@rebasepro/server 0.21.0 → 0.21.1-canary.g8c5a265

package/README.md

@@ -9,8 +9,8 @@ pnpm add @rebasepro/server
 ```
 
 ESM-only: `"type": "module"` with no CommonJS build, so it is loaded with
-`import`. `require()` of it resolves only on Node 22.12+, which supports
-`require(esm)`.
+`import`. It needs Node `>=22.22.0` (its `engines` floor), where `require()`
+of it resolves too: Node has supported `require(esm)` since 22.12.
 
 ## What This Package Does
 
@@ -21,7 +21,7 @@ This is the central orchestrator for any Rebase backend. It provides the framewo
 | Export | Description |
 |--------|-------------|
 | `initializeRebaseBackend(config)` | Main entry point. Wires up drivers, auth, storage, API routes, cron, and custom functions. Returns a `RebaseBackendInstance`. |
-| `rebase` | Server-side singleton (`RebaseClient`). Available after init. Admin-level access to data, auth, email, and storage. |
+| `rebase` | Server-side singleton — a `RebaseServerClient` (from `@rebasepro/types`): the client without `data`, plus `dataAsAdmin`. Available after init. Admin-scoped access to data (RLS is evaluated as the service identity, not skipped), auth, email, and storage. |
 | `loadEnv()` | Validates `process.env` against the Rebase env schema (Zod). Auto-generates dev secrets. Supports `extend` for custom vars. |
 | `serveSPA(app, config)` | Mounts SPA static-file serving + index.html fallback on a Hono app. |
 | `RebaseBackendConfig` | Config type for `initializeRebaseBackend`. |
@@ -31,43 +31,61 @@ This is the central orchestrator for any Rebase backend. It provides the framewo
 | `z` | The runtime's own Zod instance. Build `loadEnv({ extend })` schemas with this one — a schema from a second copy of zod is silently ignored. |
 | `_setRebaseMock` / `_resetRebaseMock` | Test helpers to mock the `rebase` singleton (NODE_ENV=test only). |
 
-Also re-exports all abstract interfaces (`DatabaseAdapter`, `AuthAdapter`, `DataDriver`, etc.), API types (`HonoEnv`, `ApiConfig`), auth module, email module, storage module, history module, cron module, custom functions, logging utilities, and driver registry.
+Also exports `HonoEnv`, the auth, email, storage, history and cron modules, custom functions, logging utilities, and the driver registry. The abstract driver interfaces (`DatabaseAdapter`, `AuthAdapter`, `DataDriver`, …) are not re-exported: import them from `@rebasepro/types`.
+
+`@rebasepro/server/functions` is the portable surface a function file imports — `defineFunction`, the `requireAuth`/`requireAdmin` guards, `getUser`, `rebase` and the rest. The package also ships the `rebase-server` binary, which runs a built project bundle (`rebase-server ./dist-bundle`); it is what the `rebasepro/server` image executes.
 
 ## Quick Start
 
 ```typescript
-import { serve } from "@hono/node-server";
+import { createServer } from "node:http";
+import { getRequestListener } from "@hono/node-server";
 import { Hono } from "hono";
-import { initializeRebaseBackend, loadEnv, serveSPA } from "@rebasepro/server";
+import { initializeRebaseBackend, loadEnv, serveSPA, type HonoEnv } from "@rebasepro/server";
 import { createPostgresAdapter } from "@rebasepro/server-postgres";
 
 // 1. Load and validate environment
 const env = loadEnv();
 
 // 2. Create Hono app + HTTP server
-const app = new Hono();
-const server = serve({ fetch: app.fetch, port: env.PORT });
+const app = new Hono<HonoEnv>();
+const server = createServer(getRequestListener(app.fetch));
 
 // 3. Initialize Rebase
 const backend = await initializeRebaseBackend({
   app,
   server,
-  database: createPostgresAdapter({ connection: db, schema }),
+  database: createPostgresAdapter({ connection: db, schema: { tables, enums, relations } }),
   collections: myCollections,
   auth: {
     collection: defaultUsersCollection,
     jwtSecret: env.JWT_SECRET,
     allowRegistration: env.ALLOW_REGISTRATION,
     serviceKey: env.REBASE_SERVICE_KEY,
-    google: { clientId: env.GOOGLE_CLIENT_ID },
+    google: env.GOOGLE_CLIENT_ID ? { clientId: env.GOOGLE_CLIENT_ID } : undefined,
+  },
+  storage: {
+    type: "s3",
+    bucket: env.S3_BUCKET!,
+    accessKeyId: env.S3_ACCESS_KEY_ID!,
+    secretAccessKey: env.S3_SECRET_ACCESS_KEY!,
+  },
+  // Storage is not under row-level security. In production the server refuses
+  // to boot storage without an access model: this hook (or `storagePolicies`),
+  // or `storagePublicRead: true` for a bucket that really is public.
+  storageAuthorize: async ({ key, user, operation }) => {
+    if (!user) return false;
+    const [ownerId] = key.split("/");
+    return ownerId === user.uid || operation === "read";
   },
-  storage: { type: "s3", bucket: env.S3_BUCKET },
   functionsDir: "./functions",
   cronsDir: "./crons",
 });
 
 // 4. Optionally serve a frontend SPA
 serveSPA(app, { frontendPath: "./frontend/dist" });
+
+server.listen(env.PORT);
 ```
 
 ## Related Packages

package/dist/auth/admin-user-ops.d.ts

@@ -12,7 +12,7 @@
 import type { AuthRepository } from "./interfaces.js";
 import type { EmailService, EmailConfig } from "../email/index.js";
 import type { ResolvedAuthHooks } from "./auth-hooks.js";
-import type { AuthCollectionConfig } from "@rebasepro/types";
+import type { AuthCollectionConfig, UserCreationFinalizeResult, UserCreationPrepareResult } from "@rebasepro/types";
 /**
  * Generate a cryptographically secure random password that meets strength requirements.
  *
@@ -78,3 +78,25 @@ export declare function finalizeAdminUserCreation(entity: {
     invitationSent: boolean;
     emailDeliveryFailed?: boolean;
 }>;
+/**
+ * The step after a new user's row is written: who delivers the credentials,
+ * and what the create response says about it.
+ *
+ * A create hook that ran owns delivery. What it reported is the answer: the
+ * invitation it says it sent, and the temporary password it chose, which the
+ * admin has to see because it is the one the user will be told. The framework
+ * sends nothing of its own. Without a hook, `finalize` runs: the built-in
+ * invitation, or the generated password when email is not configured or fails.
+ *
+ * Both doors that create a user call this, the auth collection's REST route
+ * and `POST /admin/users`. The second used to call `finalizeAdminUserCreation`
+ * directly and read neither `hookHandledEmail` nor `invitationSent`, so it
+ * handled a hook's password as if the framework had generated it. With email
+ * configured it sent its own invitation, a second one when the hook had sent
+ * its own, and left the password out of the response. The decision lives here
+ * so that the two doors cannot disagree about it again.
+ *
+ * The result has exactly the fields a create response carries, with absent
+ * ones left out.
+ */
+export declare function completeUserCreation(prepared: UserCreationPrepareResult, finalize?: (clearPassword: string | undefined) => Promise<UserCreationFinalizeResult>): Promise<UserCreationFinalizeResult>;