@rebasepro/server 0.14.0 → 0.14.1-canary.g7e666eb

package/dist/api/rest/query-parser.d.ts

@@ -1,6 +1,20 @@
-import type { ListLimitBounds } from "@rebasepro/types";
+import type { ListLimitBounds, OrderByTuple } from "@rebasepro/types";
 import { QueryOptions } from "../types";
 export declare const mapOperator: (op: string) => import("@rebasepro/types").WhereFilterOp | null;
+type OrderByEntry = {
+    field: string;
+    direction: "asc" | "desc";
+};
+/**
+ * The parsed entries as the driver contract spells them: `[field, direction]`
+ * tuples in order of significance.
+ *
+ * The REST layer used to hand the driver `orderBy[0].field` and drop the rest,
+ * so `?orderBy=[{"field":"roles"},{"field":"created_at","direction":"desc"}]`
+ * — a shape this parser has always accepted and validated in full — sorted by
+ * `roles` alone and returned the ties in whatever order Postgres pleased.
+ */
+export declare function orderByEntriesToTuples(entries?: OrderByEntry[]): OrderByTuple[] | undefined;
 export { DEFAULT_LIST_LIMIT, DEFAULT_VECTOR_LIST_LIMIT, MAX_LIST_LIMIT } from "@rebasepro/types";
 /**
  * Overridable list-pagination bounds for {@link parseQueryOptions}. Without

package/dist/api/rest/write-validation.d.ts

@@ -85,3 +85,29 @@ export declare function assertWriteValuesValid(values: Record<string, unknown>,
 export declare function projectResponseFields<T extends Record<string, unknown>>(rows: T[], fields: readonly string[] | undefined, collection: CollectionConfig, options?: {
     include?: readonly string[];
 }): T[];
+/**
+ * Both write checks, as one call, for a transport that is not the REST router.
+ *
+ * The REST routes run `assertKnownWriteFields` and `assertWriteValuesValid`
+ * back to back on the caller's body, seven times over — and they were the only
+ * place either ran. The WebSocket `SAVE` handler took a client payload straight
+ * to `driver.save`, so the same write arrived validated through one door and
+ * unvalidated through the other: `PATCH /api/data/users/1 { age: 999 }` was a
+ * 400, and the socket wrote it.
+ *
+ * Exported for the sockets in `@rebasepro/server-postgres` and
+ * `@rebasepro/server-mongo`, which are the other request boundaries. Not the
+ * route builder — `index.ts` keeps that internal, and this is a rule rather
+ * than wiring.
+ *
+ * It stays at the boundary rather than moving into the driver deliberately: it
+ * validates what a *caller sent*, before `beforeSave` gets a chance to fill in
+ * or rewrite anything. In-process writes through `rebase.data` are trusted
+ * server code and are not run through it, which is the placement the REST layer
+ * already chose.
+ *
+ * @param values     the caller's payload, exactly as it arrived
+ * @param collection resolved from the registry by path — never the copy the
+ *                   client sent, or the rules would be the caller's to pick
+ */
+export declare function assertWriteRequestValid(values: Record<string, unknown>, collection: CollectionConfig): void;

package/dist/auth/interfaces.d.ts

@@ -227,7 +227,20 @@ export interface PaginatedUsersResult {
  */
 export interface UserRepository {
     /**
-     * Create a new user
+     * Create a new user.
+     *
+     * **An email already in use is a 409 `EMAIL_EXISTS`, not a 500.** Every
+     * caller checks first — `POST /auth/register` reads `getUserByEmail` and
+     * answers 409 — and every engine backs that check with a unique index,
+     * because a check cannot hold its answer still. What is left is the window
+     * between the two, and a double-clicked signup button is wide enough: both
+     * requests read "no such user", both insert, one wins.
+     *
+     * The loser's insert violates the index either way; the only question is
+     * what it is turned into. An unmapped driver error is a 500 "Internal
+     * Server Error", which tells the person who clicked twice that the server
+     * is broken rather than that they already have an account — and tells the
+     * operator to go looking for a fault that is not there.
      */
     createUser(data: CreateUserData): Promise<UserData>;
     /**

