@rebasepro/server 0.16.1-canary.ge71347e → 0.17.0

package/dist/{auth-Cd6qQw_0.js → auth-BVPx33qB.js}

@@ -5,8 +5,9 @@ __rebaseCreateRequire(import.meta.url);
 import { i as __toESM, n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
 import { D as isAnonymousUid, E as ANONYMOUS_USER_ID } from "./src-B-CmIFMr.js";
 import "./src-Cdsw7DqV.js";
-import { n as createDdlBootstrapper, o as revokeInternalTableSql, s as isSQLAdmin } from "./ddl-bootstrap-euwN8FOy.js";
-import { S as canonicalStorageId, T as require_jsonwebtoken, _ as verifyMfaPendingToken, a as generateMfaPendingToken, c as getJwks, d as hasAsymmetricSigningKey, f as hashRefreshToken, g as verifyDownloadToken, h as verifyAccessToken, i as generateDownloadToken, l as getRefreshTokenExpiry, n as configureJwt, o as generateRefreshToken, p as isJwtConfigured, r as generateAccessToken, s as getAccessTokenExpiry, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenTtlMs, w as tryCanonicalStorageKey } from "./jwt-DoHkMMWF.js";
+import { n as createDdlBootstrapper, o as isSQLAdmin } from "./ddl-bootstrap-5YZCZ8qk.js";
+import { D as randomInt$1, E as constantTimeEqual, O as sha256Hex, S as canonicalStorageId, T as require_jsonwebtoken, _ as verifyMfaPendingToken, a as generateMfaPendingToken, c as getJwks, d as hasAsymmetricSigningKey, f as hashRefreshToken, g as verifyDownloadToken, h as verifyAccessToken, i as generateDownloadToken, l as getRefreshTokenExpiry, n as configureJwt, o as generateRefreshToken, p as isJwtConfigured, r as generateAccessToken, s as getAccessTokenExpiry, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenTtlMs, w as tryCanonicalStorageKey } from "./jwt-5VN4C6ln.js";
+import { t as revokeInternalTableSql } from "./internal-tables-DpxfPaEB.js";
 import { t as logger } from "./logger-DS03e908.js";
 import { n as errorHandler, t as ApiError } from "./errors-DBwpj9N8.js";
 import { a as resolveListLimitParam } from "./query-parser--nstjRCh.js";
@@ -14,7 +15,7 @@ import { i as object, o as string } from "./schemas-DBxgjM9A.js";
 import { createHash, randomBytes, randomInt } from "node:crypto";
 import { Hono } from "hono";
 import { promisify } from "util";
-import { createCipheriv, createDecipheriv, createHash as createHash$1, createHmac, createPublicKey, randomBytes as randomBytes$1, randomUUID as randomUUID$1, scrypt, timingSafeEqual } from "crypto";
+import { createCipheriv, createDecipheriv, createHash as createHash$1, createHmac, createPublicKey, randomBytes as randomBytes$1, randomUUID, scrypt, timingSafeEqual } from "crypto";
 import { getConnInfo } from "@hono/node-server/conninfo";
 import { createMiddleware } from "hono/factory";
 //#region ../types/src/controllers/storage.ts
@@ -296,23 +297,16 @@ async function scopeDataDriver(driver, user) {
 * Used for comparing service keys, tokens, and other secrets where
 * timing side-channels could leak information about the expected value.
 *
+* The implementation lives in `utils/portable-crypto.ts`, which does this over
+* UTF-8 bytes without `node:crypto` — this function is on the request path, and
+* the byte-level reasoning it depends on is documented there.
+*
 * @param a - First string to compare.
 * @param b - Second string to compare.
 * @returns `true` if the strings are identical, `false` otherwise.
