@rebasepro/server 0.21.1-canary.g8c5a265 → 0.21.1

package/dist/api/errors.d.ts

@@ -109,6 +109,47 @@ export interface RebaseApiError extends Error {
     code?: string;
     details?: unknown;
 }
+/**
+ * The answer an error chose for itself, read the same way at every door.
+ *
+ * @see declaredErrorAnswer
+ */
+export interface DeclaredErrorAnswer {
+    /** The HTTP status the error carries. A socket frame has no slot for it. */
+    status: number;
+    code: string;
+    message: string;
+    details?: unknown;
+    /** See {@link ApiError.expected}: log it at debug, not warn. */
+    expected: boolean;
+}
+/**
+ * The status, code and message an error carries as its own answer — or
+ * `undefined` for an error that carries none, which is a server fault and gets
+ * masked.
+ *
+ * Two classes carry one. The server's `ApiError`, and `RebaseApiError` (or its
+ * `RebaseClientError` subclass) from `@rebasepro/types` once it has a status.
+ * The second is the browser-safe class: a `config/collections/*.ts` file is
+ * bundled into the admin SPA and cannot import this package, so it is what a
+ * collection callback throws, and what a callback refusal becomes —
+ * `callbackRefusal` returns one, and `toCallbackError` wraps anything thrown
+ * that does not already carry a status.
+ *
+ * One function because several doors turn an error into an answer: the REST
+ * error handler, the two WebSocket servers, and the Postgres realtime
+ * subscriptions. Each used to list the classes it recognised by hand. The
+ * sockets listed only `ApiError`, so a `beforeDelete` veto that REST
+ * answered as 400 `CALLBACK_REJECTED` with the author's message reached the
+ * admin panel — which writes through the socket — as `INTERNAL_ERROR`, and in
+ * production as "An unexpected error occurred".
+ *
+ * Matched by name as well as `instanceof`: a monorepo can resolve two copies of
+ * a package, and `instanceof` is false across them. Name matching is also why
+ * this file needs no runtime import of `@rebasepro/types`, which it may not
+ * have — it is in the graph of `@rebasepro/server/functions`.
+ */
+export declare function declaredErrorAnswer(error: unknown): DeclaredErrorAnswer | undefined;
 /**
  * Hono error-handling middleware (`app.onError`).
  * Converts any error into the canonical `{ error: { message, code } }` shape.

package/dist/auth/auth-hooks.d.ts

@@ -222,6 +222,10 @@ export interface AuthHooks {
     /**
      * Optional hook to customize or override the default password reset flow via the admin panel.
      * When provided, this replaces the built-in password reset token generation, hashing, and email logic.
+     *
+     * A `temporaryPassword` it returns becomes the account's password: the route hashes and writes
+     * it (the same contract as a collection's `auth.onResetPassword`), so the hook need not write it
+     * through `authRepo`. The account's existing sessions end whatever the hook returns.
      */
     onAdminResetPassword?(uid: string, ctx: {
         authRepo: AuthRepository;

package/dist/auth/reset-password-admin.d.ts

@@ -5,6 +5,10 @@
  * 1. Collection-level hook (`auth.onResetPassword` on the collection)
  * 2. Backend-level hook (`AuthHooks.onAdminResetPassword`)
  * 3. Built-in default (send reset email, or generate temp password)
+ *
+ * Whichever of them runs, the account's existing sessions end, and a
+ * `temporaryPassword` in its result becomes the account's password before the
+ * response shows it to the admin.
  */
 import { Hono } from "hono";
 import type { AuthRepository } from "./interfaces.js";