package/dist/auth/jwt.d.ts

@@ -141,12 +141,40 @@ export declare function verifyMfaPendingToken(token: string): {
 export interface DownloadTokenPayload {
     purpose: "file-read";
     path: string;
+    /**
+     * The storage source the grant is good for, canonicalized by
+     * {@link canonicalStorageId}. Always present on a decoded payload; see
+     * {@link verifyDownloadToken} for how tokens minted before this claim
+     * existed are read.
+     */
+    storageId: string;
 }
 /**
  * Generate a short-lived download token scoped to a specific file path or prefix
+ * *within one storage source*.
+ *
+ * Both halves of that scope are load-bearing. A key is only unique inside its
+ * own bucket, and a project with more than one source routinely holds the same
+ * key in several of them — `avatars/u1.png` in `(default)` and in `media` are
+ * different objects, quite possibly with different owners. A token that names
+ * only the path is therefore a grant on every source at once: authorize a read
+ * on the source whose `storageAuthorize` hook says yes, then spend the token
+ * against `?storageId=` pointing somewhere else.
+ *
+ * `storageId` is optional here only because omitting it *is* the default
+ * source, which is what the overwhelming majority of deployments have. A mint
+ * site that forgets to pass a named source produces a default-scoped token,
+ * which fails closed at `/file/*` rather than over-granting.
  */
-export declare function generateDownloadToken(path: string, expiresInSeconds?: number): string;
+export declare function generateDownloadToken(path: string, expiresInSeconds?: number, storageId?: string | null): string;
 /**
- * Verify and decode a download token
+ * Verify and decode a download token.
+ *
+ * A token minted before `storageId` existed carries no such claim. It is read
+ * as a grant on the **default source** rather than on all of them: that is the
+ * fail-closed reading, and it is what such a token almost always was, since a
+ * named source has to be asked for explicitly. The cost is bounded by the
+ * five-minute TTL — for at most that long after a deploy, an in-flight token
+ * for a *named* source is refused and the client re-fetches `/metadata`.
  */
 export declare function verifyDownloadToken(token: string): DownloadTokenPayload | null;