 */
 function safeCompare(a, b) {
-	const bytesA = Buffer.from(a, "utf8");
-	const bytesB = Buffer.from(b, "utf8");
-	const length = Math.max(bytesA.length, bytesB.length);
-	const paddedA = Buffer.alloc(length);
-	const paddedB = Buffer.alloc(length);
-	bytesA.copy(paddedA);
-	bytesB.copy(paddedB);
-	try {
-		return timingSafeEqual(paddedA, paddedB) && bytesA.length === bytesB.length;
-	} catch {
-		return false;
-	}
+	return constantTimeEqual(a, b);
 }
 //#endregion
 //#region src/auth/bearer-token.ts
@@ -351,29 +345,6 @@ function extractBearerToken(authHeader) {
 //#endregion
 //#region src/auth/api-keys/api-key-middleware.ts
 /**
-* Hono middleware for authenticating requests via Service API Keys.
-*
-* This middleware is integrated into `createAuthMiddleware()` and
-* activates only when the bearer token starts with `rk_`. It:
-*
-* 1. Hashes the token with SHA-256
-* 2. Looks up the hash in the `rebase.api_keys` table
-* 3. Validates the key is not revoked and not expired
-* 4. Sets `c.set("user", ...)` and `c.set("apiKey", ...)` for downstream use
-* 5. Scopes the DataDriver via `withAuth()` using the API key's service identity
-*
-* Authorization is double-gated for API keys: the key's own permission list
-* (checked by the REST generator) is one ceiling, and Postgres RLS is another,
-* independent one — `withAuth()` runs API-key requests as the restricted
-* `rebase_user` role like any other caller. An `admin` key passes RLS via the
-* injected `default_admin` policies; a non-admin key (roles `["service"]`,
-* uid `api-key:<id>`) only sees rows that a policy explicitly grants to the
-* `service` role or to the public. Owner-style policies
-* (`owner_id = rebase.uid()`) never match an API key's synthetic uid.
-*
-* @module
-*/
-/**
 * Check whether a token looks like a Rebase API key.
 */
 function isApiKeyToken(token) {
@@ -381,9 +352,12 @@ function isApiKeyToken(token) {
 }
 /**
 * Hash a plaintext API key token for database lookup.
+*
+* Async because it hashes with WebCrypto rather than `node:crypto` — the sole
+* caller was already awaiting the store lookup this feeds.
 */
 function hashToken$1(token) {
-	return createHash$1("sha256").update(token).digest("hex");
+	return sha256Hex(token);
 }
 /**
 * Validate an API key token and populate the Hono context.
@@ -396,7 +370,7 @@ function hashToken$1(token) {
 */
 async function validateApiKey(c, token, options) {
 	const { store, driver } = options;
-	const hash = hashToken$1(token);
+	const hash = await hashToken$1(token);
 	const apiKey = await store.findByKeyHash(hash);
 	if (!apiKey) return c.json({ error: {
 		message: "Invalid API key",
@@ -569,7 +543,7 @@ var requireAuth = async (c, next) => {
 		message: "Authorization header missing or invalid",
 		code: "UNAUTHORIZED"
 	} }, 401);
-	const payload = verifyAccessToken(token);
+	const payload = await verifyAccessToken(token);
 	if (!payload) return c.json({ error: {
 		message: "Invalid or expired token",
 		code: "UNAUTHORIZED"
@@ -606,7 +580,7 @@ function createRequireAuth(options) {
 			});
 			return next();
 		}
-		const payload = verifyAccessToken(token);
+		const payload = await verifyAccessToken(token);
 		if (!payload) return c.json({ error: {
 			message: "Invalid or expired token",
 			code: "UNAUTHORIZED"
@@ -662,7 +636,7 @@ var optionalAuth = async (c, next) => {
 	if (c.get("user")) return next();
 	const token = extractBearerToken(c.req.header("authorization"));
 	if (token !== void 0 && isJwtConfigured()) {
-		const payload = verifyAccessToken(token);
+		const payload = await verifyAccessToken(token);
