@rebasepro/server 0.25.0-canary.ge06257e → 0.25.1

package/dist/{auth-xk37vrHO.js → auth-Dkvo2tTJ.js}

@@ -8,15 +8,15 @@ import { B as rewriteLegacyRlsFunctions, _ as scopesForRoles, a as KEY_MANAGEMEN
 import { n as isAnonymousUid, r as policy, t as ANONYMOUS_USER_ID } from "./policy-PdzX-Opd.js";
 import { t as isSQLAdmin } from "./backend-DTAOsLQc.js";
 import { t as IMPERSONATE_HEADER } from "./auth_adapter-CIItCTc8.js";
-import { r as logger } from "./logger-Bt32sHFw.js";
+import { a as logger } from "./logger-CW8pmTS6.js";
 import { n as revokeInternalTableSql, t as REBASE_USER_ROLE } from "./internal-tables-L2t39RdT.js";
 import { t as firstSqlRow } from "./sql-rows-C6GEc2oE.js";
-import { a as resolveListLimitParam } from "./query-parser-BnhugNwZ.js";
-import { a as isDataException, i as errorHandler, o as isDatabaseUnreachable, t as ApiError } from "./errors-CHSJYpoy.js";
-import { E as sha256Hex, S as constantTimeEqual, _ as verifyAccessToken, a as generateAccessToken, c as getAccessTokenExpiry, d as hasAsymmetricSigningKey, f as hashRefreshToken, h as processJwtService, i as customClaimsOf, l as getJwks, m as jwtOf, n as configureJwt, o as generateDownloadToken, p as isJwtConfigured, s as generateRefreshToken, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenExpiry, v as verifyDownloadToken, w as randomInt$1, x as require_jsonwebtoken } from "./jwt-YhciR93H.js";
+import { a as resolveListLimitParam } from "./query-parser-otFZqJsC.js";
+import { a as isDataException, c as warnIfDatabaseClosed, i as errorHandler, o as isDatabaseUnreachable, t as ApiError } from "./errors-OMWkKSH-.js";
+import { E as sha256Hex, S as constantTimeEqual, _ as verifyAccessToken, a as generateAccessToken, c as getAccessTokenExpiry, d as hasAsymmetricSigningKey, f as hashRefreshToken, h as processJwtService, i as customClaimsOf, l as getJwks, m as jwtOf, n as configureJwt, o as generateDownloadToken, p as isJwtConfigured, s as generateRefreshToken, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenExpiry, v as verifyDownloadToken, w as randomInt$1, x as require_jsonwebtoken } from "./jwt-D3oFauZI.js";
 import { a as canonicalStorageId, o as canonicalStorageKey, r as InvalidStorageKeyError } from "./keys-COzQ2aE8.js";
 import { n as scopeGuardProblem } from "./admin-roles-DI9RsgN3.js";
-import { n as createDdlBootstrapper } from "./ddl-bootstrap-BNqi2NZe.js";
+import { n as createDdlBootstrapper } from "./ddl-bootstrap-Ck20GSIX.js";
 import { createHash, randomBytes, randomInt } from "node:crypto";
 import { Hono } from "hono";
 import { promisify } from "util";
@@ -283,6 +283,21 @@ function scalarSubqueryBody(s) {
 	const inner = s.slice(1, -1).trim();
 	return STARTS_WITH_SELECT.test(inner) ? inner.slice(6).trim() : null;
 }
+/**
+* The names in a role array's body — `'admin', 'editor'`, each with or without
+* Postgres's `::text` — or `null` when an element is anything else. A quote
+* or a comma inside a name is not split into roles that were never there: the
+* clause stays raw and round-trips verbatim.
