@rebasepro/server 0.9.1-canary.26fe4b2 → 0.9.1-canary.29ed165

package/dist/api/errors.d.ts

@@ -9,9 +9,24 @@ export declare class ApiError extends Error {
     readonly statusCode: number;
     readonly code: string;
     readonly details?: unknown;
-    constructor(statusCode: number, code: string, message: string, details?: unknown);
+    /**
+     * Whether this outcome is a routine part of normal operation rather than
+     * something an operator should look at. Expected errors log at debug; every
+     * other operational error logs at warn.
+     *
+     * The motivating case is `POST /auth/refresh` with no session: clients
+     * refresh on page load before they know whether one exists, so every
+     * anonymous page view is a 401 — correct, and not worth a warning line.
+     */
+    readonly expected: boolean;
+    constructor(statusCode: number, code: string, message: string, details?: unknown, expected?: boolean);
     static badRequest(message: string, code?: string, details?: unknown): ApiError;
     static unauthorized(message: string, code?: string): ApiError;
+    /**
+     * A 401 that is a normal outcome, not an incident — logged at debug.
+     * See {@link ApiError.expected}.
+     */
+    static unauthenticated(message: string, code?: string): ApiError;
     static forbidden(message: string, code?: string): ApiError;
     static notFound(message: string, code?: string): ApiError;
     static conflict(message: string, code?: string): ApiError;

package/dist/api/rest/write-validation.d.ts

@@ -12,8 +12,11 @@ import { CollectionConfig } from "@rebasepro/types";
  *   columns, so the set is exact);
  * - the foreign-key column behind an owning relation, which callers may write
  *   directly instead of through the relation property;
+ * - anything named in `options.extraKnownFields` — for an auth collection the
+ *   credential keys the auth adapter consumes before a row is ever built;
  * - nothing else. `id` in particular is not automatically known — see below.
  */
 export declare function assertKnownWriteFields(values: Record<string, unknown>, collection: CollectionConfig, options?: {
     rowIndex?: number;
+    extraKnownFields?: readonly string[];
 }): void;