 		if (payload) c.set("user", payload);
 	}
 	return next();
@@ -670,7 +644,7 @@ var optionalAuth = async (c, next) => {
 /**
 * Extract user from token - for WebSocket authentication
 */
-function extractUserFromToken(token) {
+async function extractUserFromToken(token) {
 	if (!isJwtConfigured()) return null;
 	return verifyAccessToken(token);
 }
@@ -761,7 +735,7 @@ function createAuthMiddleware(options) {
 				});
 				if (result !== true) return result;
 			} else {
-				const payload = extractUserFromToken(token);
+				const payload = await extractUserFromToken(token);
 				if (payload) {
 					c.set("user", payload);
 					try {
@@ -823,7 +797,7 @@ var queryTokenAuth = async (c, next) => {
 	if (extractBearerToken(c.req.header("authorization")) !== void 0) return next();
 	const queryToken = c.req.query("token");
 	if (queryToken && isJwtConfigured()) {
-		const payload = verifyAccessToken(queryToken);
+		const payload = await verifyAccessToken(queryToken);
 		if (payload) c.set("user", payload);
 	}
 	return next();
@@ -946,7 +920,7 @@ var fileTokenAuth = async (c, next) => {
 	} }, 403);
 	const bearerToken = extractBearerToken(authHeader);
 	if (bearerToken !== void 0) {
-		const payload = verifyDownloadToken(bearerToken);
+		const payload = await verifyDownloadToken(bearerToken);
 		if (payload) {
 			const outcome = evaluateGrant(payload);
 			if (outcome === "grant") {
@@ -965,7 +939,7 @@ var fileTokenAuth = async (c, next) => {
 		return next();
 	}
 	if (queryToken) {
-		const payload = verifyDownloadToken(queryToken);
+		const payload = await verifyDownloadToken(queryToken);
 		if (payload) {
 			const outcome = evaluateGrant(payload);
 			if (outcome === "grant") {
@@ -2423,10 +2397,10 @@ function createRateLimiter(options = {}) {
 	const trustedProxyHops = resolveTrustedProxyHops(options.trustedProxyHops);
 	const { windowMs = 900 * 1e3, limit = 100, keyGenerator = (c) => defaultKeyGenerator(c, trustedProxyHops), message = "Too many requests, please try again later.", store = new MemoryRateLimitStore(windowMs), resolveLimit } = options;
 	return async (c, next) => {
-		const effectiveLimit = resolveLimit ? resolveLimit(c) : limit;
+		const effectiveLimit = resolveLimit ? await resolveLimit(c) : limit;
 		if (effectiveLimit === null) return next();
 		const activeLimit = effectiveLimit ?? limit;
-		const decision = await store.hit(keyGenerator(c), windowMs, activeLimit);
+		const decision = await store.hit(await keyGenerator(c), windowMs, activeLimit);
 		c.header("X-RateLimit-Limit", String(activeLimit));
 		c.header("X-RateLimit-Remaining", String(decision.remaining));
 		if (!decision.allowed) {
@@ -2598,13 +2572,13 @@ function createDataRateLimiter(config = {}) {
 	* to the context; an identity that fails to verify simply buckets by IP,
 	* exactly as before.
 	*/
-	const identify = (c) => {
+	const identify = async (c) => {
 		const user = c.get("user");
 		if (user?.uid) return isAnonymousUid(user.uid) ? void 0 : user.uid;
 		if (!isJwtConfigured()) return void 0;
 		const token = extractBearerToken(c.req.header("authorization"));
 		if (token === void 0) return void 0;
-		const payload = verifyAccessToken(token);
+		const payload = await verifyAccessToken(token);
 		if (!payload?.uid || isAnonymousUid(payload.uid)) return void 0;
 		return payload.uid;
 	};
@@ -2612,17 +2586,17 @@ function createDataRateLimiter(config = {}) {
 		windowMs,
 		store,
 		message: "Too many requests, please try again later.",
-		keyGenerator: (c) => {
+		keyGenerator: async (c) => {
 			const key = c.get("apiKey");
 			if (key) return `api-key:${key.id}`;