+*/
+function roleArrayElements(list) {
+	const roles = [];
+	for (const element of list.split(",")) {
+		const match = /^'([^',]*)'(?:::text)?$/.exec(element.trim());
+		if (!match) return null;
+		roles.push(match[1]);
+	}
+	return roles;
+}
 /** Whether any part of `expr` fell through to `raw`. */
 function containsRaw(expr) {
 	switch (expr.kind) {
@@ -303,16 +318,9 @@ function sqlToPolicy(sql) {
 	}
 	if (trimmed.toLowerCase() === "true") return policy.true();
 	if (trimmed.toLowerCase() === "false") return policy.false();
-	const overlapMatch = trimmed.match(/^string_to_array\s*\(\s*rebase\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\s*\[(.+)\]$/i);
-	if (overlapMatch) {
-		const roles = overlapMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
-		return policy.rolesOverlap(roles);
-	}
-	const containMatch = trimmed.match(/^string_to_array\s*\(\s*rebase\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\s*\[(.+)\]$/i);
-	if (containMatch) {
-		const roles = containMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
-		return policy.rolesContain(roles);
-	}
+	const rolesMatch = trimmed.match(/^string_to_array\s*\(\s*rebase\.roles\(\)\s*,\s*','(?:::text)?\s*\)\s*(&&|@>)\s*ARRAY\s*\[(.+)\]$/i);
+	const roles = rolesMatch ? roleArrayElements(rolesMatch[2]) : null;
+	if (rolesMatch && roles) return rolesMatch[1] === "&&" ? policy.rolesOverlap(roles) : policy.rolesContain(roles);
 	const orParts = splitTopLevel(trimmed, "OR");
 	if (orParts) return policy.or(...orParts.map(sqlToPolicy));
 	const andParts = splitTopLevel(trimmed, "AND");
@@ -764,7 +772,7 @@ var styles = {
         max-width: 600px;
         margin: 0 auto;
         padding: 40px 20px;
-        background-color: #f8fafc;
+        background-color: #f9fafb;
     `),
 	card: raw(`
         background-color: #ffffff;
@@ -773,13 +781,13 @@ var styles = {
         box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.1);
     `),
 	heading: raw(`
-        color: #1e293b;
+        color: #26292e;
         font-size: 24px;
         font-weight: 600;
         margin: 0 0 20px 0;
     `),
 	paragraph: raw(`
-        color: #475569;
+        color: #50545b;
         font-size: 16px;
         line-height: 1.6;
         margin: 0 0 20px 0;
@@ -796,14 +804,14 @@ var styles = {
         margin: 20px 0;
     `),
 	footer: raw(`
-        color: #94a3b8;
+        color: #9da2aa;
         font-size: 14px;
         margin-top: 30px;
         padding-top: 20px;
-        border-top: 1px solid #e2e8f0;
+        border-top: 1px solid #e5e8eb;
     `),
 	warning: raw(`
-        color: #64748b;
+        color: #6e737b;
         font-size: 14px;
         background-color: #fef3c7;
         padding: 12px 16px;
@@ -821,8 +829,8 @@ var styles = {
         font-size: 34px;
         font-weight: 700;
         letter-spacing: 10px;
-        color: #1e293b;
-        background-color: #f1f5f9;
+        color: #26292e;
+        background-color: #f3f5f6;
         border-radius: 10px;
         padding: 18px 20px 18px 30px;
     `)
@@ -904,7 +912,7 @@ function renderHeader(appName, logoUrl) {
 	return html`
         <div style="text-align: center; margin-bottom: 24px;">
             <img src="${logoUrl}" width="48" height="48" alt="${appName}"
-                 style="display: inline-block; width: 48px; height: auto; border: 0; outline: none; text-decoration: none; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; font-size: 12px; color: #64748b;">
+                 style="display: inline-block; width: 48px; height: auto; border: 0; outline: none; text-decoration: none; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; font-size: 12px; color: #6e737b;">
         </div>
 `;
 }
@@ -922,7 +930,7 @@ function getPasswordResetTemplate(resetUrl, user, appName = DEFAULT_APP_NAME, lo
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>${subject}</title>
 </head>
-<body style="margin: 0; padding: 0; background-color: #f8fafc;">
