@rebasepro/server 0.24.0 → 0.24.1-canary.g56af4a4

package/dist/auth/registration-policy.d.ts

@@ -1,3 +1,4 @@
+import type { AuthRepository } from "./interfaces.js";
 /**
  * Whether a registration may proceed — computed in exactly one place.
  *
@@ -66,6 +67,21 @@ export interface RegistrationPolicy {
 export declare function isBootstrapWindowOpen(env?: {
     NODE_ENV?: string;
 }): boolean;
+type UserPresenceRepository = Pick<AuthRepository, "firstUserIds" | "listUsersPaginated">;
+/**
+ * Whether the users table is empty — the question behind the bootstrap window.
+ *
+ * Through `AuthRepository.firstUserIds` when the repository has it: one
+ * unordered `LIMIT 1` read. Otherwise through `listUsersPaginated`, which also
+ * counts and sorts the whole table, so it is only the fallback.
+ */
+export declare function isUserTableEmpty(repo: UserPresenceRepository): Promise<boolean>;
+/**
+ * Whether the account just created is the only one there is. Two ids at most:
+ * whether anyone else exists, and, when nobody does, whether it is this one.
+ * Same fallback as {@link isUserTableEmpty}.
+ */
+export declare function isOnlyUser(repo: UserPresenceRepository, uid: string): Promise<boolean>;
 /**
  * What to tell a caller who hit an empty production database with the window
  * shut. Named here so the register route and the bootstrap route say the same
@@ -113,3 +129,4 @@ export declare function isAnonymousAuthOpen(policy: {
     allowAnonymous?: boolean;
     disableSelfRegistration?: boolean;
 }): boolean;
+export {};

package/dist/auth/user-picking.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Who may read the user picker (`GET /api/admin/users/pick`).
+ *
+ * A `userSelect` field stores a user's id, and the person filling it in picks
+ * that user from a list. Listing the users is an admin-plane read
+ * (`users:read`), which an editor does not hold — so the picker answers a
+ * narrower question for a wider audience: id, name, email and avatar, to
+ * anyone who may write a collection that has such a field.
+ *
+ * "May write" is the collection's `securityRules` for an insert or an update,
+ * evaluated the way the admin panel decides whether to offer the form, with
+ * one difference. A rule that depends only on the row (an owner field) counts
+ * as allowing, since the person may write some row. A rule written as SQL the
+ * policy model cannot read cannot be judged ahead, and here it counts as
+ * refusing: read optimistically, it would let any signed-in person list every
+ * user's name and email. A key or token narrowed by scopes must also hold
+ * `data:write` on that collection.
+ *
+ * The collections are read through a getter configured at boot, so a schema
+ * edited live is what is judged.
+ *
+ * @module
+ */
+import type { Context } from "hono";
+import { type CollectionConfig, type Properties } from "@rebasepro/types";
+import type { HonoEnv } from "../api/types.js";
+/** Tell the picker which collections this backend serves. Called once at boot. */
+export declare function configureUserPicking(collections: () => readonly CollectionConfig[]): void;
+/** Whether any property, at any depth, is a `userSelect` field. */
+export declare function propertiesReferenceUsers(properties: Properties | undefined): boolean;
+/**
+ * Whether this request's caller may read the user picker: they hold
+ * `users:read`, or they may write a collection with a `userSelect` field.
+ */
+export declare function mayPickUsers(c: Context<HonoEnv>): boolean;