-			const uid = identify(c);
+			const uid = await identify(c);
 			if (uid) return `user:${uid}`;
 			return `ip:${defaultKeyGenerator(c, trustedProxyHops)}`;
 		},
-		resolveLimit: (c) => {
+		resolveLimit: async (c) => {
 			const key = c.get("apiKey");
 			if (key) return key.rate_limit ?? apiKeyLimit;
-			return identify(c) ? userLimit : anonLimit;
+			return await identify(c) ? userLimit : anonLimit;
 		}
 	});
 }
@@ -3164,7 +3138,7 @@ async function openAndRewrap(authRepo, factorId, secretEncrypted) {
 	}
 	return secret;
 }
-function resolveStepUpPrincipal(c) {
+async function resolveStepUpPrincipal(c) {
 	const existing = c.get("user");
 	if (existing?.uid) return {
 		uid: existing.uid,
@@ -3173,13 +3147,13 @@ function resolveStepUpPrincipal(c) {
 	};
 	const token = extractBearerToken(c.req.header("authorization"));
 	if (token === void 0) return null;
-	const session = verifyAccessToken(token);
+	const session = await verifyAccessToken(token);
 	if (session) return {
 		uid: session.uid,
 		aal: session.aal === "aal2" ? "aal2" : "aal1",
 		pending: false
 	};
-	const pending = verifyMfaPendingToken(token);
+	const pending = await verifyMfaPendingToken(token);
 	if (pending) return {
 		uid: pending.uid,
 		aal: "aal1",
@@ -3198,7 +3172,7 @@ function resolveStepUpPrincipal(c) {
 var mfaVerificationLimiter = createRateLimiter({
 	windowMs: 900 * 1e3,
 	limit: MFA_VERIFICATION_ATTEMPTS_PER_WINDOW,
-	keyGenerator: (c) => `mfa-verify:${resolveStepUpPrincipal(c)?.uid ?? "unidentified"}`,
+	keyGenerator: async (c) => `mfa-verify:${(await resolveStepUpPrincipal(c))?.uid ?? "unidentified"}`,
 	message: "Too many verification attempts for this account, please try again later."
 });
 function mountMfaRoutes(opts) {
@@ -3302,7 +3276,7 @@ function mountMfaRoutes(opts) {
 	* `MFA_REQUIRED`, or to step an existing session up to `aal2`.
 	*/
 	router.post("/mfa/challenge", strictAuthLimiter, async (c) => {
-		const principal = resolveStepUpPrincipal(c);
+		const principal = await resolveStepUpPrincipal(c);
 		if (!principal) throw ApiError.unauthorized("Not authenticated");
 		const challengeSchema = object({ factorId: string().min(1, "Factor ID is required") });
 		const { factorId } = parseBody(challengeSchema, await c.req.json());
@@ -3323,7 +3297,7 @@ function mountMfaRoutes(opts) {
 	* minted, at `aal2`.
 	*/
 	router.post("/mfa/challenge/verify", strictAuthLimiter, mfaVerificationLimiter, async (c) => {
-		const principal = resolveStepUpPrincipal(c);
+		const principal = await resolveStepUpPrincipal(c);
 		if (!principal) throw ApiError.unauthorized("Not authenticated");
 		const challengeVerifySchema = object({
 			challengeId: string().min(1, "Challenge ID is required"),
@@ -3451,7 +3425,7 @@ async function assertMfaSatisfied(authRepo, uid) {
 	if (!await authRepo.hasVerifiedMfaFactors(uid)) return;
 	const factors = (await authRepo.getMfaFactors(uid)).filter((f) => f.verified);
 	const details = {
-		mfaToken: generateMfaPendingToken(uid),
+		mfaToken: await generateMfaPendingToken(uid),
 		factors: factors.map((f) => ({
 			id: f.id,
 			factorType: f.factorType,
@@ -3553,7 +3527,7 @@ function mountSessionRoutes(opts) {
 		const body = await c.req.json().catch(() => ({}));
 		const refreshToken = readRefreshToken(c, parseBody(logoutSchema, body), config.cookieAuth);
 		if (refreshToken) {
-			const tokenHash = hashRefreshToken(refreshToken);
+			const tokenHash = await hashRefreshToken(refreshToken);
 			const sessionId = (await authRepo.findRefreshTokenByHash(tokenHash).catch(() => null))?.sessionId;