package/dist/{auth-CYoPVf-E.js → auth-BQcdhMBL.js}

@@ -2,17 +2,16 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { i as __toESM, n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
-import { C as resolveClientListLimit, T as isAnonymousUid, a as deserializeLogicalCondition, i as deserializeFilter, r as UnknownFilterOperatorError, w as ANONYMOUS_USER_ID, x as ListLimitError } from "./src-C7rkDGxA.js";
+import { C as ListLimitError, D as isAnonymousUid, E as ANONYMOUS_USER_ID, T as resolveClientListLimit, a as deserializeLogicalCondition, i as deserializeFilter, r as UnknownFilterOperatorError } from "./src-8XDWyDfR.js";
 import "./src-Cz9nMgUR.js";
 import { i as isSQLAdmin, r as revokeInternalTableSql, t as createDdlBootstrapper } from "./ddl-bootstrap-BhXbTnBl.js";
+import { S as require_jsonwebtoken, a as generateMfaPendingToken, c as getRefreshTokenExpiry, d as isJwtConfigured, h as verifyMfaPendingToken, i as generateDownloadToken, l as getRefreshTokenTtlMs, m as verifyDownloadToken, n as configureJwt, o as generateRefreshToken, p as verifyAccessToken, r as generateAccessToken, s as getAccessTokenExpiry, t as MAX_COOKIE_AGE_MS, u as hashRefreshToken, x as tryCanonicalStorageKey, y as canonicalStorageId } from "./jwt-CYGFT0ih.js";
 import { t as logger } from "./logger-DfvF_8r-.js";
 import { n as errorHandler, t as ApiError } from "./errors-EBYiaJ2E.js";
-import { a as generateMfaPendingToken, c as getRefreshTokenExpiry, d as isJwtConfigured, g as require_jsonwebtoken, h as verifyMfaPendingToken, i as generateDownloadToken, l as getRefreshTokenTtlMs, m as verifyDownloadToken, n as configureJwt, o as generateRefreshToken, p as verifyAccessToken, r as generateAccessToken, s as getAccessTokenExpiry, t as MAX_COOKIE_AGE_MS, u as hashRefreshToken } from "./jwt-_IFqfTOg.js";
 import { createHash, randomBytes, randomInt } from "node:crypto";
 import { Hono } from "hono";
 import { promisify } from "util";
 import { createCipheriv, createDecipheriv, createHash as createHash$1, createHmac, createPublicKey, randomBytes as randomBytes$1, randomUUID as randomUUID$1, scrypt, timingSafeEqual } from "crypto";
-import path from "node:path";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region ../types/src/controllers/storage.ts
 /**
@@ -172,6 +171,19 @@ function parseWhereParam(raw) {
 	const filter = decodeFilter(parsed);
 	return Object.keys(filter).length > 0 ? filter : void 0;
 }
+/**
+* The parsed entries as the driver contract spells them: `[field, direction]`
+* tuples in order of significance.
+*
+* The REST layer used to hand the driver `orderBy[0].field` and drop the rest,
+* so `?orderBy=[{"field":"roles"},{"field":"created_at","direction":"desc"}]`
+* — a shape this parser has always accepted and validated in full — sorted by
+* `roles` alone and returned the ties in whatever order Postgres pleased.
+*/
+function orderByEntriesToTuples(entries) {
+	if (!entries || entries.length === 0) return void 0;
+	return entries.map(({ field, direction }) => [field, direction]);
+}
 function invalidOrderBy(detail) {
 	throw invalidParam(`Invalid \`orderBy\` parameter: ${detail}. Expected \`field\`, \`field:desc\`, or a JSON array like [{"field":"created_at","direction":"desc"}]`, "INVALID_ORDER_BY");
 }
@@ -832,137 +844,6 @@ function createApiKeyPreAuth(options) {
 	};
 }
 //#endregion
-//#region src/storage/keys.ts
-/**
-* Canonical storage keys and bucket names.
-*
-* Storage is not under RLS, so a `storageAuthorize` hook is the whole access
-* control model — and a hook can only be correct if the key it is shown is the
-* key that is written. That is the invariant this module exists to hold: one
-* canonical string, computed once per request, handed to the hook, to the
-* controller, and to the download token alike.
-*
-* ## Why rejecting beats stripping
-*
-* The previous `sanitizeStorageKey` *stripped* `../` in a single pass. Two
-* things were wrong with that, and only one of them was the obvious one.
-*
-* The obvious one: a single pass is not a fixed point. `....//` contains `../`
-* at offset 2, so removing it leaves `../` behind — the sanitizer manufactured
-* the traversal it was there to remove. `users/alice/....//bob/x` came out as
-* `users/alice/../bob/x`, which a prefix hook reads as alice's (it starts with
-* `users/alice/`) and the filesystem reads as bob's. The hook approved one
-* object and the controller wrote another.
-*
-* The subtler one, and the reason this is a rewrite rather than a loop: even a
-* correct strip is a silent rewrite. A caller who asks to store at `a/../b` and
