+ * Set `REBASE_EXIT_ON_UNHANDLED_REJECTION=1` to restore Node's default.
+ *
+ * @returns An uninstall function (used by tests), or `undefined` when nothing
+ * was installed.
+ */
+export declare function installUnhandledRejectionHandler(): (() => void) | undefined;

package/dist/init.d.ts

@@ -49,6 +49,17 @@ export interface RebaseAuthConfig {
      * create the first user with the CLI or a seed script.
      */
     disableSelfRegistration?: boolean;
+    /**
+     * Opt-in: allow `POST /auth/anonymous` to mint a user with no credentials.
+     *
+     * Off by default. Anonymous sign-in inserts a `users` row and assigns
+     * `defaultRole` exactly as registration does, so leaving it always-on meant
+     * a backend with `allowRegistration: false` and `disableSelfRegistration:
+     * true` still handed out permanent accounts: `/auth/anonymous` for the row
+     * and the session, then `/auth/anonymous/link` to put an email and password
+     * on it. `disableSelfRegistration` overrides this key.
+     */
+    allowAnonymous?: boolean;
     /**
      * Opt-in: expose `POST /auth/find-user` so an authenticated user can resolve
      * an email address to a minimal public profile (`uid`, `displayName`,
@@ -149,6 +160,22 @@ export interface RebaseAuthConfig {
      * ```
      */
     providers?: OAuthProvider<unknown>[];
+    /**
+     * Redirect URIs the OAuth sign-in routes will accept, for every provider.
+     *
+     * Left unset, the only check is the provider's own registered-URI match —
+     * which authorises *every* URI registered on that OAuth client, including
+     * the `localhost` entry someone added for development and the staging host
+     * nobody removed. List the origins this backend actually serves to narrow
+     * it. Compared on origin plus path; query, fragment and a trailing slash
+     * are ignored.
+     *
+     * @example
+     * ```ts
+     * auth: { allowedRedirectUris: ["https://admin.example.com/"] }
+     * ```
+     */
+    allowedRedirectUris?: string[];
     /**
      * Override specific parts of the built-in auth implementation.
      *
@@ -344,6 +371,17 @@ export interface RebaseBackendConfig {
     history?: HistoryConfig;
     enableSwagger?: boolean;
     functionsDir?: string;
+    /**
+     * Per-request ceiling for `/api/functions/*`, in milliseconds.
+     *
+     * Custom functions run code the framework did not write, and nothing else
+     * in the stack bounds it. Defaults to 30000 (or
+     * `REBASE_FUNCTIONS_TIMEOUT_MS`). `0` disables the ceiling — for a function
+     * that legitimately runs long, or a deployment whose proxy already imposes
+     * one. Timed-out requests answer 504; the handler itself cannot be
+     * cancelled, so give outbound calls an `AbortSignal`.
+     */
+    functionsTimeoutMs?: number;
     cronsDir?: string;
     /**
      * Enable/disable database persistence for cron job execution logs.

