@rebasepro/server 0.22.0 → 0.23.0

package/dist/auth/jwt.d.ts

@@ -133,6 +133,18 @@ isAnonymous?: boolean): Promise<string>;
  * Get the expiration time of an access token in milliseconds from now
  */
 export declare function getAccessTokenExpiryMs(): number;
+/**
+ * A lifetime setting in milliseconds, or null when it is not one.
+ *
+ * The grammar is vercel/ms, because that is what `jsonwebtoken` reads
+ * `expiresIn` with: the token's `exp` and the expiry this module reports
+ * have to come from one reading of the same string, and they used to come
+ * from two — ours understood `<integer><d|h|m|s>` and nothing else.
+ *
+ * Stricter than ms in two ways, both about values nobody means: a bare number
+ * (ms reads "3600" as 3.6 seconds) and a lifetime of zero or less.
+ */
+export declare function parseDurationMs(value: string): number | null;
 /**
  * Get the expiration timestamp for an access token
  */
@@ -205,9 +217,14 @@ export declare function generateMfaPendingToken(uid: string, expiresInSeconds?:
  *
  * Returns `null` for anything else — including a perfectly valid *access*
  * token, which must not be interchangeable with this one in either direction.
+ *
+ * `iat` comes back with the uid because this token is a first factor that was
+ * accepted at that instant, and a sign-out everywhere after it has to void it
+ * the way it voids an access token — see `isAccessTokenRevoked`.
  */
 export declare function verifyMfaPendingToken(token: string): Promise<{
     uid: string;
+    iat?: number;
 } | null>;
 export interface DownloadTokenPayload {
     purpose: "file-read";

package/dist/auth/oauth-signin-policy.d.ts

@@ -13,7 +13,16 @@ export type AutoLinkRefusal =
  * address. Attaching a provider identity to it would hand the session to
  * whoever registered the address first — the classic pre-hijack.
  */
- | "local-account-unverified";
+ | "local-account-unverified"
+/**
+ * The local account has no password, and its address was never proven
+ * either: it was made by a sign-in through a provider that did not vouch
+ * for the address, or by someone who never had to. Its sign-in methods are
+ * whatever that someone attached, so this is the same pre-hijack as a
+ * password would be. Reported apart from `local-account-unverified` only
+ * so a login screen does not tell its owner to use a password.
+ */
+ | "local-account-unverified-passwordless";
 export type AutoLinkDecision = {
     allowed: true;
 } | {
@@ -28,17 +37,25 @@ export interface AutoLinkExistingUser {
 /**
  * May an OAuth identity be attached to a pre-existing account found *by email*?
  *
- * Both sides have to be trustworthy, and only one of them used to be checked:
+ * Both sides have to be trustworthy:
  *
  *  - the **provider** must have verified the address, or the caller has not
  *    shown they control it;
- *  - the **local account** must itself be trustworthy — either its address was
- *    verified, or it has no password at all (it was created by an OAuth
- *    sign-in or an invitation, so there is no credential an attacker could
- *    have planted in advance).
+ *  - the **local account**'s address must have been verified too. Whoever
+ *    made an unverified account never proved the address, and every way in
+ *    they left on it — a password, an identity from a provider that did not
+ *    vouch for the address — would go on opening the account the owner is
+ *    about to be signed into.
+ *
+ * The second rule used to exempt an account with no password, on the theory
+ * that one made by an OAuth sign-in holds no credential an attacker could have
+ * planted. It holds exactly one: the identity it was made with, which is an
+ * attacker's whenever the provider did not vouch for the address.
  *
- * A refusal is not a dead end: `POST /auth/link/<provider>` attaches the
- * identity once the caller proves ownership by holding a session.
+ * A refusal is not a dead end. `POST /auth/link/<provider>` attaches the
+ * identity once the caller proves ownership by holding a session, and proving
+ * the address (a magic link, an email code, a password reset) verifies the
+ * account — removing what nobody proved — after which this answers yes.
  */
 export declare function decideOAuthAutoLink(args: {
     providerEmailVerified: boolean | undefined;