package/dist/auth/token-revocation.d.ts

@@ -3,11 +3,12 @@ import type { AccessTokenPayload } from "./jwt.js";
 /**
  * Has this access token been revoked?
  *
- * `logout`, `change-password`, `reset-password` and `DELETE /auth/sessions` all
- * stamp a `tokensValidAfter` watermark on the user. Every one of them also
- * deletes refresh-token rows, which is what made the gap easy to miss: the
- * session really is gone, and the *refresh* path really does check the
- * watermark — so signing out looked like it worked.
+ * Everything that ends every session a user holds — a password change or reset
+ * of any kind, and `DELETE /auth/sessions` — goes through
+ * {@link revokeAllSessions}, which stamps a `tokensValidAfter` watermark on the
+ * user. It also deletes refresh-token rows, which is what made the gap easy to
+ * miss: the session really is gone, and the *refresh* path really does check
+ * the watermark — so signing out looked like it worked.
  *
  * The access token was untouched. It is a bearer credential that nothing
  * consulted a database about, so it stayed valid for its full lifetime after
@@ -36,3 +37,36 @@ import type { AccessTokenPayload } from "./jwt.js";
  * failure is logged at warn so it is visible rather than silent.
  */
 export declare function isAccessTokenRevoked(authRepo: Pick<AuthRepository, "getTokensValidAfter">, payload: Pick<AccessTokenPayload, "uid" | "iat">): Promise<boolean>;
+/**
+ * End every session this user holds, on every device.
+ *
+ * Two writes, because each covers what the other cannot. Deleting the refresh
+ * rows ends the sessions that exist at this instant, and on a repository
+ * without the watermark it is the only revocation there is. The watermark
+ * voids what the delete cannot see: a refresh already in flight that inserts
+ * its rotated token a moment after the delete ran, and every access token
+ * already handed out, which {@link isAccessTokenRevoked} refuses from here on.
+ *
+ * The watermark write does not fail the caller. By the time it runs the
+ * credential has usually already changed and the rows are gone, so a 500 would
+ * tell someone their password did not change when it did. It is logged, because
+ * a failure here leaves access tokens working until they expire.
+ */
+export declare function revokeAllSessions(authRepo: Pick<AuthRepository, "deleteAllRefreshTokensForUser" | "setTokensValidAfter">, uid: string): Promise<void>;
+/**
+ * Replace a user's password and end every session they hold.
+ *
+ * The one way a password hash is written over an existing account. A new
+ * password is what someone sets when they believe the old one — or a session
+ * signed in with it — is in someone else's hands, so a password change that
+ * leaves those sessions alive does not do the thing it was done for.
+ *
+ * It used to be a pair of lines repeated after each `updatePassword`, and it
+ * reached the two self-service routes and none of the admin ones: an
+ * administrator resetting a phished account left the attacker's refresh token
+ * minting access tokens for the rest of its lifetime.
+ * `test/password-change-revokes-sessions.test.ts` holds every route that sets a
+ * password to this, and fails if anything but this function calls
+ * `updatePassword`.
+ */
+export declare function replaceUserPassword(authRepo: Pick<AuthRepository, "updatePassword" | "deleteAllRefreshTokensForUser" | "setTokensValidAfter">, uid: string, passwordHash: string): Promise<void>;

