@rebasepro/server 0.19.1 → 0.19.2-canary.g09316f6

package/dist/{auth-BRiOuyq8.js → auth-DJsLXsCR.js}

@@ -3,23 +3,23 @@ import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { i as __toESM, n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
-import { A as ANONYMOUS_USER_ID, j as isAnonymousUid } from "./src-Dq-I3Ybx.js";
-import "./src-DHK4fHkw.js";
+import { et as ANONYMOUS_USER_ID, tt as isAnonymousUid } from "./src-DqZ9YiGA.js";
+import "./src-Br6ARbs6.js";
 import { n as createDdlBootstrapper, o as isSQLAdmin } from "./ddl-bootstrap-CfNvxMuK.js";
 import { t as revokeInternalTableSql } from "./internal-tables-DYVcFFSv.js";
 import { r as logger } from "./logger-DO2PZc4i.js";
-import { n as errorHandler, t as ApiError } from "./errors-HjfaPlvY.js";
-import { a as resolveListLimitParam } from "./query-parser-C68Q9EX4.js";
-import { S as sha256Hex, _ as verifyMfaPendingToken, a as generateMfaPendingToken, b as constantTimeEqual, c as getJwks, d as hasAsymmetricSigningKey, f as hashRefreshToken, g as verifyDownloadToken, h as verifyAccessToken, i as generateDownloadToken, l as getRefreshTokenExpiry, n as configureJwt, o as generateRefreshToken, p as isJwtConfigured, r as generateAccessToken, s as getAccessTokenExpiry, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenTtlMs, x as randomInt$1, y as require_jsonwebtoken } from "./jwt-DkhXwMzR.js";
+import { n as errorHandler, t as ApiError } from "./errors-DMImyqyR.js";
+import { a as resolveListLimitParam } from "./query-parser-BQiPZrM-.js";
+import { S as sha256Hex, _ as verifyMfaPendingToken, a as generateMfaPendingToken, b as constantTimeEqual, c as getJwks, d as hasAsymmetricSigningKey, f as hashRefreshToken, g as verifyDownloadToken, h as verifyAccessToken, i as generateDownloadToken, l as getRefreshTokenExpiry, n as configureJwt, o as generateRefreshToken, p as isJwtConfigured, r as generateAccessToken, s as getAccessTokenExpiry, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenTtlMs, x as randomInt$1, y as require_jsonwebtoken } from "./jwt-DATvkKB_.js";
 import { n as hasAdministrativeRole, r as isAdministrativeRole, t as ADMINISTRATIVE_ROLES } from "./admin-roles-vYdp_Pil.js";
-import { c as tryCanonicalStorageKey, i as canonicalStorageId } from "./keys-g8lbVC_o.js";
-import { Rn as string, Tn as object } from "./schemas-C3234HWE.js";
+import { c as tryCanonicalStorageKey, i as canonicalStorageId } from "./keys-Qfc4XieN.js";
 import { createHash, randomBytes, randomInt } from "node:crypto";
 import { Hono } from "hono";
 import { promisify } from "util";
 import { createCipheriv, createDecipheriv, createHash as createHash$1, createHmac, createPublicKey, randomBytes as randomBytes$1, randomUUID, scrypt, timingSafeEqual } from "crypto";
 import { getConnInfo } from "@hono/node-server/conninfo";
 import { createMiddleware } from "hono/factory";
+import { z } from "zod";
 //#region ../types/src/controllers/storage.ts
 /**
 * Path prefix that marks an object as **public**. Files stored under this
@@ -714,7 +714,8 @@ function createAuthMiddleware(options) {
 						const user = {
 							uid: payload.uid,
 							roles: payload.roles,
-							isAnonymous: payload.isAnonymous === true
+							isAnonymous: payload.isAnonymous === true,
+							claims: payload.claims
 						};
 						c.set("driver", await scopeDataDriver(driver, user));
 					} catch (error) {
@@ -3240,9 +3241,9 @@ function mountMfaRoutes(opts) {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		await requireStepUpForFactorChange(userCtx);
-		const verifySchema = object({
-			factorId: string().min(1, "Factor ID is required"),
-			code: string().length(6, "Code must be 6 digits")
+		const verifySchema = z.object({
+			factorId: z.string().min(1, "Factor ID is required"),
+			code: z.string().length(6, "Code must be 6 digits")
 		});
 		const { factorId, code } = parseBody(verifySchema, await c.req.json());