 			if (sessionId && authRepo.revokeRefreshTokenSession) await authRepo.revokeRefreshTokenSession(sessionId);
 			else await authRepo.deleteRefreshToken(tokenHash);
@@ -3561,8 +3535,8 @@ function mountSessionRoutes(opts) {
 		clearRefreshCookie(c, config.cookieAuth);
 		const accessToken = extractBearerToken(c.req.header("authorization"));
 		if (ops.afterLogout && accessToken !== void 0) {
-			const { verifyAccessToken } = await import("./jwt-DoHkMMWF.js").then((n) => n.m);
-			const payload = verifyAccessToken(accessToken);
+			const { verifyAccessToken } = await import("./jwt-5VN4C6ln.js").then((n) => n.m);
+			const payload = await verifyAccessToken(accessToken);
 			if (payload) ops.afterLogout(payload.uid).catch((err) => {
 				logger.error("[AuthHooks] afterLogout error", { error: err instanceof Error ? err.message : err });
 			});
@@ -3577,7 +3551,7 @@ function mountSessionRoutes(opts) {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		const currentRefreshToken = c.req.header("x-refresh-token");
-		const currentTokenHash = currentRefreshToken ? hashRefreshToken(currentRefreshToken) : null;
+		const currentTokenHash = currentRefreshToken ? await hashRefreshToken(currentRefreshToken) : null;
 		const tokens = await authRepo.listRefreshTokensForUser(userCtx.uid);
 		const bySession = /* @__PURE__ */ new Map();
 		for (const token of tokens) {
@@ -3845,7 +3819,7 @@ var OTP_ATTEMPTS_PER_WINDOW = 5;
 * and one of them is the classic modulo bias.
 */
 function generateOtpCode() {
-	return String(randomInt(0, 10 ** OTP_DIGITS)).padStart(OTP_DIGITS, "0");
+	return String(randomInt$1(10 ** OTP_DIGITS)).padStart(OTP_DIGITS, "0");
 }
 /**
 * What gets hashed and stored.
@@ -4183,10 +4157,10 @@ function createAuthRoutes(config) {
 				customClaims = await ops.customizeAccessToken(defaultClaims, user);
 			}
 		}
-		const accessToken = generateAccessToken(uid, roleIds, aal, customClaims);
+		const accessToken = await generateAccessToken(uid, roleIds, aal, customClaims);
 		const refreshToken = generateRefreshToken();
-		await authRepo.createRefreshToken(uid, hashRefreshToken(refreshToken), getRefreshTokenExpiry(), userAgent, ipAddress, {
-			id: randomUUID$1(),
+		await authRepo.createRefreshToken(uid, await hashRefreshToken(refreshToken), getRefreshTokenExpiry(), userAgent, ipAddress, {
+			id: randomUUID(),
 			startedAt: /* @__PURE__ */ new Date(),
 			aal
 		});
@@ -4550,7 +4524,7 @@ function createAuthRoutes(config) {
 		const body = await c.req.json().catch(() => ({}));
 		const refreshToken = readRefreshToken(c, parseBody(refreshSchema, body), config.cookieAuth);
 		if (!refreshToken) throw ApiError.unauthenticated("No refresh token presented", "NO_SESSION");
-		const tokenHash = hashRefreshToken(refreshToken);
+		const tokenHash = await hashRefreshToken(refreshToken);
 		const storedToken = await authRepo.findRefreshTokenByHash(tokenHash);
 		if (!storedToken) throw ApiError.unauthorized("Invalid refresh token", "INVALID_TOKEN");
 		if (storedToken.revoked) {
@@ -4598,7 +4572,7 @@ function createAuthRoutes(config) {
 			};
 			customClaims = await ops.customizeAccessToken(defaultClaims, user);
 		}
-		const newAccessToken = generateAccessToken(storedToken.uid, roleIds, sessionAal, customClaims);
+		const newAccessToken = await generateAccessToken(storedToken.uid, roleIds, sessionAal, customClaims);
 		const newRefreshToken = generateRefreshToken();
 		const userAgent = c.req.header("user-agent") || "unknown";
 		const ipAddress = c.req.header("x-forwarded-for") || "unknown";
@@ -4609,7 +4583,7 @@ function createAuthRoutes(config) {
 		};
 		if (!supersededAt) if (authRepo.markRefreshTokenRotated) await authRepo.markRefreshTokenRotated(tokenHash);