-* gets an object at `a/b` was not protected, they were misled — and every later
-* read, ownership row and audit line now refers to a path nobody chose. So a key
-* that means something other than what it says is refused (400), not repaired.
-*
-* Note what is NOT traversal under this rule: `....` is an ordinary directory
-* name, and `users/alice/....//bob/x` canonicalizes to
-* `users/alice/..../bob/x` — still comfortably inside alice's prefix, which is
-* exactly right. Only a real `..` segment is refused.
-*/
-/** Longest key accepted, in UTF-16 code units. Matches the previous cap. */
-var MAX_STORAGE_KEY_LENGTH = 1024;
-/**
-* A key that cannot be canonicalized. Carries no path back to the caller
-* beyond what they sent, so it is safe to surface as a 400 message.
-*/
-var InvalidStorageKeyError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "InvalidStorageKeyError";
-	}
-};
-/**
-* Canonicalize a caller-supplied storage key, or throw
-* {@link InvalidStorageKeyError}.
-*
-* Normalizations applied (safe, idempotent, and meaning-preserving):
-* - leading slashes removed — `/a/b` and `a/b` name the same object
-* - `.` segments and repeated slashes collapsed
-*
-* Refusals (the key means something other than what it says):
-* - any `..` segment, on either separator, at any depth
-* - null bytes
-* - keys longer than {@link MAX_STORAGE_KEY_LENGTH}
-*
-* A trailing slash is preserved: it is how the folder route marks a prefix.
-*/
-function canonicalStorageKey(rawKey) {
-	if (rawKey.includes("\0")) throw new InvalidStorageKeyError("Storage key contains a null byte.");
-	if (rawKey.length > 1024) throw new InvalidStorageKeyError(`Storage key exceeds the maximum length of ${MAX_STORAGE_KEY_LENGTH} characters.`);
-	if (rawKey.split(/[\\/]/).some((segment) => segment === "..")) throw new InvalidStorageKeyError("Storage key contains a '..' path segment. Keys must name an object directly.");
-	const withoutLeadingSlashes = rawKey.replace(/^\/+/, "");
-	if (withoutLeadingSlashes === "") return "";
-	const denotesDirectory = /(?:^|\/)\.?$/.test(withoutLeadingSlashes);
-	const normalized = path.posix.normalize(withoutLeadingSlashes);
-	if (normalized === "." || normalized === "./") return "";
-	const key = normalized.replace(/^\.\//, "").replace(/^\/+/, "");
-	if (key === "") return "";
-	return denotesDirectory && !key.endsWith("/") ? `${key}/` : key;
-}
-/**
-* Canonicalize, or return `null` when the key is not canonicalizable.
-*
-* For callers that must fail closed without an exception — the download-token
-* middleware compares a request path against a granted path, and a key it
-* cannot canonicalize simply matches nothing.
-*/
-function tryCanonicalStorageKey(rawKey) {
-	try {
-		return canonicalStorageKey(rawKey);
-	} catch {
-		return null;
-	}
-}
-/** A bucket name that does not name a bucket. See {@link canonicalStorageBucket}. */
-var InvalidStorageBucketError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "InvalidStorageBucketError";
-	}
-};
-/**
-* One path segment: letters, digits, `.`, `_`, `-`, first character
-* alphanumeric. Deliberately narrow — it is the intersection of what S3, GCS
-* and a filesystem directory all accept, and it makes `..`, `.tus-uploads`,
-* absolute paths and anything containing a separator unrepresentable.
-*/
-var STORAGE_BUCKET_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-/**
-* Canonicalize a caller-supplied bucket name, or throw
-* {@link InvalidStorageBucketError}.
-*
-* The bucket is the *other* caller-controlled routing value in an upload
-* request, and it was the one nobody validated. `LocalStorageController`
-* builds `join(basePath, bucket)` and then checks containment against that
-* result, so a bucket of `../../etc` moved the boundary rather than crossing
-* it — the guard passed because the guard's reference point was the attacker's.
-* The containment check now resolves against the storage root, and this is the
-* check at the route boundary that stops the value before it gets there.
-*
-* A bucket is configuration, not user data: there is no legitimate caller that
-* needs a separator, a leading dot, or a `..` in one. So this refuses rather
-* than repairs, exactly as {@link canonicalStorageKey} does — a rewritten
-* bucket would silently store the object somewhere the caller did not ask for.
-*
-* Returns `undefined` when the caller named no bucket (absent, or an empty
-* form field), which is how every controller spells "use my default". An empty
-* string used to reach `getFullPath` and resolve to the storage *root* rather
