@rebasepro/server 0.9.1-canary.29ed165 → 0.9.1-canary.437af5f

package/dist/api/errors.d.ts

@@ -9,24 +9,9 @@ export declare class ApiError extends Error {
     readonly statusCode: number;
     readonly code: string;
     readonly details?: unknown;
-    /**
-     * Whether this outcome is a routine part of normal operation rather than
-     * something an operator should look at. Expected errors log at debug; every
-     * other operational error logs at warn.
-     *
-     * The motivating case is `POST /auth/refresh` with no session: clients
-     * refresh on page load before they know whether one exists, so every
-     * anonymous page view is a 401 — correct, and not worth a warning line.
-     */
-    readonly expected: boolean;
-    constructor(statusCode: number, code: string, message: string, details?: unknown, expected?: boolean);
+    constructor(statusCode: number, code: string, message: string, details?: unknown);
     static badRequest(message: string, code?: string, details?: unknown): ApiError;
     static unauthorized(message: string, code?: string): ApiError;
-    /**
-     * A 401 that is a normal outcome, not an incident — logged at debug.
-     * See {@link ApiError.expected}.
-     */
-    static unauthenticated(message: string, code?: string): ApiError;
     static forbidden(message: string, code?: string): ApiError;
     static notFound(message: string, code?: string): ApiError;
     static conflict(message: string, code?: string): ApiError;

package/dist/api/rest/write-validation.d.ts

@@ -12,11 +12,8 @@ import { CollectionConfig } from "@rebasepro/types";
  *   columns, so the set is exact);
  * - the foreign-key column behind an owning relation, which callers may write
  *   directly instead of through the relation property;
- * - anything named in `options.extraKnownFields` — for an auth collection the
- *   credential keys the auth adapter consumes before a row is ever built;
  * - nothing else. `id` in particular is not automatically known — see below.
  */
 export declare function assertKnownWriteFields(values: Record<string, unknown>, collection: CollectionConfig, options?: {
     rowIndex?: number;
-    extraKnownFields?: readonly string[];
 }): void;