 		else await authRepo.deleteRefreshToken(tokenHash);
-		await authRepo.createRefreshToken(storedToken.uid, hashRefreshToken(newRefreshToken), getRefreshTokenExpiry(), userAgent, ipAddress, session);
+		await authRepo.createRefreshToken(storedToken.uid, await hashRefreshToken(newRefreshToken), getRefreshTokenExpiry(), userAgent, ipAddress, session);
 		authRepo.pruneRefreshTokens?.(storedToken.uid, session.id, new Date(Date.now() - reuseWindowMs)).catch((err) => {
 			logger.warn("[Auth] Refresh token prune failed", { error: err instanceof Error ? err.message : String(err) });
 		});
@@ -5089,7 +5063,7 @@ function createBuiltinAuthAdapter(config) {
 				isAdmin: true,
 				rawToken: token
 			};
-			const payload = verifyAccessToken(token);
+			const payload = await verifyAccessToken(token);
 			if (!payload) return null;
 			if (await isAccessTokenRevoked(authRepository, payload)) {
 				logger.warn("[Security Audit] Refused a revoked access token", {
@@ -5125,7 +5099,7 @@ function createBuiltinAuthAdapter(config) {
 				isAdmin: true,
 				rawToken: token
 			};
-			const payload = verifyAccessToken(token);
+			const payload = await verifyAccessToken(token);
 			if (!payload) return null;
 			if (await isAccessTokenRevoked(authRepository, payload)) {
 				logger.warn("[Security Audit] Refused a revoked access token", {
@@ -7035,4 +7009,4 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 //#endregion
 export { html as $, activeDevEmailSink as A, hashPassword as B, providerVerifiedEmail as C, PUBLIC_STORAGE_PREFIX as Ct, createDataRateLimiter as D, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as E, SMTPEmailService as F, getEmailVerificationTemplate as G, verifyPassword as H, createEmailService as I, getUserInvitationTemplate as J, getMagicLinkTemplate as K, assertEmailLinkBases as L, createDevEmailSink as M, extractLinks as N, defaultAuthLimiter as O, registerDevEmailSink as P, escapeHtml as Q, resolveEmailLinkBase as R, pkceTokenParams as S, isOperationAllowed as St, createBuiltinAuthAdapter as T, generateSecurePassword as U, validatePasswordStrength as V, getEmailOtpTemplate as W, resolveEmailBranding as X, getWelcomeEmailTemplate as Y, RawHtml as Z, verifyOidcIdToken as _, safeCompare as _t, resolveRateLimitStoreKind as a, fileTokenAuth as at, createGoogleProvider as b, hasAdministrativeRole as bt, createSlackProvider as c, queryTokenAuth as ct, createDiscordProvider as d, createApiKeyPreAuth as dt, raw as et, createTwitterProvider as f, createFunctionApiKeyGuard as ft, tryVerifyOidcIdToken as g, extractBearerToken as gt, createMicrosoftProvider as h, validateApiKey as ht, createApiKeyStore as i, extractUserFromToken as it, clearActiveDevEmailSink as j, MemoryRateLimitStore as k, createBitbucketProvider as l, requireAdmin as lt, createAppleProvider as m, isApiKeyToken as mt, createCustomAuthAdapter as n, createAuthMiddleware as nt, createSqlRateLimitStore as o, optionalAuth as ot, createFacebookProvider as p, createStorageApiKeyGuard as pt, getPasswordResetTemplate as q, createApiKeyRoutes as r, createRequireAuth as rt, createSpotifyProvider as s, publicObjectAuth as st, auth_exports as t, createAdapterAuthMiddleware as tt, createGitLabProvider as u, requireAuth as ut, createGitHubProvider as v, SERVICE_IDENTITY as vt, createJwksRoutes as w, isPublicStoragePath as wt, oauthCodeFlowSchema as x, httpMethodToOperation as xt, createLinkedinProvider as y, scopeDataDriver as yt, resolveAuthHooks as z };
 
-//# sourceMappingURL=auth-Cd6qQw_0.js.map
+//# sourceMappingURL=auth-BVPx33qB.js.map