@rebasepro/server 0.24.0 → 0.24.1-canary.g19596ef

package/dist/auth/api-keys/api-key-middleware.d.ts

@@ -23,6 +23,7 @@ import { type DataDriver } from "@rebasepro/types";
 import type { HonoEnv } from "../../api/types.js";
 import type { ApiKeyStore } from "./api-key-store.js";
 import type { ApiKeyMasked } from "./api-key-types.js";
+import { type AccessControl } from "../access.js";
 /**
  * Check whether a token looks like a Rebase API key.
  */
@@ -41,8 +42,12 @@ export interface ApiKeyRefusal {
 /**
  * Verify a presented key: it exists, is live, and — for a personal key —
  * personal keys are on and its owner still exists. Records the use.
+ *
+ * `access` is the backend the key belongs to: whether it takes personal keys,
+ * how it finds their owners, and what their roles hold. The process default
+ * when omitted.
  */
-export declare function resolveApiKey(store: ApiKeyStore, token: string): Promise<ApiKeyIdentity | ApiKeyRefusal>;
+export declare function resolveApiKey(store: ApiKeyStore, token: string, access?: AccessControl): Promise<ApiKeyIdentity | ApiKeyRefusal>;
 /**
  * Options for the API key authentication handler.
  */
@@ -81,9 +86,11 @@ export declare function createTusScopeGuard(): MiddlewareHandler<HonoEnv>;
  *
  * @param mountPrefix - The path the functions router is mounted at
  *                      (e.g. `/api/functions`), used to extract the function
- *                      name from the request path.
+ *                      name from the request path. Omitted, it is the
+ *                      `mountPath` the functions group recorded for this
+ *                      request — wherever the application mounted it.
  */
-export declare function createFunctionScopeGuard(mountPrefix: string): MiddlewareHandler<HonoEnv>;
+export declare function createFunctionScopeGuard(mountPrefix?: string): MiddlewareHandler<HonoEnv>;
 /**
  * Pre-auth middleware for `rk_` bearer tokens.
  *

package/dist/auth/api-keys/api-key-routes.d.ts

@@ -33,7 +33,10 @@ export interface ApiKeyRouteOptions {
     revocationRepo?: import("../token-revocation.js").AccessJudgeRepository;
     /** What a scope's target may name. Unset, targets are not checked for existence. */
     targets?: KeyTargets;
-    /** The access model to validate scopes against. Defaults to the configured one. */
+    /**
+     * The access model to validate scopes against. Defaults to the one of the
+     * backend answering the request.
+     */
     accessModel?: () => AccessModel;
 }
 /**

package/dist/auth/builtin-auth-adapter.d.ts

@@ -10,6 +10,9 @@
  * present the same functionality through the pluggable `AuthAdapter` contract.
  */
 import type { AuthAdapter } from "@rebasepro/types";
+import { type JwtService } from "./jwt.js";
+import type { AuthLimiters } from "./rate-limiter.js";
+import type { AccessControl } from "./access.js";
 import type { CaptchaConfig } from "./captcha.js";
 import type { AuthRepository, OAuthProvider } from "./interfaces.js";
 import type { AuthHooks } from "./auth-hooks.js";
@@ -23,6 +26,16 @@ import type { EmailService, EmailConfig } from "../email/index.js";
 export interface BuiltinAuthAdapterConfig {
     /** The bootstrapper-provided auth repository (users, roles, tokens). */
     authRepository: AuthRepository;
+    /**
+     * The backend this adapter signs and verifies tokens for —
+     * `backend.services.jwt`, or a service of your own from `createJwtService`.
+     * The process default (what `configureJwt` sets) when omitted.
+     */
+    jwt?: JwtService;
+    /** The backend's auth limiters, counting in its own store. The process default's set when omitted. */
+    limiters?: AuthLimiters;
+    /** The backend's access model, which the default role is checked against. The process default when omitted. */
+    access?: AccessControl;
     /** Email service for password resets, verification, etc. */
     emailService?: EmailService;
     /** Email configuration. */