 		const factor = await authRepo.getMfaFactorById(factorId);
@@ -3264,7 +3265,7 @@ function mountMfaRoutes(opts) {
 	router.post("/mfa/challenge", strictAuthLimiter, async (c) => {
 		const principal = await resolveStepUpPrincipal(c);
 		if (!principal) throw ApiError.unauthorized("Not authenticated");
-		const challengeSchema = object({ factorId: string().min(1, "Factor ID is required") });
+		const challengeSchema = z.object({ factorId: z.string().min(1, "Factor ID is required") });
 		const { factorId } = parseBody(challengeSchema, await c.req.json());
 		const factor = await authRepo.getMfaFactorById(factorId);
 		if (!factor || factor.uid !== principal.uid) throw ApiError.notFound("MFA factor not found");
@@ -3285,9 +3286,9 @@ function mountMfaRoutes(opts) {
 	router.post("/mfa/challenge/verify", strictAuthLimiter, mfaVerificationLimiter, async (c) => {
 		const principal = await resolveStepUpPrincipal(c);
 		if (!principal) throw ApiError.unauthorized("Not authenticated");
-		const challengeVerifySchema = object({
-			challengeId: string().min(1, "Challenge ID is required"),
-			code: string().min(1, "Code is required")
+		const challengeVerifySchema = z.object({
+			challengeId: z.string().min(1, "Challenge ID is required"),
+			code: z.string().min(1, "Code is required")
 		});
 		const { challengeId, code } = parseBody(challengeVerifySchema, await c.req.json());
 		const challenge = await authRepo.getMfaChallengeById(challengeId);
@@ -3365,7 +3366,7 @@ function mountMfaRoutes(opts) {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		if (userCtx.aal !== "aal2") throw ApiError.forbidden("MFA verification required to unenroll. Please re-authenticate with your second factor.", "AAL2_REQUIRED");
-		const unenrollSchema = object({ factorId: string().min(1, "Factor ID is required") });
+		const unenrollSchema = z.object({ factorId: z.string().min(1, "Factor ID is required") });
 		const { factorId } = parseBody(unenrollSchema, await c.req.json());
 		const factor = await authRepo.getMfaFactorById(factorId);
 		if (!factor || factor.uid !== userCtx.uid) throw ApiError.notFound("MFA factor not found");
@@ -3518,16 +3519,16 @@ function mountSessionRoutes(opts) {
 		})) return;
 		throw ApiError.forbidden(config.disableSelfRegistration ? "Anonymous sign-in is disabled: disableSelfRegistration blocks it." : "Anonymous sign-in is disabled. Set `auth.allowAnonymous: true` to enable it.", "ANONYMOUS_AUTH_DISABLED");
 	}
-	const logoutSchema = object({ refreshToken: string().optional() });
-	const linkSchema = object({
-		email: string().email("Invalid email address").max(255),
-		password: string().min(1, "Password is required").max(128)
+	const logoutSchema = z.object({ refreshToken: z.string().optional() });
+	const linkSchema = z.object({
+		email: z.string().email("Invalid email address").max(255),
+		password: z.string().min(1, "Password is required").max(128)
 	});
-	const updateProfileSchema = object({
-		displayName: string().max(255).optional(),
-		photoURL: string().url().max(2048).optional()
+	const updateProfileSchema = z.object({
+		displayName: z.string().max(255).optional(),
+		photoURL: z.string().url().max(2048).optional()
 	});
-	const findUserSchema = object({ email: string().email("Invalid email address").max(255) });
+	const findUserSchema = z.object({ email: z.string().email("Invalid email address").max(255) });
 	/**
 	* POST /auth/logout
 	*/
@@ -3543,7 +3544,7 @@ function mountSessionRoutes(opts) {
 		clearRefreshCookie(c, config.cookieAuth);
 		const accessToken = extractBearerToken(c.req.header("authorization"));
 		if (ops.afterLogout && accessToken !== void 0) {
-			const { verifyAccessToken } = await import("./jwt-DkhXwMzR.js").then((n) => n.m);
+			const { verifyAccessToken } = await import("./jwt-DATvkKB_.js").then((n) => n.m);
 			const payload = await verifyAccessToken(accessToken);
