@rebasepro/server 0.9.1-canary.09aaf62 → 0.9.1-canary.0de22e0

package/dist/api/types.d.ts

@@ -1,5 +1,5 @@
 import { VectorSearchParams, LogicalCondition, FilterValues } from "@rebasepro/types";
-import { AuthResult } from "../auth/middleware";
+import type { AuthResult } from "../auth/middleware";
 import { DataDriver } from "@rebasepro/types";
 import type { ApiKeyMasked } from "../auth/api-keys/api-key-types";
 /**
@@ -9,7 +9,7 @@ import type { ApiKeyMasked } from "../auth/api-keys/api-key-types";
 export type HonoEnv = {
     Variables: {
         user?: AuthResult | {
-            userId?: string;
+            uid?: string;
             roles?: string[];
         };
         driver?: DataDriver;

package/dist/auth/jwt.d.ts

@@ -4,9 +4,14 @@ export interface JwtConfig {
     refreshExpiresIn?: string;
 }
 export interface AccessTokenPayload {
-    userId: string;
+    /**
+     * The user's id — the same spelling the domain model, the auth adapters and
+     * the RLS layer (`auth.uid()`) all use. Tokens minted before this rename
+     * carry `userId` instead, and older external IdPs may send `sub`;
+     * {@link verifyAccessToken} accepts all three and normalises to this.
+     */
+    uid: string;
     roles: string[];
-    uid?: string;
     /** Authentication Assurance Level: aal1 = password/oauth, aal2 = MFA verified */
     aal?: "aal1" | "aal2";
     /** Email claim from the JWT, if present */
@@ -28,7 +33,7 @@ export declare function configureJwt(config: JwtConfig): void;
 /**
  * Generate an access token (short-lived, 1 hour by default)
  */
-export declare function generateAccessToken(userId: string, roles: string[], aal?: "aal1" | "aal2", customClaims?: Record<string, unknown>): string;
+export declare function generateAccessToken(uid: string, roles: string[], aal?: "aal1" | "aal2", customClaims?: Record<string, unknown>): string;
 /**
  * Get the expiration time of an access token in milliseconds from now
  */

package/dist/auth/middleware.d.ts

@@ -1,13 +1,13 @@
 import { MiddlewareHandler, Context } from "hono";
 import { DataDriver } from "@rebasepro/types";
 import { AccessTokenPayload } from "./jwt";
-import { HonoEnv } from "../api/types";
+import type { HonoEnv } from "../api/types";
 import type { ApiKeyStore } from "./api-keys/api-key-store";
 /**
  * Result from a custom auth validator.
  * - `false`/`null`/`undefined` = not authenticated
  * - `true` = authenticated as default user
- * - object with `userId` or `uid` = authenticated with user info
+ * - object with `uid` (or legacy `userId`) = authenticated with user info
  */
 export type AuthResult = boolean | null | undefined | {
     userId?: string;