-* than the `default` bucket, which is a third place a bare key did not
-* round-trip.
-*/
-function canonicalStorageBucket(rawBucket) {
-	if (rawBucket === void 0 || rawBucket === null || rawBucket === "") return void 0;
-	if (rawBucket.length > 63) throw new InvalidStorageBucketError(`Storage bucket exceeds the maximum length of 63 characters.`);
-	if (!STORAGE_BUCKET_PATTERN.test(rawBucket)) throw new InvalidStorageBucketError("Storage bucket must be a single name of letters, digits, '.', '_' or '-', starting with a letter or digit.");
-	return rawBucket;
-}
-//#endregion
 //#region src/auth/middleware.ts
 /**
 * Hono middleware that requires a valid JWT token via Authorization header.
@@ -1326,25 +1207,49 @@ var fileTokenAuth = async (c, next) => {
 			resolvedPath: tryCanonicalStorageKey(filePath)
 		};
 	};
+	/**
+	* Decide what a valid download token entitles this request to.
+	*
+	* One function rather than a copy per token location: a Bearer token and a
+	* `?token=` are the same grant presented two ways, and the whole failure
+	* this guards against is two places disagreeing about what was granted.
+	*
+	* `"no-path"` is distinct from the two denials because the caller treats it
+	* differently — a request with no object path at all is not a denied read,
+	* it is a request this middleware has nothing to say about, and on
+	* `/metadata/*` it must still reach the downstream auth gate.
+	*/
+	const evaluateGrant = (payload) => {
+		if (canonicalStorageId(c.req.query("storageId")) !== payload.storageId) return "deny-storage";
+		const rawPath = extractWildcard(c);
+		if (!rawPath) return "no-path";
+		const { bucket, resolvedPath } = parseBucketPath(decodeURIComponent(rawPath));
+		if (resolvedPath === null) return "deny-path";
+		return isPathMatch(`${bucket}/${resolvedPath}`, payload.path) ? "grant" : "deny-path";
+	};
+	/**
+	* Which half of the scope failed is named in the message. The holder of the
+	* token already knows both values, so this reveals nothing to an attacker —
+	* and without it, a client that forgets to forward `?storageId=` on the file
+	* URL reports a "path mismatch" for a path that matches perfectly.
+	*/
+	const denyMismatch = (outcome) => c.json({ error: {
+		message: outcome === "deny-storage" ? "Forbidden: Scoped token storage mismatch" : "Forbidden: Scoped token path mismatch",
+		code: "FORBIDDEN"
+	} }, 403);
 	const bearerToken = extractBearerToken(authHeader);
 	if (bearerToken !== void 0) {
 		const payload = verifyDownloadToken(bearerToken);
 		if (payload) {
-			const rawPath = extractWildcard(c);
-			if (rawPath) {
-				const { bucket, resolvedPath } = parseBucketPath(decodeURIComponent(rawPath));
-				const requestedFullPath = resolvedPath === null ? null : `${bucket}/${resolvedPath}`;
-				if (requestedFullPath !== null && isPathMatch(requestedFullPath, payload.path)) {
-					c.set("user", {
-						uid: "download-token",
-						roles: ["reader"]
-					});
-					return next();
-				} else return c.json({ error: {
-					message: "Forbidden: Scoped token path mismatch",
-					code: "FORBIDDEN"
-				} }, 403);
+			const outcome = evaluateGrant(payload);
+			if (outcome === "grant") {
+				c.set("user", {
+					uid: "download-token",
+					roles: ["reader"]
+				});
+				return next();
 			}
+			if (outcome !== "no-path") return denyMismatch(outcome);
 		}
 		if (isFileRoute) return c.json({ error: {
 			message: "Unauthorized: Access JWT not allowed on file routes",
@@ -1355,21 +1260,15 @@ var fileTokenAuth = async (c, next) => {
 	if (queryToken) {
 		const payload = verifyDownloadToken(queryToken);
 		if (payload) {
-			const rawPath = extractWildcard(c);
-			if (rawPath) {
-				const { bucket, resolvedPath } = parseBucketPath(decodeURIComponent(rawPath));
-				const requestedFullPath = resolvedPath === null ? null : `${bucket}/${resolvedPath}`;
-				if (requestedFullPath !== null && isPathMatch(requestedFullPath, payload.path)) {
-					c.set("user", {
-						uid: "download-token",
-						roles: ["reader"]
-					});
-					return next();
-				} else return c.json({ error: {
-					message: "Forbidden: Scoped token path mismatch",
-					code: "FORBIDDEN"
-				} }, 403);
+			const outcome = evaluateGrant(payload);
+			if (outcome === "grant") {
+				c.set("user", {
+					uid: "download-token",
+					roles: ["reader"]
+				});
+				return next();
 			}
+			if (outcome !== "no-path") return denyMismatch(outcome);
 		}
 		return c.json({ error: {
 			message: "Unauthorized: Invalid or unauthorized token",
@@ -7419,7 +7318,7 @@ function mountSessionRoutes(opts) {
 		clearRefreshCookie(c, config.cookieAuth);