package/dist/auth/rate-limiter.d.ts

@@ -1,6 +1,7 @@
 import { MiddlewareHandler } from "hono";
+import { type DataRateLimitCaller } from "@rebasepro/types";
 import { HonoEnv } from "../api/types.js";
-import { RateLimitStore } from "./rate-limit-store.js";
+import { RateLimitDecision, RateLimitStore } from "./rate-limit-store.js";
 /**
  * Sliding-window rate limiting for Hono.
  *
@@ -28,6 +29,15 @@ interface RateLimiterOptions {
      * shared one to have several limiters (or several processes) agree.
      */
     store?: RateLimitStore;
+    /**
+     * Count in the deployment's shared store once one is configured, under
+     * this name. For a limiter declared at module load, which runs before any
+     * configuration exists and so cannot be handed a `store` — see
+     * {@link setSharedRateLimitStore}. The name namespaces the limiter's keys
+     * there: two limiters keyed by the same IP must not share one count.
+     * Ignored when `store` is given.
+     */
+    name?: string;
     /**
      * Per-request limit override, for buckets whose allowance is data rather
      * than config (an API key's own `rate_limit`). Returning `undefined` uses
@@ -59,6 +69,14 @@ interface RateLimiterOptions {
      */
     trustedProxyHops?: number;
 }
+/**
+ * Point every named limiter at the deployment's shared store — or, with
+ * `undefined`, back at its own memory. Called once per boot with the store
+ * the data limiters use, and only when that store is shared (SQL, or one the
+ * operator supplied): the default memory store is swept on the data window,
+ * which is not every limiter's window.
+ */
+export declare function setSharedRateLimitStore(store: RateLimitStore | undefined): void;
 /**
  * Create a rate-limiting middleware.
  *
@@ -212,4 +230,16 @@ export declare const DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT = 3000;
  * `enabled: false` rather than pay for it twice.
  */
 export declare function createDataRateLimiter(config?: DataRateLimitConfig): MiddlewareHandler<HonoEnv>;
+/**
+ * The data API's per-caller limit, as a check rather than a middleware — for
+ * the door into the same data that is not an HTTP request.
+ *
+ * The realtime socket serves the rows the data API serves, one frame per
+ * request. It counted them per connection only, so a caller bought more budget
+ * by opening more sockets, and a frame never met the per-person limit its HTTP
+ * twin does. Built from the same config and store as
+ * {@link createDataRateLimiter}, it puts a caller in the same bucket under the
+ * same key: one person's allowance, spent through either door.
+ */
+export declare function createDataRateLimitCheck(config?: DataRateLimitConfig): (caller: DataRateLimitCaller) => Promise<RateLimitDecision | null>;
 export {};

package/dist/auth/session-routes.d.ts

@@ -34,6 +34,13 @@ interface SessionRoutesConfig {
         refreshToken: string;
     }>;
     applyTransformHook: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, uid: string) => Promise<AuthResponsePayload>;
+    /**
+     * The `register` captcha, built by the caller so a misconfiguration fails
+     * the boot once. `/anonymous/link` is registration — it is where a guest
+     * becomes an account — so it is guarded by the same challenge as
+     * `/register`. Absent when captcha is off or `register` is not protected.
+     */
+    registerCaptcha?: MiddlewareHandler<HonoEnv>;
 }
 export declare function mountSessionRoutes(opts: SessionRoutesConfig): void;
 export {};

package/dist/auth/token-revocation.d.ts

@@ -68,5 +68,8 @@ export declare function revokeAllSessions(authRepo: Pick<AuthRepository, "delete
  * `test/password-change-revokes-sessions.test.ts` holds every route that sets a
  * password to this, and fails if anything but this function calls
  * `updatePassword`.
+ *
+ * `null` removes the password instead, for the same reason and with the same
+ * revocation: see `confirmAddressOwnership`.
  */
-export declare function replaceUserPassword(authRepo: Pick<AuthRepository, "updatePassword" | "deleteAllRefreshTokensForUser" | "setTokensValidAfter">, uid: string, passwordHash: string): Promise<void>;
+export declare function replaceUserPassword(authRepo: Pick<AuthRepository, "updatePassword" | "deleteAllRefreshTokensForUser" | "setTokensValidAfter">, uid: string, passwordHash: string | null): Promise<void>;