@rebasepro/server 0.14.1-canary.g7e666eb → 0.14.1

package/dist/api/rest/query-parser.d.ts

@@ -15,6 +15,28 @@ type OrderByEntry = {
  * `roles` alone and returned the ties in whatever order Postgres pleased.
  */
 export declare function orderByEntriesToTuples(entries?: OrderByEntry[]): OrderByTuple[] | undefined;
+export interface ParsedAggregate {
+    fn: "count" | "sum" | "avg" | "min" | "max";
+    /** Absent only for `count()`, which counts rows rather than values. */
+    field?: string;
+    /** The key this appears under in the response. */
+    alias: string;
+}
+/**
+ * Parse `?select=count(),sum(total),avg(total)`.
+ *
+ * The spelling is SQL's, because whoever writes it is thinking in SQL and
+ * because any other spelling has to be learned first. `count()` with no field
+ * counts rows; every other function names a column.
+ *
+ * Aliases are derived rather than accepted: `sum(total)` returns as
+ * `sum_total`, `count()` as `count`. Letting a caller choose would mean
+ * checking their alias is not also a `groupBy` field — a rule nobody would
+ * guess, and a silently overwritten value if it went unchecked.
+ */
+export declare function parseAggregateSelect(raw: unknown): ParsedAggregate[] | undefined;
+/** Parse `?groupBy=status,country`. */
+export declare function parseGroupBy(raw: unknown): string[] | undefined;
 export { DEFAULT_LIST_LIMIT, DEFAULT_VECTOR_LIST_LIMIT, MAX_LIST_LIMIT } from "@rebasepro/types";
 /**
  * Overridable list-pagination bounds for {@link parseQueryOptions}. Without

package/dist/auth/index.d.ts

@@ -1,6 +1,8 @@
 export * from "./interfaces";
-export { configureJwt, isJwtConfigured, generateAccessToken, verifyAccessToken, generateRefreshToken, hashRefreshToken, getRefreshTokenExpiry, getAccessTokenExpiry, generateDownloadToken, verifyDownloadToken } from "./jwt";
+export { configureJwt, isJwtConfigured, generateAccessToken, verifyAccessToken, generateRefreshToken, hashRefreshToken, getRefreshTokenExpiry, getAccessTokenExpiry, generateDownloadToken, verifyDownloadToken, getJwks, hasAsymmetricSigningKey } from "./jwt";
 export type { JwtConfig, AccessTokenPayload, DownloadTokenPayload } from "./jwt";
+export { createJwksRoutes } from "./jwks-routes";
+export type { JwtSigningKeyConfig, JwtSigningAlgorithm, PublicJwk } from "./jwt-keys";
 export { hashPassword, verifyPassword, validatePasswordStrength } from "./password";
 export { safeCompare } from "./crypto-utils";
 export type { PasswordValidationResult } from "./password";

package/dist/auth/jwks-routes.d.ts

@@ -0,0 +1,17 @@
+import { Hono } from "hono";
+import type { HonoEnv } from "../api/types";
+/**
+ * `GET /.well-known/jwks.json` — the public keys that verify this issuer's
+ * access tokens.
+ *
+ * Deliberately unauthenticated and world-readable: the whole point is that a
+ * gateway, an edge function or a neighbouring service can check a Rebase token
+ * without being trusted with anything. Public keys are not a secret, and
+ * `jwt-keys.ts` derives what is served here from the public half of each pair.
+ *
+ * Mounted at the root rather than under `basePath`, because `/.well-known/` is
+ * where every verifier looks — an issuer of `https://api.example.com` implies
+ * `https://api.example.com/.well-known/jwks.json`, whatever the API happens to
+ * be prefixed with.
+ */
+export declare function createJwksRoutes(): Hono<HonoEnv>;