 			if (payload) ops.afterLogout(payload.uid).catch((err) => {
 				logger.error("[AuthHooks] afterLogout error", { error: err instanceof Error ? err.message : err });
@@ -3741,8 +3742,8 @@ function getMagicLinkExpiry() {
 function mountMagicLinkRoutes(deps) {
 	const { router, config, ops, parseBody, buildAuthResponse, createSessionAndTokens, applyTransformHook, captchaMiddleware } = deps;
 	const { authRepo, emailService, emailConfig } = config;
-	const magicLinkSchema = object({ email: string().email("Invalid email address").max(255) });
-	const verifyMagicLinkSchema = object({ token: string().min(1, "Token is required") });
+	const magicLinkSchema = z.object({ email: z.string().email("Invalid email address").max(255) });
+	const verifyMagicLinkSchema = z.object({ token: z.string().min(1, "Token is required") });
 	function isEmailConfigured() {
 		return !!(emailService && emailService.isConfigured());
 	}
@@ -3926,10 +3927,10 @@ var captureOtpEmail = async (c, next) => {
 function mountOtpRoutes(deps) {
 	const { router, config, ops, parseBody, buildAuthResponse, createSessionAndTokens, applyTransformHook, captchaMiddleware } = deps;
 	const { authRepo, emailService, emailConfig } = config;
-	const requestSchema = object({ email: string().email("Invalid email address").max(255) });
-	const verifySchema = object({
-		email: string().email("Invalid email address").max(255),
-		code: string().regex(/^\d{6}$/, "A code is six digits")
+	const requestSchema = z.object({ email: z.string().email("Invalid email address").max(255) });
+	const verifySchema = z.object({
+		email: z.string().email("Invalid email address").max(255),
+		code: z.string().regex(/^\d{6}$/, "A code is six digits")
 	});
 	const isEmailConfigured = () => !!(emailService && emailService.isConfigured());
 	/**
@@ -4125,25 +4126,25 @@ function createAuthRoutes(config) {
 			return response;
 		}
 	}
-	const registerSchema = object({
-		email: string().email("Invalid email address").max(255),
-		password: string().min(1, "Password is required").max(128),
-		displayName: string().max(255).optional()
+	const registerSchema = z.object({
+		email: z.string().email("Invalid email address").max(255),
+		password: z.string().min(1, "Password is required").max(128),
+		displayName: z.string().max(255).optional()
 	});
-	const loginSchema = object({
-		email: string().email("Invalid email address").max(255),
-		password: string().min(1, "Password is required").max(128)
+	const loginSchema = z.object({
+		email: z.string().email("Invalid email address").max(255),
+		password: z.string().min(1, "Password is required").max(128)
 	});
-	const forgotPasswordSchema = object({ email: string().email("Invalid email address").max(255) });
-	const resetPasswordSchema = object({
-		token: string().min(1, "Token is required"),
-		password: string().min(1, "Password is required").max(128)
+	const forgotPasswordSchema = z.object({ email: z.string().email("Invalid email address").max(255) });
+	const resetPasswordSchema = z.object({
+		token: z.string().min(1, "Token is required"),
+		password: z.string().min(1, "Password is required").max(128)
 	});
-	const changePasswordSchema = object({
-		oldPassword: string().min(1, "Old password is required").max(128),
-		newPassword: string().min(1, "New password is required").max(128)
+	const changePasswordSchema = z.object({
+		oldPassword: z.string().min(1, "Old password is required").max(128),
+		newPassword: z.string().min(1, "New password is required").max(128)
 	});
-	const refreshSchema = object({ refreshToken: string().min(1).optional() });
+	const refreshSchema = z.object({ refreshToken: z.string().min(1).optional() });
 	/** Parse a Zod schema against the request body, throwing ApiError on failure */
 	function parseBody(schema, body) {
 		const result = schema.safeParse(body);
@@ -5416,10 +5417,10 @@ function createJwksRoutes() {
 * providers that mandate PKCE (Twitter/X).