package/dist/index.es.js

@@ -3539,12 +3539,23 @@ var ApiError = class ApiError extends Error {
 	statusCode;
 	code;
 	details;
-	constructor(statusCode, code, message, details) {
+	/**
+	* Whether this outcome is a routine part of normal operation rather than
+	* something an operator should look at. Expected errors log at debug; every
+	* other operational error logs at warn.
+	*
+	* The motivating case is `POST /auth/refresh` with no session: clients
+	* refresh on page load before they know whether one exists, so every
+	* anonymous page view is a 401 — correct, and not worth a warning line.
+	*/
+	expected;
+	constructor(statusCode, code, message, details, expected = false) {
 		super(message);
 		this.name = "ApiError";
 		this.statusCode = statusCode;
 		this.code = code;
 		this.details = details;
+		this.expected = expected;
 	}
 	static badRequest(message, code = "BAD_REQUEST", details) {
 		return new ApiError(400, code, message, details);
@@ -3552,6 +3563,13 @@ var ApiError = class ApiError extends Error {
 	static unauthorized(message, code = "UNAUTHORIZED") {
 		return new ApiError(401, code, message);
 	}
+	/**
+	* A 401 that is a normal outcome, not an incident — logged at debug.
+	* See {@link ApiError.expected}.
+	*/
+	static unauthenticated(message, code = "UNAUTHORIZED") {
+		return new ApiError(401, code, message, void 0, true);
+	}
 	static forbidden(message, code = "FORBIDDEN") {
 		return new ApiError(403, code, message);
 	}
@@ -3584,7 +3602,10 @@ var errorHandler = (err, c) => {
 	const error = err;
 	const reqId = typeof c.get === "function" ? c.get("requestId") : void 0;
 	if (error instanceof ApiError || error.name === "ApiError") {
-		logger.warn(`⚠️ [API] ${c.req.method} ${c.req.path} → ${error.statusCode} ${error.code}: ${error.message}` + (reqId ? ` [${reqId}]` : ""));
+		const expected = error instanceof ApiError && error.expected;
+		const line = `[API] ${c.req.method} ${c.req.path} → ${error.statusCode} ${error.code}: ${error.message}` + (reqId ? ` [${reqId}]` : "");
+		if (expected) logger.debug(line);
+		else logger.warn(`⚠️ ${line}`);
 		return c.json({ error: {
 			message: error.message,
 			code: error.code || "INTERNAL_ERROR",
@@ -3826,6 +3847,8 @@ function parseQueryOptions(query) {
 *   columns, so the set is exact);
 * - the foreign-key column behind an owning relation, which callers may write
 *   directly instead of through the relation property;
+* - anything named in `options.extraKnownFields` — for an auth collection the
+*   credential keys the auth adapter consumes before a row is ever built;
 * - nothing else. `id` in particular is not automatically known — see below.
 */
 function assertKnownWriteFields(values, collection, options) {
@@ -3833,6 +3856,7 @@ function assertKnownWriteFields(values, collection, options) {
 	if (!collection.properties || Object.keys(collection.properties).length === 0) return;
 	const known = new Set(Object.keys(collection.properties));
 	for (const relation of Object.values(resolveCollectionRelations(collection))) if (relation.localKey) known.add(relation.localKey);
+	for (const field of options?.extraKnownFields ?? []) known.add(field);
 	const unknown = Object.keys(values).filter((key) => !known.has(key));
 	if (unknown.length === 0) return;
 	const where = options?.rowIndex !== void 0 ? `Row ${options.rowIndex}: ` : "";
@@ -4081,9 +4105,13 @@ var RestApiGenerator = class {
 				const body = await parseJsonBody(c);
 				const isAuth = collection.auth;
 				const isAuthCollection = isAuth === true || isAuth && typeof isAuth === "object" && isAuth.enabled === true;
+				const collectionAuthConfig = typeof isAuth === "object" ? isAuth : void 0;
 				if (!isAuthCollection) assertKnownWriteFields(body, resolvedCollection);
+				else {
+					const contract = this.authAdapter?.describeUserCreationContract?.(collectionAuthConfig);
+					if (contract?.validate) assertKnownWriteFields(body, resolvedCollection, { extraKnownFields: contract.extraFields });
+				}
 				if (isAuthCollection && this.authAdapter?.prepareUserCreation) {
-					const collectionAuthConfig = typeof isAuth === "object" ? isAuth : void 0;
 					const prepared = await this.authAdapter.prepareUserCreation(body, collectionAuthConfig);
 					const entity = await driver.save({
 						path,
@@ -10347,7 +10375,7 @@ function createAuthRoutes(config) {
 		oldPassword: string().min(1, "Old password is required").max(128),
 		newPassword: string().min(1, "New password is required").max(128)
 	});
-	const refreshSchema = object({ refreshToken: config.cookieAuth ? string().optional() : string().min(1, "Refresh token is required") });
+	const refreshSchema = object({ refreshToken: string().min(1).optional() });
 	object({ refreshToken: string().optional() });
 	object({
 		displayName: string().max(255).optional(),
@@ -10731,7 +10759,7 @@ function createAuthRoutes(config) {
 	*/
 	router.post("/refresh", async (c) => {
 		const refreshToken = readRefreshToken(c, parseBody(refreshSchema, await c.req.json().catch(() => ({}))), config.cookieAuth);
-		if (!refreshToken) throw ApiError.badRequest("Refresh token is required", "INVALID_INPUT");
+		if (!refreshToken) throw ApiError.unauthenticated("No refresh token presented", "NO_SESSION");
 		const tokenHash = hashRefreshToken(refreshToken);
 		const storedToken = await authRepo.findRefreshTokenByHash(tokenHash);
 		if (!storedToken) {
@@ -11253,6 +11281,16 @@ function createBuiltinAuthAdapter(config) {
 				collectionAuthConfig: collectionAuth ?? collectionAuthConfig
 			});
 		},
+		describeUserCreationContract(collectionAuth) {
+			if ((collectionAuth ?? collectionAuthConfig)?.onCreateUser || resolvedOps.onAdminCreateUser) return {
+				validate: false,
+				extraFields: []
+			};
+			return {
+				validate: true,
+				extraFields: ["password"]
+			};
+		},
 		async finalizeUserCreation(entity, clearPassword) {
 			return finalizeAdminUserCreation(entity, clearPassword, {
 				authRepo: authRepository,