package/dist/auth/jwt-keys.d.ts

@@ -0,0 +1,108 @@
+import { type KeyObject } from "crypto";
+/**
+ * Asymmetric signing keys for access tokens, and the JWKS built from them.
+ *
+ * The symmetric secret this replaces is not going away — it still signs every
+ * purpose-scoped token (download, MFA-pending, password reset), which are read
+ * only by the server that minted them and are better off short. What a shared
+ * secret cannot do is let *anybody else* verify a session:
+ *
+ *  - a gateway, an edge worker, or a second service that wants to check a token
+ *    has to be handed the key that mints them, so every verifier becomes a
+ *    forger;
+ *  - and rotating it invalidates every token in circulation at once, which is
+ *    why in practice it never gets rotated at all.
+ *
+ * A private key signs, the matching public key verifies, and the public half is
+ * published at `/.well-known/jwks.json` for anyone to fetch. Rotation stops
+ * being an outage: mint with the new key, keep the old one in the list until
+ * the last token signed by it has expired, then drop it.
+ *
+ * **The key is chosen by `kid`, and the algorithm comes from the key — never
+ * from the token.** A verifier that reads `alg` out of the header it is
+ * checking will accept an `HS256` token whose "secret" is the RSA public key it
+ * published, which is a complete authentication bypass and the best-known way
+ * to get this wrong. {@link resolveVerificationKey} therefore returns the
+ * algorithm alongside the key, and the caller pins it.
+ */
+/** The algorithms a signing key may use. Both are widely supported by verifiers. */
+export type JwtSigningAlgorithm = "RS256" | "ES256";
+/**
+ * One asymmetric key pair, as an operator configures it.
+ *
+ * Only the private key is supplied: the public half is derived from it, so a
+ * mismatched pair — a configuration error that produces tokens nobody can
+ * verify, and which no amount of local testing catches because the signer never
+ * consults the public key — cannot be expressed.
+ */
+export interface JwtSigningKeyConfig {
+    /**
+     * Names this key in the token header and in the JWKS. Any stable string;
+     * something that identifies *when* it was minted (`"2026-08"`) is the usual
+     * choice, because the question you ask of a `kid` later is always "is this
+     * the old one?".
+     */
+    kid: string;
+    /** PEM-encoded PKCS#8 or SEC1 private key. */
+    privateKey: string;
+    /**
+     * Defaults to the algorithm implied by the key type — RSA keys sign RS256,
+     * EC keys sign ES256. Worth setting only to be explicit.
+     */
+    algorithm?: JwtSigningAlgorithm;
+}
+/** A configured key, parsed and ready to sign or verify with. */
+export interface ResolvedJwtKey {
+    kid: string;
+    algorithm: JwtSigningAlgorithm;
+    privateKey: KeyObject;
+    publicKey: KeyObject;
+}
+/** A JSON Web Key, as served by the JWKS endpoint. Public parameters only. */
+export type PublicJwk = Record<string, unknown> & {
+    kid: string;
+    alg: JwtSigningAlgorithm;
+    use: "sig";
+};
+/**
+ * Parse the configured keys, deriving each public half from its private key.
+ *
+ * Throws on anything malformed. This runs at boot, from `configureJwt`, so a
+ * key that cannot sign takes the process down at start rather than at the first
+ * login — the same bargain every other credential in this file makes.
+ */
+export declare function resolveSigningKeys(configs: JwtSigningKeyConfig[]): ResolvedJwtKey[];
+/**
+ * The key a token names, or `null` if it names none we hold.
+ *
+ * The returned algorithm is the *key's*, and the caller must verify with that
+ * one alone. See the module docblock for what happens otherwise.
+ */
+export declare function resolveVerificationKey(keys: ResolvedJwtKey[], kid: string | undefined): ResolvedJwtKey | null;
+/**
+ * A PEM as an environment variable can actually carry it.
+ *
+ * A PEM is multi-line and environment variables are not, so every deployment
+ * tool solves it differently: `.env` files and most secret managers escape the
+ * newlines to `\n`, Kubernetes and Docker secrets pass the bytes through
+ * intact, and CI systems that mangle both are usually fed base64. All three
+ * arrive here, and guessing wrong produces "not a readable PEM private key" at
+ * boot with a key the operator can see is perfectly valid.
+ *
+ * Detection is on content, not on a flag: a PEM says so on its first line, and
+ * anything that does not is tried as base64.
+ */
+export declare function normalizePemFromEnv(value: string): string;
+/**
+ * The public halves, in JWKS form.
+ *
+ * Node exports a JWK containing only public parameters for a public
+ * `KeyObject` — no `d`, no primes — so the private material cannot leak
+ * through this path even if a private key were passed by mistake. The keys are
+ * derived from `publicKey` regardless, and this is asserted in the tests,
+ * because "cannot" is worth checking on the one endpoint whose entire job is to
+ * be world-readable.
+ */
+export declare function toJwks(keys: ResolvedJwtKey[]): {
+    keys: PublicJwk[];
+};

