@rebasepro/server 0.21.1 → 0.22.0

package/dist/auth/exclude-auth-secrets.d.ts

@@ -1,9 +1,41 @@
+/**
+ * Keep the auth collection's secret columns off the API, whoever declared it.
+ *
+ * `users` is the one collection a project is *expected* to redeclare: it is
+ * scaffolded into `config/collections/users.ts` so the panel can present it, and
+ * a slug collision replaces the framework's default outright rather than merging
+ * with it. So every protection the default carried has to be restated by hand in
+ * the copy — and the one that is invisible when it goes missing is
+ * `excludeFromApi`.
+ *
+ * It is invisible because the neighbouring options *look* like they do the same
+ * job. `admin.hideFromCollection` and `admin.disabled.hidden` keep a field out of
+ * the CMS, which is what a person editing that file is thinking about, and a
+ * declaration carrying both of those reads as careful. Neither one strips the
+ * column from a row on the wire; only `excludeFromApi` does. The result is a
+ * users collection that hides the password hash from the admin panel and serves
+ * it to anyone whose read policy admits the row.
+ *
+ * Which is not hypothetical: it is what the platform's own control plane did,
+ * where the read policy deliberately admits co-members so the Members view can
+ * name them, and every colleague's browser was therefore handed everyone's
+ * scrypt hash and any pending email-verification token.
+ *
+ * So the framework restates it. Not by rejecting the collection — a boot failure
+ * over a field a developer never thought about is a bad trade, and an existing
+ * deployment would stop rather than start protecting itself — but by adding the
+ * flag and saying so. Which columns count is decided once, by
+ * {@link authSecretsMissingExclusion} in `@rebasepro/common`, and every
+ * `CollectionRegistry` applies the same rule to the copies it makes — which is
+ * how the panel, building its registry from the project's file as written,
+ * agrees with the server.
+ */
 /**
  * Force `excludeFromApi` onto the auth collection's secret columns.
  *
- * Mutates in place and must therefore run BEFORE the collections are registered:
- * each registry re-normalizes what it is given, and a flag set afterwards
- * reaches whichever copy happened to be mutated and no others.
+ * Mutates in place, for what reads the collection configs directly rather than a
+ * registry's normalized copies. Run it before the collections are handed on, so
+ * those readers never see a config without the flag.
  *
  * @returns the columns it had to fix, per collection — for the caller to log and
  *          for tests to assert on.