package/dist/{auth-BvBllZjy.js → auth-BS4WBA10.js}

@@ -8,8 +8,8 @@ import "./src-Br6ARbs6.js";
 import { n as createDdlBootstrapper, o as isSQLAdmin } from "./ddl-bootstrap-CfNvxMuK.js";
 import { t as firstSqlRow } from "./sql-rows-C6GEc2oE.js";
 import { r as logger } from "./logger-DO2PZc4i.js";
-import { n as errorHandler, t as ApiError } from "./errors-DMImyqyR.js";
-import { a as resolveListLimitParam } from "./query-parser-DUl8d557.js";
+import { r as errorHandler, t as ApiError } from "./errors-DWsX4yTd.js";
+import { a as resolveListLimitParam } from "./query-parser-C-rl30ce.js";
 import { C as require_jsonwebtoken, E as randomInt$1, O as sha256Hex, _ as verifyAccessToken, b as verifyMfaPendingToken, c as getAccessTokenExpiry, d as getRefreshTokenTtlMs, f as hasAsymmetricSigningKey, i as generateDownloadToken, l as getJwks, m as isJwtConfigured, n as configureJwt, o as generateMfaPendingToken, p as hashRefreshToken, r as generateAccessToken, s as generateRefreshToken, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenExpiry, v as verifyDownloadToken, w as constantTimeEqual } from "./jwt-C4OW-DNq.js";
 import { n as hasAdministrativeRole, r as isAdministrativeRole, t as ADMINISTRATIVE_ROLES } from "./admin-roles-vYdp_Pil.js";
 import { c as tryCanonicalStorageKey, i as canonicalStorageId } from "./keys-Qfc4XieN.js";
@@ -1034,11 +1034,12 @@ async function completeUserCreation(prepared, finalize) {
 /**
 * Has this access token been revoked?
 *
-* `logout`, `change-password`, `reset-password` and `DELETE /auth/sessions` all
-* stamp a `tokensValidAfter` watermark on the user. Every one of them also
-* deletes refresh-token rows, which is what made the gap easy to miss: the
-* session really is gone, and the *refresh* path really does check the
-* watermark — so signing out looked like it worked.
+* Everything that ends every session a user holds — a password change or reset
+* of any kind, and `DELETE /auth/sessions` — goes through
+* {@link revokeAllSessions}, which stamps a `tokensValidAfter` watermark on the
+* user. It also deletes refresh-token rows, which is what made the gap easy to
+* miss: the session really is gone, and the *refresh* path really does check
+* the watermark — so signing out looked like it worked.
 *
 * The access token was untouched. It is a bearer credential that nothing
 * consulted a database about, so it stayed valid for its full lifetime after
@@ -1082,6 +1083,52 @@ async function isAccessTokenRevoked(authRepo, payload) {
 	if (!validAfter) return false;
 	return payload.iat < Math.floor(validAfter.getTime() / 1e3);
 }
+/**
+* End every session this user holds, on every device.
+*
+* Two writes, because each covers what the other cannot. Deleting the refresh
+* rows ends the sessions that exist at this instant, and on a repository
+* without the watermark it is the only revocation there is. The watermark
+* voids what the delete cannot see: a refresh already in flight that inserts
+* its rotated token a moment after the delete ran, and every access token
+* already handed out, which {@link isAccessTokenRevoked} refuses from here on.
+*
+* The watermark write does not fail the caller. By the time it runs the
+* credential has usually already changed and the rows are gone, so a 500 would
+* tell someone their password did not change when it did. It is logged, because
+* a failure here leaves access tokens working until they expire.
+*/
+async function revokeAllSessions(authRepo, uid) {
+	await authRepo.deleteAllRefreshTokensForUser(uid);
+	try {
+		await authRepo.setTokensValidAfter?.(uid, /* @__PURE__ */ new Date());
+	} catch (error) {
+		logger.warn("[Auth] Could not write the token revocation watermark; access tokens issued before now stay valid until they expire", {
+			uid,
+			error
+		});
+	}
+}
+/**
+* Replace a user's password and end every session they hold.
+*