package/dist/auth/jwt.d.ts

@@ -1,7 +1,26 @@
+import { type JwtSigningKeyConfig, type PublicJwk } from "./jwt-keys";
 export interface JwtConfig {
     secret: string;
     accessExpiresIn?: string;
     refreshExpiresIn?: string;
+    /**
+     * Asymmetric keys for signing **access tokens**, newest first.
+     *
+     * Optional and additive: with none configured everything below behaves
+     * exactly as it did, signing HS256 with {@link JwtConfig.secret}. With one
+     * configured, access tokens are signed by {@link JwtConfig.activeKid} (or
+     * the first entry) and carry its `kid`, and every key in the list keeps
+     * verifying — which is what makes rotation a deploy rather than a mass
+     * sign-out. Tokens minted before any key existed carry no `kid` and are
+     * still verified against the secret until they expire.
+     *
+     * The secret stays required regardless: purpose-scoped tokens (download,
+     * MFA-pending, password reset) are read only by this server, and are
+     * shorter and cheaper symmetric. See `jwt-keys.ts`.
+     */
+    signingKeys?: JwtSigningKeyConfig[];
+    /** Which key signs. Defaults to the first entry of {@link JwtConfig.signingKeys}. */
+    activeKid?: string;
 }
 export interface AccessTokenPayload {
     /**
@@ -42,6 +61,19 @@ export interface AccessTokenPayload {
  * Validates the secret strength to prevent deployment with default/weak secrets.
  */
 export declare function configureJwt(config: JwtConfig): void;
+/**
+ * The public keys, in JWKS form, for `/.well-known/jwks.json`.
+ *
+ * An empty `keys` array on a backend with no asymmetric keys configured is the
+ * correct answer rather than a 404: it says "this issuer publishes none",
+ * which a verifier can act on, where a 404 is indistinguishable from a
+ * misconfigured URL.
+ */
+export declare function getJwks(): {
+    keys: PublicJwk[];
+};
+/** Is this backend signing access tokens asymmetrically? */
+export declare function hasAsymmetricSigningKey(): boolean;
 /**
  * Has this server been given a JWT secret?
  *