package/dist/index.es.js

@@ -3539,23 +3539,12 @@ var ApiError = class ApiError extends Error {
 	statusCode;
 	code;
 	details;
-	/**
-	* Whether this outcome is a routine part of normal operation rather than
-	* something an operator should look at. Expected errors log at debug; every
-	* other operational error logs at warn.
-	*
-	* The motivating case is `POST /auth/refresh` with no session: clients
-	* refresh on page load before they know whether one exists, so every
-	* anonymous page view is a 401 — correct, and not worth a warning line.
-	*/
-	expected;
-	constructor(statusCode, code, message, details, expected = false) {
+	constructor(statusCode, code, message, details) {
 		super(message);
 		this.name = "ApiError";
 		this.statusCode = statusCode;
 		this.code = code;
 		this.details = details;
-		this.expected = expected;
 	}
 	static badRequest(message, code = "BAD_REQUEST", details) {
 		return new ApiError(400, code, message, details);
@@ -3563,13 +3552,6 @@ var ApiError = class ApiError extends Error {
 	static unauthorized(message, code = "UNAUTHORIZED") {
 		return new ApiError(401, code, message);
 	}
-	/**
-	* A 401 that is a normal outcome, not an incident — logged at debug.
-	* See {@link ApiError.expected}.
-	*/
-	static unauthenticated(message, code = "UNAUTHORIZED") {
-		return new ApiError(401, code, message, void 0, true);
-	}
 	static forbidden(message, code = "FORBIDDEN") {
 		return new ApiError(403, code, message);
 	}
@@ -3602,10 +3584,7 @@ var errorHandler = (err, c) => {
 	const error = err;
 	const reqId = typeof c.get === "function" ? c.get("requestId") : void 0;
 	if (error instanceof ApiError || error.name === "ApiError") {
-		const expected = error instanceof ApiError && error.expected;
-		const line = `[API] ${c.req.method} ${c.req.path} → ${error.statusCode} ${error.code}: ${error.message}` + (reqId ? ` [${reqId}]` : "");
-		if (expected) logger.debug(line);
-		else logger.warn(`⚠️ ${line}`);
+		logger.warn(`⚠️ [API] ${c.req.method} ${c.req.path} → ${error.statusCode} ${error.code}: ${error.message}` + (reqId ? ` [${reqId}]` : ""));
 		return c.json({ error: {
 			message: error.message,
 			code: error.code || "INTERNAL_ERROR",
@@ -3847,8 +3826,6 @@ function parseQueryOptions(query) {
 *   columns, so the set is exact);
 * - the foreign-key column behind an owning relation, which callers may write
 *   directly instead of through the relation property;
-* - anything named in `options.extraKnownFields` — for an auth collection the
-*   credential keys the auth adapter consumes before a row is ever built;
 * - nothing else. `id` in particular is not automatically known — see below.
 */
 function assertKnownWriteFields(values, collection, options) {
@@ -3856,7 +3833,6 @@ function assertKnownWriteFields(values, collection, options) {
 	if (!collection.properties || Object.keys(collection.properties).length === 0) return;
 	const known = new Set(Object.keys(collection.properties));
 	for (const relation of Object.values(resolveCollectionRelations(collection))) if (relation.localKey) known.add(relation.localKey);
-	for (const field of options?.extraKnownFields ?? []) known.add(field);
 	const unknown = Object.keys(values).filter((key) => !known.has(key));
 	if (unknown.length === 0) return;
 	const where = options?.rowIndex !== void 0 ? `Row ${options.rowIndex}: ` : "";
@@ -4105,13 +4081,9 @@ var RestApiGenerator = class {
 				const body = await parseJsonBody(c);
 				const isAuth = collection.auth;
 				const isAuthCollection = isAuth === true || isAuth && typeof isAuth === "object" && isAuth.enabled === true;
-				const collectionAuthConfig = typeof isAuth === "object" ? isAuth : void 0;
 				if (!isAuthCollection) assertKnownWriteFields(body, resolvedCollection);
-				else {
-					const contract = this.authAdapter?.describeUserCreationContract?.(collectionAuthConfig);
-					if (contract?.validate) assertKnownWriteFields(body, resolvedCollection, { extraKnownFields: contract.extraFields });
-				}
 				if (isAuthCollection && this.authAdapter?.prepareUserCreation) {
+					const collectionAuthConfig = typeof isAuth === "object" ? isAuth : void 0;
 					const prepared = await this.authAdapter.prepareUserCreation(body, collectionAuthConfig);
 					const entity = await driver.save({
 						path,
@@ -10375,7 +10347,7 @@ function createAuthRoutes(config) {
 		oldPassword: string().min(1, "Old password is required").max(128),
 		newPassword: string().min(1, "New password is required").max(128)
 	});
-	const refreshSchema = object({ refreshToken: string().min(1).optional() });
+	const refreshSchema = object({ refreshToken: config.cookieAuth ? string().optional() : string().min(1, "Refresh token is required") });
 	object({ refreshToken: string().optional() });
 	object({
 		displayName: string().max(255).optional(),
@@ -10759,7 +10731,7 @@ function createAuthRoutes(config) {
 	*/
 	router.post("/refresh", async (c) => {
 		const refreshToken = readRefreshToken(c, parseBody(refreshSchema, await c.req.json().catch(() => ({}))), config.cookieAuth);
-		if (!refreshToken) throw ApiError.unauthenticated("No refresh token presented", "NO_SESSION");
+		if (!refreshToken) throw ApiError.badRequest("Refresh token is required", "INVALID_INPUT");
 		const tokenHash = hashRefreshToken(refreshToken);
 		const storedToken = await authRepo.findRefreshTokenByHash(tokenHash);
 		if (!storedToken) {
@@ -11281,16 +11253,6 @@ function createBuiltinAuthAdapter(config) {
 				collectionAuthConfig: collectionAuth ?? collectionAuthConfig
 			});
 		},
-		describeUserCreationContract(collectionAuth) {
-			if ((collectionAuth ?? collectionAuthConfig)?.onCreateUser || resolvedOps.onAdminCreateUser) return {
-				validate: false,
-				extraFields: []
-			};
-			return {
-				validate: true,
-				extraFields: ["password"]
-			};
-		},
 		async finalizeUserCreation(entity, clearPassword) {
 			return finalizeAdminUserCreation(entity, clearPassword, {
 				authRepo: authRepository,