+* The one way a password hash is written over an existing account. A new
+* password is what someone sets when they believe the old one — or a session
+* signed in with it — is in someone else's hands, so a password change that
+* leaves those sessions alive does not do the thing it was done for.
+*
+* It used to be a pair of lines repeated after each `updatePassword`, and it
+* reached the two self-service routes and none of the admin ones: an
+* administrator resetting a phished account left the attacker's refresh token
+* minting access tokens for the rest of its lifetime.
+* `test/password-change-revokes-sessions.test.ts` holds every route that sets a
+* password to this, and fails if anything but this function calls
+* `updatePassword`.
+*/
+async function replaceUserPassword(authRepo, uid, passwordHash) {
+	await authRepo.updatePassword(uid, passwordHash);
+	await revokeAllSessions(authRepo, uid);
+}
 //#endregion
 //#region src/auth/rls-scope.ts
 var import_jsonwebtoken = /* @__PURE__ */ __toESM(require_jsonwebtoken(), 1);
@@ -3633,8 +3680,7 @@ function mountSessionRoutes(opts) {
 	router.delete("/sessions", requireLiveSession, async (c) => {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
-		await authRepo.deleteAllRefreshTokensForUser(userCtx.uid);
-		await authRepo.setTokensValidAfter?.(userCtx.uid, /* @__PURE__ */ new Date()).catch(() => void 0);
+		await revokeAllSessions(authRepo, userCtx.uid);
 		return c.json({
 			success: true,
 			message: "All sessions revoked successfully"
@@ -4548,10 +4594,8 @@ function createAuthRoutes(config) {
 		const storedToken = await authRepo.findValidPasswordResetToken(tokenHash);
 		if (!storedToken) throw ApiError.badRequest("Invalid or expired reset token", "INVALID_TOKEN");
 		const passwordHash = await ops.hashPassword(password);
-		await authRepo.updatePassword(storedToken.uid, passwordHash);
+		await replaceUserPassword(authRepo, storedToken.uid, passwordHash);
 		await authRepo.markPasswordResetTokenUsed(tokenHash);
-		await authRepo.deleteAllRefreshTokensForUser(storedToken.uid);
-		await authRepo.setTokensValidAfter?.(storedToken.uid, /* @__PURE__ */ new Date()).catch(() => void 0);
 		if (ops.onPasswordReset) ops.onPasswordReset(storedToken.uid).catch((err) => {
 			logger.error("[AuthHooks] onPasswordReset error", { error: err instanceof Error ? err.message : err });
 		});
@@ -4574,9 +4618,7 @@ function createAuthRoutes(config) {
 		const passwordValidation = ops.validatePasswordStrength(newPassword);
 		if (!passwordValidation.valid) throw ApiError.badRequest(passwordValidation.errors.join(". "), "WEAK_PASSWORD");
 		const passwordHash = await ops.hashPassword(newPassword);
-		await authRepo.updatePassword(user.id, passwordHash);
-		await authRepo.deleteAllRefreshTokensForUser(user.id);
-		await authRepo.setTokensValidAfter?.(user.id, /* @__PURE__ */ new Date()).catch(() => void 0);
+		await replaceUserPassword(authRepo, user.id, passwordHash);
 		return c.json({
 			success: true,
 			message: "Password has been changed successfully"
@@ -4809,6 +4851,10 @@ function buildBuiltinAuthCapabilities(inputs) {
 * 1. Collection-level hook (`auth.onResetPassword` on the collection)
 * 2. Backend-level hook (`AuthHooks.onAdminResetPassword`)
 * 3. Built-in default (send reset email, or generate temp password)
+*
+* Whichever of them runs, the account's existing sessions end, and a
+* `temporaryPassword` in its result becomes the account's password before the
+* response shows it to the admin.
 */
 /**
 * Create a standalone admin route for resetting user passwords.
@@ -4834,14 +4880,10 @@ function createResetPasswordRoute(config) {
 		let temporaryPassword;
 		let emailDeliveryFailed = false;
 		const body = await c.req.json().catch(() => ({}));
-		if (body.password) {
-			const password = body.password;
-			const validation = ops.validatePasswordStrength(password);