package/dist/{auth-BQcdhMBL.js → auth-BobZVd0j.js}

@@ -4,8 +4,8 @@ __createRequire(import.meta.url);
 import { i as __toESM, n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
 import { C as ListLimitError, D as isAnonymousUid, E as ANONYMOUS_USER_ID, T as resolveClientListLimit, a as deserializeLogicalCondition, i as deserializeFilter, r as UnknownFilterOperatorError } from "./src-8XDWyDfR.js";
 import "./src-Cz9nMgUR.js";
-import { i as isSQLAdmin, r as revokeInternalTableSql, t as createDdlBootstrapper } from "./ddl-bootstrap-BhXbTnBl.js";
-import { S as require_jsonwebtoken, a as generateMfaPendingToken, c as getRefreshTokenExpiry, d as isJwtConfigured, h as verifyMfaPendingToken, i as generateDownloadToken, l as getRefreshTokenTtlMs, m as verifyDownloadToken, n as configureJwt, o as generateRefreshToken, p as verifyAccessToken, r as generateAccessToken, s as getAccessTokenExpiry, t as MAX_COOKIE_AGE_MS, u as hashRefreshToken, x as tryCanonicalStorageKey, y as canonicalStorageId } from "./jwt-CYGFT0ih.js";
+import { n as createDdlBootstrapper, o as revokeInternalTableSql, s as isSQLAdmin } from "./ddl-bootstrap-Cywoj8Ta.js";
+import { S as canonicalStorageId, T as require_jsonwebtoken, _ as verifyMfaPendingToken, a as generateMfaPendingToken, c as getJwks, d as hasAsymmetricSigningKey, f as hashRefreshToken, g as verifyDownloadToken, h as verifyAccessToken, i as generateDownloadToken, l as getRefreshTokenExpiry, n as configureJwt, o as generateRefreshToken, p as isJwtConfigured, r as generateAccessToken, s as getAccessTokenExpiry, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenTtlMs, w as tryCanonicalStorageKey } from "./jwt-VJyXTdQQ.js";
 import { t as logger } from "./logger-DfvF_8r-.js";
 import { n as errorHandler, t as ApiError } from "./errors-EBYiaJ2E.js";
 import { createHash, randomBytes, randomInt } from "node:crypto";
@@ -187,6 +187,52 @@ function orderByEntriesToTuples(entries) {
 function invalidOrderBy(detail) {
 	throw invalidParam(`Invalid \`orderBy\` parameter: ${detail}. Expected \`field\`, \`field:desc\`, or a JSON array like [{"field":"created_at","direction":"desc"}]`, "INVALID_ORDER_BY");
 }
+/** The aggregate functions `?select=` accepts. */
+var AGGREGATE_FUNCTIONS = /* @__PURE__ */ new Set([
+	"count",
+	"sum",
+	"avg",
+	"min",
+	"max"
+]);
+/**
+* Parse `?select=count(),sum(total),avg(total)`.
+*
+* The spelling is SQL's, because whoever writes it is thinking in SQL and
+* because any other spelling has to be learned first. `count()` with no field
+* counts rows; every other function names a column.
+*
+* Aliases are derived rather than accepted: `sum(total)` returns as
+* `sum_total`, `count()` as `count`. Letting a caller choose would mean
+* checking their alias is not also a `groupBy` field — a rule nobody would
+* guess, and a silently overwritten value if it went unchecked.
+*/
+function parseAggregateSelect(raw) {
+	const value = getLastValue(raw);
+	if (!value) return void 0;
+	const entries = String(value).split(",").map((s) => s.trim()).filter(Boolean);
+	if (entries.length === 0) return void 0;
+	return entries.map((entry) => {
+		const match = /^([a-z]+)\(\s*([A-Za-z0-9_]*)\s*\)$/i.exec(entry);
+		if (!match) throw invalidParam(`Invalid \`select\` entry "${entry}". Expected \`fn(field)\`, e.g. \`sum(total)\` or \`count()\`.`, "INVALID_AGGREGATE_SELECT");
+		const fn = match[1].toLowerCase();
+		const field = match[2] || void 0;
+		if (!AGGREGATE_FUNCTIONS.has(fn)) throw invalidParam(`Unknown aggregate function "${fn}". Expected: ${[...AGGREGATE_FUNCTIONS].join(", ")}.`, "INVALID_AGGREGATE_FUNCTION");
+		if (fn !== "count" && !field) throw invalidParam(`\`${fn}()\` needs a field, e.g. \`${fn}(total)\`. Only \`count()\` may be empty.`, "INVALID_AGGREGATE_SELECT");