package/dist/auth/email-change-routes.d.ts

@@ -26,6 +26,7 @@ import { z } from "zod";
 import type { HonoEnv } from "../api/types.js";
 import type { MiddlewareHandler } from "hono";
 import type { resolveAuthHooks } from "./auth-hooks.js";
+import type { AuthLimiters } from "./rate-limiter.js";
 import type { AuthModuleConfig } from "./routes.js";
 /** How long an address-change link stays usable. */
 export declare const EMAIL_CHANGE_TTL_MS: number;
@@ -36,6 +37,8 @@ interface EmailChangeRoutesConfig {
     parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T;
     /** A signed-in user, with the revocation watermark consulted. */
     requireLiveSession: MiddlewareHandler<HonoEnv>;
+    /** The backend's auth limiters. */
+    limiters: AuthLimiters;
 }
 export declare function mountEmailChangeRoutes(opts: EmailChangeRoutesConfig): void;
 export {};

package/dist/auth/expired-token-sweep.d.ts

@@ -40,7 +40,11 @@ export type ExpiredTokenSweepOutcome = "swept" | "claimed-elsewhere" | "unclaime
 export interface ExpiredTokenSweep {
     /** Sweep now, then once per interval. */
     start(): void;
-    stop(): void;
+    /**
+     * No more ticks. Resolves once a tick already running has finished, so a
+     * caller about to close the pool can wait for the tick still using it.
+     */
+    stop(): Promise<void>;
     /** One tick: claim this interval's slot and, if it is ours, sweep. */
     runSlot(): Promise<ExpiredTokenSweepOutcome>;
 }

package/dist/auth/interfaces.d.ts

@@ -324,6 +324,16 @@ export interface UserRepository {
      * List users with server-side pagination, search, and sorting.
      */
     listUsersPaginated(options?: ListUsersOptions): Promise<PaginatedUsersResult>;
+    /**
+     * The ids of at most `limit` users, in no particular order. Answers "is
+     * there any user?" (`limit` 1) and "is this the only one?" (`limit` 2).
+     *
+     * `listUsersPaginated` answered those by counting the whole table and
+     * sorting it, on every anonymous `GET /auth/config` and every sign-up.
+     * Optional: a repository without it is asked through `listUsersPaginated`
+     * instead (`isUserTableEmpty` / `isOnlyUser` in `registration-policy.ts`).
+     */
+    firstUserIds?(limit: number): Promise<string[]>;
     /**
      * Update user's password hash. `null` removes the password: the account
      * then signs in only by link, code or provider.

package/dist/auth/jwks-routes.d.ts

@@ -1,5 +1,6 @@
 import { Hono } from "hono";
 import type { HonoEnv } from "../api/types.js";
+import { type JwtService } from "./jwt.js";
 /**
  * `GET /.well-known/jwks.json` — the public keys that verify this issuer's
  * access tokens.
@@ -13,5 +14,8 @@ import type { HonoEnv } from "../api/types.js";
  * where every verifier looks — an issuer of `https://api.example.com` implies
  * `https://api.example.com/.well-known/jwks.json`, whatever the API happens to
  * be prefixed with.
+ *
+ * `jwt` is the issuer whose keys these are — a backend's own
+ * (`backend.services.jwt`), or the process default when omitted.
  */
-export declare function createJwksRoutes(): Hono<HonoEnv>;
+export declare function createJwksRoutes(jwt?: JwtService): Hono<HonoEnv>;

package/dist/auth/jwt-crypto.d.ts

@@ -74,6 +74,13 @@ export declare function signJwt(payload: JwtClaims, key: JwtSigningKey, options:
 export declare function verifyJwt(token: string, key: JwtVerificationKey, options: {
     algorithms: string[];
 }): Promise<JwtClaims>;
+/**
+ * Whether a {@link verifyJwt} rejection says only that the token's `exp` has
+ * passed — the routine refusal that sends a client to refresh — rather than
+ * that the token is not one we signed. Here because the library decides how
+ * that is spelled.
+ */
+export declare function isExpiredJwtError(error: unknown): boolean;
 /**
  * The token's unverified header — `kid` and `alg` — or an empty object.
  *

package/dist/auth/jwt-keys.d.ts

@@ -106,3 +106,7 @@ export declare function normalizePemFromEnv(value: string): string;
 export declare function toJwks(keys: ResolvedJwtKey[]): {
     keys: PublicJwk[];
 };
+/** A verification key, as `jsonwebtoken.verify` would import it, once per string. */
+export declare function importedVerificationKey<K>(key: K): K | KeyObject;
+/** A signing key, as `jsonwebtoken.sign` would import it, once per string. */
+export declare function importedSigningKey<K>(key: K): K | KeyObject;