+<body style="margin: 0; padding: 0; background-color: #f9fafb;">
     <div style="${styles.container}">${renderHeader(appName, logoUrl)}
         <div style="${styles.card}">
             <h1 style="${styles.heading}">Reset Your Password</h1>
@@ -997,7 +1005,7 @@ function getEmailVerificationTemplate(verifyUrl, user, appName = DEFAULT_APP_NAM
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>${subject}</title>
 </head>
-<body style="margin: 0; padding: 0; background-color: #f8fafc;">
+<body style="margin: 0; padding: 0; background-color: #f9fafb;">
     <div style="${styles.container}">${renderHeader(appName, logoUrl)}
         <div style="${styles.card}">
             <h1 style="${styles.heading}">Verify Your Email</h1>
@@ -1073,7 +1081,7 @@ function getUserInvitationTemplate(setPasswordUrl, user, appName = DEFAULT_APP_N
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>${subject}</title>
 </head>
-<body style="margin: 0; padding: 0; background-color: #f8fafc;">
+<body style="margin: 0; padding: 0; background-color: #f9fafb;">
     <div style="${styles.container}">${renderHeader(appName, logoUrl)}
         <div style="${styles.card}">
             <h1 style="${styles.heading}">Welcome to ${appName}!</h1>
@@ -1148,7 +1156,7 @@ function getWelcomeEmailTemplate(user, appName = DEFAULT_APP_NAME, loginUrl, log
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>${subject}</title>
 </head>
-<body style="margin: 0; padding: 0; background-color: #f8fafc;">
+<body style="margin: 0; padding: 0; background-color: #f9fafb;">
     <div style="${styles.container}">${renderHeader(appName, logoUrl)}
         <div style="${styles.card}">
             <h1 style="${styles.heading}">Welcome to ${appName}</h1>
@@ -1216,7 +1224,7 @@ function getEmailOtpTemplate(code, user, appName = DEFAULT_APP_NAME, logoUrl) {
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>${subject}</title>
 </head>
-<body style="margin: 0; padding: 0; background-color: #f8fafc;">
+<body style="margin: 0; padding: 0; background-color: #f9fafb;">
     <div style="${styles.container}">${renderHeader(appName, logoUrl)}
         <div style="${styles.card}">
             <h1 style="${styles.heading}">Your sign-in code</h1>
@@ -1282,7 +1290,7 @@ function getMagicLinkTemplate(magicLinkUrl, user, appName = DEFAULT_APP_NAME, lo
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>${subject}</title>
 </head>
-<body style="margin: 0; padding: 0; background-color: #f8fafc;">
+<body style="margin: 0; padding: 0; background-color: #f9fafb;">
     <div style="${styles.container}">${renderHeader(appName, logoUrl)}
         <div style="${styles.card}">
             <h1 style="${styles.heading}">Sign In to ${appName}</h1>
@@ -1361,7 +1369,7 @@ function getEmailChangeTemplate(confirmUrl, user, newEmail, appName = DEFAULT_AP
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>${subject}</title>
 </head>
-<body style="margin: 0; padding: 0; background-color: #f8fafc;">
+<body style="margin: 0; padding: 0; background-color: #f9fafb;">
     <div style="${styles.container}">${renderHeader(appName, logoUrl)}
         <div style="${styles.card}">
             <h1 style="${styles.heading}">Confirm Your New Email</h1>
@@ -1434,7 +1442,7 @@ function getEmailChangeNoticeTemplate(user, newEmail, appName = DEFAULT_APP_NAME
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>${subject}</title>
 </head>
-<body style="margin: 0; padding: 0; background-color: #f8fafc;">
+<body style="margin: 0; padding: 0; background-color: #f9fafb;">
     <div style="${styles.container}">${renderHeader(appName, logoUrl)}
         <div style="${styles.card}">
             <h1 style="${styles.heading}">Email Change Requested</h1>
@@ -2987,7 +2995,7 @@ function createRequireAuth(options) {
 			return next();
 		} catch (error) {
 			if (isDatabaseUnreachable(error)) {