+		return {
+			fn,
+			field,
+			alias: field ? `${fn}_${field}` : fn
+		};
+	});
+}
+/** Parse `?groupBy=status,country`. */
+function parseGroupBy(raw) {
+	const value = getLastValue(raw);
+	if (!value) return void 0;
+	const fields = String(value).split(",").map((s) => s.trim()).filter(Boolean);
+	return fields.length > 0 ? fields : void 0;
+}
 /** `asc`/`desc`, in any case. Anything else is a request to sort in a way that does not exist. */
 function toDirection(raw, context) {
 	if (raw === void 0 || raw === null) return "asc";
@@ -311,7 +357,9 @@ function parseQueryOptions(query, limits = {}) {
 		"vector_threshold",
 		"or",
 		"and",
-		"where"
+		"where",
+		"select",
+		"groupBy"
 	];
 	const filterDict = {};
 	for (const [key, rawValue] of Object.entries(query)) {
@@ -7318,7 +7366,7 @@ function mountSessionRoutes(opts) {
 		clearRefreshCookie(c, config.cookieAuth);
 		const accessToken = extractBearerToken(c.req.header("authorization"));
 		if (ops.afterLogout && accessToken !== void 0) {
-			const { verifyAccessToken } = await import("./jwt-CYGFT0ih.js").then((n) => n.f);
+			const { verifyAccessToken } = await import("./jwt-VJyXTdQQ.js").then((n) => n.m);
 			const payload = verifyAccessToken(accessToken);
 			if (payload) ops.afterLogout(payload.uid).catch((err) => {
 				logger.error("[AuthHooks] afterLogout error", { error: err instanceof Error ? err.message : err });
@@ -8948,6 +8996,31 @@ function toAuthUserData(user) {
 	};
 }
 //#endregion
+//#region src/auth/jwks-routes.ts
+/**
+* `GET /.well-known/jwks.json` — the public keys that verify this issuer's
+* access tokens.
+*
+* Deliberately unauthenticated and world-readable: the whole point is that a
+* gateway, an edge function or a neighbouring service can check a Rebase token
+* without being trusted with anything. Public keys are not a secret, and
+* `jwt-keys.ts` derives what is served here from the public half of each pair.
+*
+* Mounted at the root rather than under `basePath`, because `/.well-known/` is
+* where every verifier looks — an issuer of `https://api.example.com` implies
+* `https://api.example.com/.well-known/jwks.json`, whatever the API happens to
+* be prefixed with.
+*/
+function createJwksRoutes() {
+	const router = new Hono();
+	router.get("/jwks.json", (c) => {
+		const jwks = getJwks();
+		c.header("Cache-Control", "public, max-age=300");
+		return c.json(jwks);
+	});
+	return router;
+}
+//#endregion
 //#region src/auth/oauth-code-flow.ts
 /**
 * Build the request schema for an authorization-code provider.
@@ -10377,6 +10450,7 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	createGitHubProvider: () => createGitHubProvider,
 	createGitLabProvider: () => createGitLabProvider,
 	createGoogleProvider: () => createGoogleProvider,
+	createJwksRoutes: () => createJwksRoutes,
 	createLinkedinProvider: () => createLinkedinProvider,
 	createMicrosoftProvider: () => createMicrosoftProvider,
 	createRateLimiter: () => createRateLimiter,
@@ -10395,7 +10469,9 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	generateSecurePassword: () => generateSecurePassword,
 	generateSecureToken: () => generateSecureToken,
 	getAccessTokenExpiry: () => getAccessTokenExpiry,
+	getJwks: () => getJwks,
 	getRefreshTokenExpiry: () => getRefreshTokenExpiry,
+	hasAsymmetricSigningKey: () => hasAsymmetricSigningKey,
 	hashPassword: () => hashPassword,
 	hashRefreshToken: () => hashRefreshToken,
 	hashToken: () => hashToken,
@@ -10425,6 +10501,6 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	verifyPassword: () => verifyPassword
 });
 //#endregion