package/dist/{jwt-CzeviDcB.js → jwt-_IFqfTOg.js}

@@ -2,7 +2,7 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { i as __toESM, n as __exportAll, r as __require, t as __commonJSMin } from "./rolldown-runtime-DSJWtz9O.js";
-import { t as logger } from "./logger-BYU66ENZ.js";
+import { t as logger } from "./logger-DfvF_8r-.js";
 import { createHash, randomBytes } from "crypto";
 //#region ../../node_modules/.pnpm/safe-buffer@5.2.1/node_modules/safe-buffer/index.js
 var require_safe_buffer = /* @__PURE__ */ __commonJSMin(((exports, module) => {
@@ -2275,7 +2275,7 @@ var require_verify = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var validateAsymmetricKey = require_validateAsymmetricKey();
 	var PS_SUPPORTED = require_psSupported();
 	var jws = require_jws();
-	var { KeyObject: KeyObject$1, createSecretKey: createSecretKey$1, createPublicKey } = __require("crypto");
+	var { KeyObject: KeyObject$1, createSecretKey: createSecretKey$1, createPublicKey: createPublicKey$1 } = __require("crypto");
 	var PUB_KEY_ALGS = [
 		"RS256",
 		"RS384",
@@ -2343,7 +2343,7 @@ var require_verify = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			if (hasSignature && !secretOrPublicKey) return done(new JsonWebTokenError("secret or public key must be provided"));
 			if (!hasSignature && !options.algorithms) return done(new JsonWebTokenError("please specify \"none\" in \"algorithms\" to verify unsigned tokens"));
 			if (secretOrPublicKey != null && !(secretOrPublicKey instanceof KeyObject$1)) try {
-				secretOrPublicKey = createPublicKey(secretOrPublicKey);
+				secretOrPublicKey = createPublicKey$1(secretOrPublicKey);
 			} catch (_) {
 				try {
 					secretOrPublicKey = createSecretKey$1(typeof secretOrPublicKey === "string" ? Buffer.from(secretOrPublicKey) : secretOrPublicKey);
@@ -4150,9 +4150,11 @@ var require_jsonwebtoken = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#region src/auth/jwt.ts
 var jwt_exports = /* @__PURE__ */ __exportAll({
 	MAX_COOKIE_AGE_MS: () => MAX_COOKIE_AGE_MS,
+	MFA_PENDING_PURPOSE: () => MFA_PENDING_PURPOSE,
 	configureJwt: () => configureJwt,
 	generateAccessToken: () => generateAccessToken,
 	generateDownloadToken: () => generateDownloadToken,
+	generateMfaPendingToken: () => generateMfaPendingToken,
 	generateRefreshToken: () => generateRefreshToken,
 	getAccessTokenExpiry: () => getAccessTokenExpiry,
 	getAccessTokenExpiryMs: () => getAccessTokenExpiryMs,
@@ -4161,7 +4163,8 @@ var jwt_exports = /* @__PURE__ */ __exportAll({
 	hashRefreshToken: () => hashRefreshToken,
 	isJwtConfigured: () => isJwtConfigured,
 	verifyAccessToken: () => verifyAccessToken,
-	verifyDownloadToken: () => verifyDownloadToken
+	verifyDownloadToken: () => verifyDownloadToken,
+	verifyMfaPendingToken: () => verifyMfaPendingToken
 });
 var import_jsonwebtoken = /* @__PURE__ */ __toESM(require_jsonwebtoken(), 1);
 var jwtConfig = {
@@ -4224,8 +4227,8 @@ function generateAccessToken(uid, roles, aal = "aal1", customClaims) {
 	const payload = {
 		uid,
 		roles,
-		aal,
-		...customClaims
+		...customClaims,
+		aal
 	};
 	return import_jsonwebtoken.default.sign(payload, jwtConfig.secret, {
 		expiresIn: jwtConfig.accessExpiresIn,
@@ -4284,7 +4287,8 @@ function verifyAccessToken(token) {
 		return {
 			uid: id,
 			roles: decoded.roles || [],
-			aal
+			aal,
+			iat: decoded.iat
 		};
 	} catch (error) {
 		logger.error("[JWT] Verification failed", {
@@ -4343,6 +4347,50 @@ function getRefreshTokenExpiry() {
 	return new Date(Date.now() + getRefreshTokenTtlMs());
 }
 /**
+* The `purpose` claim carried by a credential that stands between "first factor
+* accepted" and "session issued".
+*
+* A pre-auth token is NOT a session and must never be usable as one:
+* {@link verifyAccessToken} refuses any token carrying a `purpose`, so this
+* value cannot authenticate a request no matter which route it is presented to.
+* The only thing that reads it is the MFA challenge pair, which exchanges it —
+* plus a second factor — for a real session.
+*/
+var MFA_PENDING_PURPOSE = "mfa-pending";
+/**
+* Mint the short-lived credential handed back with an `MFA_REQUIRED` response.
+*
+* Short-lived on purpose: it is the window in which a caller who has proven the
+* first factor may present the second, not a session to be carried around. Five
+* minutes matches the challenge TTL.
+*/
+function generateMfaPendingToken(uid, expiresInSeconds = 300) {
+	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
+	return import_jsonwebtoken.default.sign({
+		purpose: MFA_PENDING_PURPOSE,
+		uid
+	}, jwtConfig.secret, {
+		expiresIn: expiresInSeconds,
+		algorithm: "HS256"
+	});
+}
+/**
+* Verify a pre-auth token and return the user it was minted for.
+*
+* Returns `null` for anything else — including a perfectly valid *access*
+* token, which must not be interchangeable with this one in either direction.
+*/
+function verifyMfaPendingToken(token) {
+	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
+	try {
+		const decoded = import_jsonwebtoken.default.verify(token, jwtConfig.secret, { algorithms: ["HS256"] });
+		if (decoded.purpose !== "mfa-pending" || !decoded.uid) return null;
+		return { uid: decoded.uid };
+	} catch {
+		return null;
+	}
+}
+/**
 * Generate a short-lived download token scoped to a specific file path or prefix
 */
 function generateDownloadToken(path, expiresInSeconds = 300) {
@@ -4374,6 +4422,6 @@ function verifyDownloadToken(token) {
 	}
 }
 //#endregion
-export { generateRefreshToken as a, getRefreshTokenTtlMs as c, jwt_exports as d, verifyAccessToken as f, generateDownloadToken as i, hashRefreshToken as l, require_jsonwebtoken as m, configureJwt as n, getAccessTokenExpiry as o, verifyDownloadToken as p, generateAccessToken as r, getRefreshTokenExpiry as s, MAX_COOKIE_AGE_MS as t, isJwtConfigured as u };
+export { generateMfaPendingToken as a, getRefreshTokenExpiry as c, isJwtConfigured as d, jwt_exports as f, require_jsonwebtoken as g, verifyMfaPendingToken as h, generateDownloadToken as i, getRefreshTokenTtlMs as l, verifyDownloadToken as m, configureJwt as n, generateRefreshToken as o, verifyAccessToken as p, generateAccessToken as r, getAccessTokenExpiry as s, MAX_COOKIE_AGE_MS as t, hashRefreshToken as u };
 
-//# sourceMappingURL=jwt-CzeviDcB.js.map
+//# sourceMappingURL=jwt-_IFqfTOg.js.map