-				logger.warn("[Auth] Could not resolve roles for an admin-gated request: the database is unreachable", { uid: payload.uid });
+				if (!warnIfDatabaseClosed(error)) logger.warn("[Auth] Could not resolve roles for an admin-gated request: the database is unreachable", { uid: payload.uid });
 				return refuse(c, ApiError.databaseUnavailable());
 			}
 			logger.warn("[Auth] Could not resolve roles for an admin-gated request", {
@@ -7877,7 +7885,7 @@ function createBuiltinAuthAdapter(config) {
 	*/
 	function lookupRefusal(line, uid, error) {
 		if (isDatabaseUnreachable(error)) {
-			logger.warn(`${line}: the database is unreachable`, { uid });
+			if (!warnIfDatabaseClosed(error)) logger.warn(`${line}: the database is unreachable`, { uid });
 			return ApiError.databaseUnavailable();
 		}
 		logger.warn(line, {
@@ -10262,4 +10270,4 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 //#endregion
 export { optionalAuth as $, raw as $t, createAuthLimiters as A, setDefaultAccessControl as At, registerDevEmailSink as B, resolveEmailLinkBase as Bt, createPersonalKeyRoutes as C, configureAccess as Ct, configureUserPicking as D, processAccessControl as Dt, createBuiltinAuthAdapter as E, keyOwnerResolverFor as Et, MemoryRateLimitStore as F, supportsRlsScoping as Ft, validatePasswordStrength as G, getMagicLinkTemplate as Gt, createEmailService as H, getEmailChangeTemplate as Ht, activeDevEmailSink as I, isAccessTokenRevoked as It, createAdapterAuthMiddleware as J, getWelcomeEmailTemplate as Jt, verifyPassword as K, getPasswordResetTemplate as Kt, clearActiveDevEmailSink as L, completeUserCreation as Lt, createDataRateLimiter as M, safeCompare as Mt, createRateLimiter as N, SERVICE_IDENTITY as Nt, isBootstrapWindowOpen as O, requireScope as Ot, setSharedRateLimitStore as P, scopeDataDriver as Pt, fileTokenAuth as Q, html as Qt, createDevEmailSink as R, generateSecurePassword as Rt, createApiKeyRoutes as S, callerScopes as St, createJwksRoutes as T, hasScope as Tt, resolveAuthHooks as U, getEmailOtpTemplate as Ut, SMTPEmailService as V, getEmailChangeNoticeTemplate as Vt, hashPassword as W, getEmailVerificationTemplate as Wt, createRequireAuth as X, RawHtml as Xt, createAuthMiddleware as Y, resolveEmailBranding as Yt, extractUserFromToken as Z, escapeHtml as Zt, oauthCodeFlowSchema as _, isApiKeyToken as _t, createBitbucketProvider as a, storageObjectPath as an, userFromToken as at, resolveRateLimitStoreKind as b, accessModelFromCollections as bt, createTwitterProvider as c, isPublicObjectGrant as ct, createMicrosoftProvider as d, storageRequestWildcard as dt, httpMethodToOperation as en, publicObjectAuth as et, tryVerifyOidcIdToken as f, decideImpersonation as ft, createGoogleProvider as g, createTusScopeGuard as gt, createLinkedinProvider as h, createFunctionScopeGuard as ht, createSlackProvider as i, isPublicStoragePath as in, requireAuth as it, createDataRateLimitCheck as j, extractBearerToken as jt, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as k, requireScopeByMethod as kt, createFacebookProvider as l, requestedStorageObject as lt, createGitHubProvider as m, createApiKeyPreAuth as mt, createCustomAuthAdapter as n, PUBLIC_STORAGE_PREFIX as nn, refuse as nt, createGitLabProvider as o, PUBLIC_OBJECT_PRINCIPAL as ot, verifyOidcIdToken as p, refuseUnhonouredImpersonation as pt, adapterRefusal as q, getUserInvitationTemplate as qt, createSpotifyProvider as r, isPublicStorageKey as rn, requireAdmin as rt, createDiscordProvider as s, isDownloadTokenGrant as st, auth_exports as t, securityRuleToConditions as tn, queryTokenAuth as tt, createAppleProvider as u, storageObjectOfPath as ut, pkceTokenParams as v, resolveApiKey as vt, createApiKeyStore as w, getAccessModel as wt, createSqlRateLimitStore as x, accessOf as xt, providerVerifiedEmail as y, validateApiKey as yt, extractLinks as z, assertEmailLinkBases as zt };
 
-//# sourceMappingURL=auth-xk37vrHO.js.map
+//# sourceMappingURL=auth-Dkvo2tTJ.js.map