+		const chosenPassword = body.password ? body.password : void 0;
+		if (chosenPassword) {
+			const validation = ops.validatePasswordStrength(chosenPassword);
 			if (!validation.valid) throw ApiError.badRequest(`Password too weak: ${validation.errors.join(", ")}`);
-			const passwordHash = await ops.hashPassword(password);
-			await authRepo.updatePassword(existing.id, passwordHash);
-			temporaryPassword = void 0;
-			invitationSent = false;
 		} else if (collectionAuthConfig?.onResetPassword) {
 			const isEmailConfigured = !!(emailService && emailService.isConfigured());
 			const hookResult = await collectionAuthConfig.onResetPassword(existing.id, {
@@ -4861,42 +4903,38 @@ function createResetPasswordRoute(config) {
 			});
 			temporaryPassword = hookResult.temporaryPassword;
 			invitationSent = hookResult.invitationSent ?? false;
-		} else if (!!(emailService && emailService.isConfigured())) try {
+		} else if (!!(emailService && emailService.isConfigured())) {
 			const token = generateSecureToken();
 			const tokenHash = hashToken$1(token);
 			const expiresAt = new Date(Date.now() + 3600 * 1e3);
 			await authRepo.createPasswordResetToken(existing.id, tokenHash, expiresAt);
-			const setPasswordUrl = `${emailConfig?.resetPasswordUrl || ""}/reset-password?token=${token}`;
-			const { appName, logoUrl } = resolveEmailBranding(emailConfig);
-			const templateFn = emailConfig?.templates?.passwordReset;
-			const emailContent = templateFn ? templateFn(setPasswordUrl, {
-				email: existing.email,
-				displayName: existing.displayName
-			}) : getPasswordResetTemplate(setPasswordUrl, {
-				email: existing.email,
-				displayName: existing.displayName
-			}, appName, logoUrl);
-			await emailService.send({
-				to: existing.email,
-				subject: emailContent.subject,
-				html: emailContent.html,
-				text: emailContent.text
-			});
-			invitationSent = true;
-		} catch (emailError) {
-			logger.error("Failed to send reset email", { error: emailError instanceof Error ? emailError.message : emailError });
-			const clearPassword = generateSecurePassword();
-			const passwordHash = await ops.hashPassword(clearPassword);
-			await authRepo.updatePassword(existing.id, passwordHash);
-			temporaryPassword = clearPassword;
-			emailDeliveryFailed = true;
-		}
-		else {
-			const clearPassword = generateSecurePassword();
-			const passwordHash = await ops.hashPassword(clearPassword);
-			await authRepo.updatePassword(existing.id, passwordHash);
-			temporaryPassword = clearPassword;
-		}
+			try {
+				const setPasswordUrl = `${emailConfig?.resetPasswordUrl || ""}/reset-password?token=${token}`;
+				const { appName, logoUrl } = resolveEmailBranding(emailConfig);
+				const templateFn = emailConfig?.templates?.passwordReset;
+				const emailContent = templateFn ? templateFn(setPasswordUrl, {
+					email: existing.email,
+					displayName: existing.displayName
+				}) : getPasswordResetTemplate(setPasswordUrl, {
+					email: existing.email,
+					displayName: existing.displayName
+				}, appName, logoUrl);
+				await emailService.send({
+					to: existing.email,
+					subject: emailContent.subject,
+					html: emailContent.html,
+					text: emailContent.text
+				});
+				invitationSent = true;
+			} catch (emailError) {
+				logger.error("Failed to send reset email", { error: emailError instanceof Error ? emailError.message : emailError });
+				temporaryPassword = generateSecurePassword();
+				emailDeliveryFailed = true;
+			}
+		} else temporaryPassword = generateSecurePassword();
+		const newPassword = chosenPassword ?? temporaryPassword;
+		if (newPassword) await replaceUserPassword(authRepo, existing.id, await ops.hashPassword(newPassword));
+		else await revokeAllSessions(authRepo, existing.id);
 		const userRoles = await authRepo.getUserRoleIds(existing.id);
 		return c.json({
 			user: {