-export { fileTokenAuth as $, MemoryRateLimitStore as A, getEmailVerificationTemplate as B, ZodNumber as C, _coercedNumber as D, string as E, resolveAuthHooks as F, RawHtml as G, getPasswordResetTemplate as H, hashPassword as I, raw as J, escapeHtml as K, validatePasswordStrength as L, createEmailService as M, assertEmailLinkBases as N, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as O, resolveEmailLinkBase as P, extractUserFromToken as Q, verifyPassword as R, createBuiltinAuthAdapter as S, object as T, getUserInvitationTemplate as U, getMagicLinkTemplate as V, getWelcomeEmailTemplate as W, createAuthMiddleware as X, createAdapterAuthMiddleware as Y, createRequireAuth as Z, createLinkedinProvider as _, parseQueryOptions as _t, createSpotifyProvider as a, createApiKeyPreAuth as at, pkceTokenParams as b, isPublicStoragePath as bt, createGitLabProvider as c, isApiKeyToken as ct, createFacebookProvider as d, safeCompare as dt, optionalAuth as et, createAppleProvider as f, SERVICE_IDENTITY as ft, createGitHubProvider as g, orderByEntriesToTuples as gt, verifyOidcIdToken as h, isOperationAllowed as ht, createApiKeyStore as i, requireAuth as it, SMTPEmailService as j, createDataRateLimiter as k, createDiscordProvider as l, validateApiKey as lt, tryVerifyOidcIdToken as m, httpMethodToOperation as mt, createCustomAuthAdapter as n, queryTokenAuth as nt, createSlackProvider as o, createFunctionApiKeyGuard as ot, createMicrosoftProvider as p, scopeDataDriver as pt, html as q, createApiKeyRoutes as r, requireAdmin as rt, createBitbucketProvider as s, createStorageApiKeyGuard as st, auth_exports as t, publicObjectAuth as tt, createTwitterProvider as u, extractBearerToken as ut, createGoogleProvider as v, resolveListLimitParam as vt, _enum as w, providerVerifiedEmail as x, oauthCodeFlowSchema as y, PUBLIC_STORAGE_PREFIX as yt, generateSecurePassword as z };
+export { extractUserFromToken as $, createDataRateLimiter as A, generateSecurePassword as B, createBuiltinAuthAdapter as C, isPublicStoragePath as Ct, string as D, object as E, resolveEmailLinkBase as F, getWelcomeEmailTemplate as G, getMagicLinkTemplate as H, resolveAuthHooks as I, html as J, RawHtml as K, hashPassword as L, SMTPEmailService as M, createEmailService as N, _coercedNumber as O, assertEmailLinkBases as P, createRequireAuth as Q, validatePasswordStrength as R, createJwksRoutes as S, PUBLIC_STORAGE_PREFIX as St, _enum as T, getPasswordResetTemplate as U, getEmailVerificationTemplate as V, getUserInvitationTemplate as W, createAdapterAuthMiddleware as X, raw as Y, createAuthMiddleware as Z, createLinkedinProvider as _, orderByEntriesToTuples as _t, createSpotifyProvider as a, requireAuth as at, pkceTokenParams as b, parseQueryOptions as bt, createGitLabProvider as c, createStorageApiKeyGuard as ct, createFacebookProvider as d, extractBearerToken as dt, fileTokenAuth as et, createAppleProvider as f, safeCompare as ft, createGitHubProvider as g, isOperationAllowed as gt, verifyOidcIdToken as h, httpMethodToOperation as ht, createApiKeyStore as i, requireAdmin as it, MemoryRateLimitStore as j, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as k, createDiscordProvider as l, isApiKeyToken as lt, tryVerifyOidcIdToken as m, scopeDataDriver as mt, createCustomAuthAdapter as n, publicObjectAuth as nt, createSlackProvider as o, createApiKeyPreAuth as ot, createMicrosoftProvider as p, SERVICE_IDENTITY as pt, escapeHtml as q, createApiKeyRoutes as r, queryTokenAuth as rt, createBitbucketProvider as s, createFunctionApiKeyGuard as st, auth_exports as t, optionalAuth as tt, createTwitterProvider as u, validateApiKey as ut, createGoogleProvider as v, parseAggregateSelect as vt, ZodNumber as w, providerVerifiedEmail as x, resolveListLimitParam as xt, oauthCodeFlowSchema as y, parseGroupBy as yt, verifyPassword as z };
 
-//# sourceMappingURL=auth-BQcdhMBL.js.map
+//# sourceMappingURL=auth-BobZVd0j.js.map