package/dist/{auth-BS4WBA10.js → auth-CCDpk2rn.js}

@@ -3,13 +3,13 @@ import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { i as __toESM, n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
-import { P as revokeInternalTableSql, at as isAnonymousUid, it as ANONYMOUS_USER_ID } from "./src-Caz7nREj.js";
+import { F as revokeInternalTableSql, ot as ANONYMOUS_USER_ID, st as isAnonymousUid } from "./src-1vL-I1Po.js";
 import "./src-Br6ARbs6.js";
 import { n as createDdlBootstrapper, o as isSQLAdmin } from "./ddl-bootstrap-CfNvxMuK.js";
 import { t as firstSqlRow } from "./sql-rows-C6GEc2oE.js";
 import { r as logger } from "./logger-DO2PZc4i.js";
 import { r as errorHandler, t as ApiError } from "./errors-DWsX4yTd.js";
-import { a as resolveListLimitParam } from "./query-parser-C-rl30ce.js";
+import { a as resolveListLimitParam } from "./query-parser-BleZmY18.js";
 import { C as require_jsonwebtoken, E as randomInt$1, O as sha256Hex, _ as verifyAccessToken, b as verifyMfaPendingToken, c as getAccessTokenExpiry, d as getRefreshTokenTtlMs, f as hasAsymmetricSigningKey, i as generateDownloadToken, l as getJwks, m as isJwtConfigured, n as configureJwt, o as generateMfaPendingToken, p as hashRefreshToken, r as generateAccessToken, s as generateRefreshToken, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenExpiry, v as verifyDownloadToken, w as constantTimeEqual } from "./jwt-C4OW-DNq.js";
 import { n as hasAdministrativeRole, r as isAdministrativeRole, t as ADMINISTRATIVE_ROLES } from "./admin-roles-vYdp_Pil.js";
 import { c as tryCanonicalStorageKey, i as canonicalStorageId } from "./keys-Qfc4XieN.js";
@@ -2676,6 +2676,7 @@ function createDataRateLimiter(config = {}) {
 			return `ip:${defaultKeyGenerator(c, trustedProxyHops)}`;
 		},
 		resolveLimit: async (c) => {
+			if (c.get("user")?.uid === SERVICE_IDENTITY.uid) return null;
 			const key = c.get("apiKey");
 			if (key) return key.rate_limit ?? apiKeyLimit;
 			return await identify(c) ? userLimit : anonLimit;
@@ -4446,10 +4447,10 @@ function createAuthRoutes(config) {
 						providerEmailVerified: externalUser.emailVerified,
 						existingUser: user
 					});
-					if (!decision.allowed) {
-						const why = decision.reason === "provider-email-unverified" ? `${provider.id} has not verified this email address, so it cannot be linked automatically.` : "That account's email address was never verified, so it cannot be linked automatically.";
-						throw ApiError.forbidden(`An account with this email already exists with a different sign-in method. ${why} Sign in with your existing method, then POST to /auth/link/${provider.id} to link ${provider.id} to your account.`, "EMAIL_NOT_VERIFIED");
-					}
+					if (!decision.allowed) throw new ApiError(403, "EMAIL_NOT_VERIFIED", `An account with this email already exists with a different sign-in method. ${decision.reason === "provider-email-unverified" ? `${provider.id} has not verified this email address, so it cannot be linked automatically.` : "That account's email address was never verified, so it cannot be linked automatically."} Sign in with your existing method, then POST to /auth/link/${provider.id} to link ${provider.id} to your account.`, {
+						reason: decision.reason,
+						provider: provider.id
+					});
 					await authRepo.linkUserIdentity(user.id, provider.id, externalUser.providerId, { email: externalUser.email });
 					await authRepo.updateUser(user.id, {
 						displayName: user.displayName || externalUser.displayName || void 0,
@@ -4534,13 +4535,15 @@ function createAuthRoutes(config) {
 			if (identityOwner) return c.json({
 				success: true,
 				provider: provider.id,
-				alreadyLinked: true
+				alreadyLinked: true,
+				photoURL: externalUser.photoUrl ?? null
 			});
 			await authRepo.linkUserIdentity(userCtx.uid, provider.id, externalUser.providerId, { email: externalUser.email });
 			return c.json({
 				success: true,
 				provider: provider.id,
-				alreadyLinked: false
+				alreadyLinked: false,
+				photoURL: externalUser.photoUrl ?? null
 			});
 		});
 	}
@@ -7178,4 +7181,4 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 //#endregion
 export { requireAdmin as $, defaultAuthLimiter as A, resolveEmailLinkBase as B, providerVerifiedEmail as C, raw as Ct, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as D, isPublicStoragePath as Dt, isBootstrapWindowOpen as E, PUBLIC_STORAGE_PREFIX as Et, extractLinks as F, createAdapterAuthMiddleware as G, hashPassword as H, registerDevEmailSink as I, extractUserFromToken as J, createAuthMiddleware as K, SMTPEmailService as L, activeDevEmailSink as M, clearActiveDevEmailSink as N, createDataRateLimiter as O, createDevEmailSink as P, queryTokenAuth as Q, createEmailService as R, pkceTokenParams as S, html as St, createBuiltinAuthAdapter as T, isOperationAllowed as Tt, validatePasswordStrength as U, resolveAuthHooks as V, verifyPassword as W, optionalAuth as X, fileTokenAuth as Y, publicObjectAuth as Z, verifyOidcIdToken as _, getUserInvitationTemplate as _t, resolveRateLimitStoreKind as a, validateApiKey as at, createGoogleProvider as b, RawHtml as bt, createSlackProvider as c, SERVICE_IDENTITY as ct, createDiscordProvider as d, completeUserCreation as dt, requireAuth as et, createTwitterProvider as f, generateSecurePassword as ft, tryVerifyOidcIdToken as g, getPasswordResetTemplate as gt, createMicrosoftProvider as h, getMagicLinkTemplate as ht, createApiKeyStore as i, isApiKeyToken as it, MemoryRateLimitStore as j, createRateLimiter as k, createBitbucketProvider as l, scopeDataDriver as lt, createAppleProvider as m, getEmailVerificationTemplate as mt, createCustomAuthAdapter as n, createFunctionApiKeyGuard as nt, createSqlRateLimitStore as o, extractBearerToken as ot, createFacebookProvider as p, getEmailOtpTemplate as pt, createRequireAuth as q, createApiKeyRoutes as r, createStorageApiKeyGuard as rt, createSpotifyProvider as s, safeCompare as st, auth_exports as t, createApiKeyPreAuth as tt, createGitLabProvider as u, supportsRlsScoping as ut, createGitHubProvider as v, getWelcomeEmailTemplate as vt, createJwksRoutes as w, httpMethodToOperation as wt, oauthCodeFlowSchema as x, escapeHtml as xt, createLinkedinProvider as y, resolveEmailBranding as yt, assertEmailLinkBases as z };
 
-//# sourceMappingURL=auth-BS4WBA10.js.map
+//# sourceMappingURL=auth-CCDpk2rn.js.map