@@ -5124,12 +5162,14 @@ function createAdminUsersRoute(config) {
 		const updates = {};
 		if (email !== void 0) updates.email = normalizeEmail(email);
 		if (displayName !== void 0) updates.displayName = displayName;
+		let passwordHash;
 		if (password) {
 			const validation = ops.validatePasswordStrength(password);
 			if (!validation.valid) throw ApiError.badRequest(`Password too weak: ${validation.errors.join(". ")}`);
-			updates.passwordHash = await ops.hashPassword(password);
+			passwordHash = await ops.hashPassword(password);
 		}
 		if (Object.keys(updates).length > 0) await authRepo.updateUser(uid, updates);
+		if (passwordHash) await replaceUserPassword(authRepo, uid, passwordHash);
 		if (roles !== void 0 && Array.isArray(roles)) {
 			const wasAdmin = (await authRepo.getUserRoleIds(uid)).includes("admin");
 			const willBeAdmin = roles.includes("admin");
@@ -5396,8 +5436,9 @@ function createUserManagementFromRepo(repo, resolvedOps) {
 			if (data.displayName !== void 0) updateData.displayName = data.displayName;
 			if (data.photoUrl !== void 0) updateData.photoUrl = data.photoUrl;
 			if (data.metadata !== void 0) updateData.metadata = data.metadata;
-			if (data.password) updateData.passwordHash = await resolvedOps.hashPassword(data.password);
+			const passwordHash = data.password ? await resolvedOps.hashPassword(data.password) : void 0;
 			const user = await repo.updateUser(id, updateData);
+			if (user && passwordHash) await replaceUserPassword(repo, id, passwordHash);
 			return user ? toAuthUserData(user) : null;
 		},
 		async deleteUser(id) {
@@ -7137,4 +7178,4 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 //#endregion
 export { requireAdmin as $, defaultAuthLimiter as A, resolveEmailLinkBase as B, providerVerifiedEmail as C, raw as Ct, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as D, isPublicStoragePath as Dt, isBootstrapWindowOpen as E, PUBLIC_STORAGE_PREFIX as Et, extractLinks as F, createAdapterAuthMiddleware as G, hashPassword as H, registerDevEmailSink as I, extractUserFromToken as J, createAuthMiddleware as K, SMTPEmailService as L, activeDevEmailSink as M, clearActiveDevEmailSink as N, createDataRateLimiter as O, createDevEmailSink as P, queryTokenAuth as Q, createEmailService as R, pkceTokenParams as S, html as St, createBuiltinAuthAdapter as T, isOperationAllowed as Tt, validatePasswordStrength as U, resolveAuthHooks as V, verifyPassword as W, optionalAuth as X, fileTokenAuth as Y, publicObjectAuth as Z, verifyOidcIdToken as _, getUserInvitationTemplate as _t, resolveRateLimitStoreKind as a, validateApiKey as at, createGoogleProvider as b, RawHtml as bt, createSlackProvider as c, SERVICE_IDENTITY as ct, createDiscordProvider as d, completeUserCreation as dt, requireAuth as et, createTwitterProvider as f, generateSecurePassword as ft, tryVerifyOidcIdToken as g, getPasswordResetTemplate as gt, createMicrosoftProvider as h, getMagicLinkTemplate as ht, createApiKeyStore as i, isApiKeyToken as it, MemoryRateLimitStore as j, createRateLimiter as k, createBitbucketProvider as l, scopeDataDriver as lt, createAppleProvider as m, getEmailVerificationTemplate as mt, createCustomAuthAdapter as n, createFunctionApiKeyGuard as nt, createSqlRateLimitStore as o, extractBearerToken as ot, createFacebookProvider as p, getEmailOtpTemplate as pt, createRequireAuth as q, createApiKeyRoutes as r, createStorageApiKeyGuard as rt, createSpotifyProvider as s, safeCompare as st, auth_exports as t, createApiKeyPreAuth as tt, createGitLabProvider as u, supportsRlsScoping as ut, createGitHubProvider as v, getWelcomeEmailTemplate as vt, createJwksRoutes as w, httpMethodToOperation as wt, oauthCodeFlowSchema as x, escapeHtml as xt, createLinkedinProvider as y, resolveEmailBranding as yt, assertEmailLinkBases as z };
 
-//# sourceMappingURL=auth-BvBllZjy.js.map
+//# sourceMappingURL=auth-BS4WBA10.js.map