 		const accessToken = extractBearerToken(c.req.header("authorization"));
 		if (ops.afterLogout && accessToken !== void 0) {
-			const { verifyAccessToken } = await import("./jwt-_IFqfTOg.js").then((n) => n.f);
+			const { verifyAccessToken } = await import("./jwt-CYGFT0ih.js").then((n) => n.f);
 			const payload = verifyAccessToken(accessToken);
 			if (payload) ops.afterLogout(payload.uid).catch((err) => {
 				logger.error("[AuthHooks] afterLogout error", { error: err instanceof Error ? err.message : err });
@@ -10526,6 +10425,6 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	verifyPassword: () => verifyPassword
 });
 //#endregion
-export { fileTokenAuth as $, MemoryRateLimitStore as A, getEmailVerificationTemplate as B, ZodNumber as C, isPublicStoragePath as Ct, _coercedNumber as D, string as E, resolveAuthHooks as F, RawHtml as G, getPasswordResetTemplate as H, hashPassword as I, raw as J, escapeHtml as K, validatePasswordStrength as L, createEmailService as M, assertEmailLinkBases as N, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as O, resolveEmailLinkBase as P, extractUserFromToken as Q, verifyPassword as R, createBuiltinAuthAdapter as S, PUBLIC_STORAGE_PREFIX as St, object as T, getUserInvitationTemplate as U, getMagicLinkTemplate as V, getWelcomeEmailTemplate as W, createAuthMiddleware as X, createAdapterAuthMiddleware as Y, createRequireAuth as Z, createLinkedinProvider as _, scopeDataDriver as _t, createSpotifyProvider as a, InvalidStorageBucketError as at, pkceTokenParams as b, parseQueryOptions as bt, createGitLabProvider as c, canonicalStorageKey as ct, createFacebookProvider as d, createStorageApiKeyGuard as dt, optionalAuth as et, createAppleProvider as f, isApiKeyToken as ft, createGitHubProvider as g, SERVICE_IDENTITY as gt, verifyOidcIdToken as h, safeCompare as ht, createApiKeyStore as i, requireAuth as it, SMTPEmailService as j, createDataRateLimiter as k, createDiscordProvider as l, createApiKeyPreAuth as lt, tryVerifyOidcIdToken as m, extractBearerToken as mt, createCustomAuthAdapter as n, queryTokenAuth as nt, createSlackProvider as o, InvalidStorageKeyError as ot, createMicrosoftProvider as p, validateApiKey as pt, html as q, createApiKeyRoutes as r, requireAdmin as rt, createBitbucketProvider as s, canonicalStorageBucket as st, auth_exports as t, publicObjectAuth as tt, createTwitterProvider as u, createFunctionApiKeyGuard as ut, createGoogleProvider as v, httpMethodToOperation as vt, _enum as w, providerVerifiedEmail as x, resolveListLimitParam as xt, oauthCodeFlowSchema as y, isOperationAllowed as yt, generateSecurePassword as z };
+export { fileTokenAuth as $, MemoryRateLimitStore as A, getEmailVerificationTemplate as B, ZodNumber as C, _coercedNumber as D, string as E, resolveAuthHooks as F, RawHtml as G, getPasswordResetTemplate as H, hashPassword as I, raw as J, escapeHtml as K, validatePasswordStrength as L, createEmailService as M, assertEmailLinkBases as N, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as O, resolveEmailLinkBase as P, extractUserFromToken as Q, verifyPassword as R, createBuiltinAuthAdapter as S, object as T, getUserInvitationTemplate as U, getMagicLinkTemplate as V, getWelcomeEmailTemplate as W, createAuthMiddleware as X, createAdapterAuthMiddleware as Y, createRequireAuth as Z, createLinkedinProvider as _, parseQueryOptions as _t, createSpotifyProvider as a, createApiKeyPreAuth as at, pkceTokenParams as b, isPublicStoragePath as bt, createGitLabProvider as c, isApiKeyToken as ct, createFacebookProvider as d, safeCompare as dt, optionalAuth as et, createAppleProvider as f, SERVICE_IDENTITY as ft, createGitHubProvider as g, orderByEntriesToTuples as gt, verifyOidcIdToken as h, isOperationAllowed as ht, createApiKeyStore as i, requireAuth as it, SMTPEmailService as j, createDataRateLimiter as k, createDiscordProvider as l, validateApiKey as lt, tryVerifyOidcIdToken as m, httpMethodToOperation as mt, createCustomAuthAdapter as n, queryTokenAuth as nt, createSlackProvider as o, createFunctionApiKeyGuard as ot, createMicrosoftProvider as p, scopeDataDriver as pt, html as q, createApiKeyRoutes as r, requireAdmin as rt, createBitbucketProvider as s, createStorageApiKeyGuard as st, auth_exports as t, publicObjectAuth as tt, createTwitterProvider as u, extractBearerToken as ut, createGoogleProvider as v, resolveListLimitParam as vt, _enum as w, providerVerifiedEmail as x, oauthCodeFlowSchema as y, PUBLIC_STORAGE_PREFIX as yt, generateSecurePassword as z };
 
-//# sourceMappingURL=auth-CYoPVf-E.js.map
+//# sourceMappingURL=auth-BQcdhMBL.js.map