 */
 function oauthCodeFlowSchema(opts = {}) {
-	const verifier = opts.pkce === "required" ? string().min(1, "PKCE code verifier is required") : string().min(1).optional();
-	return object({
-		code: string().min(1, "Auth code is required"),
-		redirectUri: string().url("Valid redirect URI is required"),
+	const verifier = opts.pkce === "required" ? z.string().min(1, "PKCE code verifier is required") : z.string().min(1).optional();
+	return z.object({
+		code: z.string().min(1, "Auth code is required"),
+		redirectUri: z.string().url("Valid redirect URI is required"),
 		codeVerifier: verifier
 	});
 }
@@ -5537,12 +5538,12 @@ function createGoogleProvider(config) {
 	}
 	return {
 		id: "google",
-		schema: object({
-			idToken: string().min(1).optional(),
-			accessToken: string().min(1).optional(),
-			code: string().min(1).optional(),
-			redirectUri: string().min(1).optional(),
-			codeVerifier: string().min(1).optional()
+		schema: z.object({
+			idToken: z.string().min(1).optional(),
+			accessToken: z.string().min(1).optional(),
+			code: z.string().min(1).optional(),
+			redirectUri: z.string().min(1).optional(),
+			codeVerifier: z.string().min(1).optional()
 		}).refine((data) => data.idToken || data.accessToken || data.code && data.redirectUri, { message: "One of idToken, accessToken, or code+redirectUri is required" }),
 		verify: async (payload) => {
 			try {
@@ -5946,9 +5947,9 @@ function createAppleProvider(config) {
 		* that claim is absent simply by omitting the `email` scope from
 		* their own authorization request.
 		*/
-user: object({ name: object({
-			firstName: string().optional(),
-			lastName: string().optional()
+user: z.object({ name: z.object({
+			firstName: z.string().optional(),
+			lastName: z.string().optional()
 		}).optional() }).optional() }),
 		verify: async (payload) => {
 			try {
@@ -7094,4 +7095,4 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 //#endregion
 export { escapeHtml as $, MemoryRateLimitStore as A, resolveAuthHooks as B, providerVerifiedEmail as C, PUBLIC_STORAGE_PREFIX as Ct, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as D, isBootstrapWindowOpen as E, registerDevEmailSink as F, getEmailOtpTemplate as G, validatePasswordStrength as H, SMTPEmailService as I, getPasswordResetTemplate as J, getEmailVerificationTemplate as K, createEmailService as L, clearActiveDevEmailSink as M, createDevEmailSink as N, createDataRateLimiter as O, extractLinks as P, RawHtml as Q, assertEmailLinkBases as R, pkceTokenParams as S, isOperationAllowed as St, createBuiltinAuthAdapter as T, verifyPassword as U, hashPassword as V, generateSecurePassword as W, getWelcomeEmailTemplate as X, getUserInvitationTemplate as Y, resolveEmailBranding as Z, verifyOidcIdToken as _, extractBearerToken as _t, resolveRateLimitStoreKind as a, extractUserFromToken as at, createGoogleProvider as b, scopeDataDriver as bt, createSlackProvider as c, publicObjectAuth as ct, createDiscordProvider as d, requireAuth as dt, html as et, createTwitterProvider as f, createApiKeyPreAuth as ft, tryVerifyOidcIdToken as g, validateApiKey as gt, createMicrosoftProvider as h, isApiKeyToken as ht, createApiKeyStore as i, createRequireAuth as it, activeDevEmailSink as j, defaultAuthLimiter as k, createBitbucketProvider as l, queryTokenAuth as lt, createAppleProvider as m, createStorageApiKeyGuard as mt, createCustomAuthAdapter as n, createAdapterAuthMiddleware as nt, createSqlRateLimitStore as o, fileTokenAuth as ot, createFacebookProvider as p, createFunctionApiKeyGuard as pt, getMagicLinkTemplate as q, createApiKeyRoutes as r, createAuthMiddleware as rt, createSpotifyProvider as s, optionalAuth as st, auth_exports as t, raw as tt, createGitLabProvider as u, requireAdmin as ut, createGitHubProvider as v, safeCompare as vt, createJwksRoutes as w, isPublicStoragePath as wt, oauthCodeFlowSchema as x, httpMethodToOperation as xt, createLinkedinProvider as y, SERVICE_IDENTITY as yt, resolveEmailLinkBase as z };
 
-//# sourceMappingURL=auth-BRiOuyq8.js.map
+//# sourceMappingURL=auth-DJsLXsCR.js.map