@rebasepro/server 0.9.1-canary.7dddf96 → 0.9.1-canary.a57c262

package/dist/api/rest/write-validation.d.ts

@@ -0,0 +1,19 @@
+import { CollectionConfig } from "@rebasepro/types";
+/**
+ * Reject a write naming a field the collection does not have.
+ *
+ * Unknown keys used to travel all the way into the INSERT, where Postgres
+ * rejected them — so a typo came back as `column "titel" does not exist`,
+ * phrased by the database, from a stack the caller cannot see, and only if the
+ * column really was absent. It is a request problem and belongs in a 400.
+ *
+ * What counts as known:
+ * - a declared property (for an introspected BaaS collection these *are* the
+ *   columns, so the set is exact);
+ * - the foreign-key column behind an owning relation, which callers may write
+ *   directly instead of through the relation property;
+ * - nothing else. `id` in particular is not automatically known — see below.
+ */
+export declare function assertKnownWriteFields(values: Record<string, unknown>, collection: CollectionConfig, options?: {
+    rowIndex?: number;
+}): void;

package/dist/auth/collection-callback-warning.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Warn when the auth collection hangs data callbacks that auth will not fire.
+ *
+ * Creating a user through the auth subsystem — registration, OAuth, the admin
+ * user routes — writes to the user store directly, because that path owns
+ * password hashing, identity rows and its own transaction. It deliberately does
+ * not go through the collection save pipeline: a `beforeSave` able to rewrite
+ * `password_hash` on its way to the database is a footgun, not a feature, and
+ * the auth hooks (`afterUserCreate`, `beforeUserCreate`, …) exist to hang
+ * behaviour off those events with the right contract.
+ *
+ * The cost is a reasonable expectation quietly not being met: someone puts
+ * "send the welcome email" in `afterSave` on their users collection, tests it
+ * by creating a user in the admin, and it works — because *that* is a
+ * collection write. Then a real signup does nothing at all. Which is why this
+ * is said at boot, naming the callbacks that will not run.
+ */
+export declare function warnOnAuthCollectionDataCallbacks(collection?: {
+    slug?: string;
+    callbacks?: Record<string, unknown>;
+}): void;

package/dist/auth/index.d.ts

@@ -28,7 +28,10 @@ export type { AuthModuleConfig, CookieAuthConfig } from "./routes";
 export { mountMagicLinkRoutes } from "./magic-link-routes";
 export { createResetPasswordRoute } from "./reset-password-admin";
 export type { ResetPasswordRouteConfig } from "./reset-password-admin";
-export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter, createApiKeyRateLimiter, apiKeyKeyGenerator } from "./rate-limiter";
+export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter, createApiKeyRateLimiter, createDataRateLimiter, apiKeyKeyGenerator } from "./rate-limiter";
+export type { DataRateLimitConfig } from "./rate-limiter";
+export { MemoryRateLimitStore } from "./rate-limit-store";
+export type { RateLimitStore, RateLimitDecision } from "./rate-limit-store";
 export { createApiKeyStore, createApiKeyRoutes, isApiKeyToken, validateApiKey, httpMethodToOperation, isOperationAllowed } from "./api-keys";
 export type { ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest, ApiKeyStore, ApiKeyOperation } from "./api-keys";
 export { createBuiltinAuthAdapter } from "./builtin-auth-adapter";

package/dist/auth/jwt.d.ts

@@ -38,7 +38,18 @@ export declare function getAccessTokenExpiryMs(): number;
  */
 export declare function getAccessTokenExpiry(): number;
 /**
- * Verify and decode an access token
+ * Verify and decode an access token.
+ *
+ * Every token this server issues is signed with the same secret, so what a
+ * token *is* comes from its claims, not from its signature. A download token
+ * ({@link generateDownloadToken}) is therefore a validly-signed string that
+ * must never authenticate anybody: it is scoped to one file path and handed out
+ * in URLs, which is a far weaker thing to hold than a session.
+ *
+ * Today it is rejected below for want of an id — but only by luck, since
+ * nothing stops a future download token from carrying one. So the purpose is
+ * checked explicitly: a token minted for reading a file is not a token for
+ * being a user.
  */
 export declare function verifyAccessToken(token: string): AccessTokenPayload | null;
 /**

package/dist/auth/middleware.d.ts

@@ -150,6 +150,27 @@ export declare const queryTokenAuth: MiddlewareHandler<HonoEnv>;
  * untouched, so they still require a valid token.
  */
 export declare const publicObjectAuth: MiddlewareHandler<HonoEnv>;
+/**
+ * Helper to match paths for scoped file tokens.
+ * Matches exact paths or prefixes (exact folder prefixes or ending with /).
+ *
+ * The traversal check is defence in depth, not the load-bearing defence.
+ *
+ * A prefix comparison is a lie for any path containing `..`: `user1/../user2/x`
+ * starts with `user1/`, so a token scoped to `user1/` would authorize reading
+ * user2's file — and the storage controller would not object, because its own
+ * guard stops a path escaping the *bucket*, and that one resolves to `user2/x`,
+ * comfortably inside it. The grant is what would be escaped, and this is the
+ * only layer that knows what was granted.
+ *
+ * Nothing arrives here in that shape today: the URL parser resolves `..` (and
+ * `%2e%2e`, which the WHATWG spec treats as a dot for normalization) before
+ * Hono routes the request, so this comparison already runs on a resolved path.
+ * But that is a guarantee of the runtime rather than of this code, and it is
+ * one line to not depend on it. The same rule already guards the public-object
+ * path — see `isPublicStoragePath`.
+ */
+export declare function isPathMatch(requested: string, allowed: string): boolean;
 /**
  * Middleware that authenticates file-serving routes using scoped download tokens.
  * It enforces that only scoped "file-read" tokens can access "/file/*" and "?token=" query params.

package/dist/auth/rate-limit-store.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Where a rate limiter keeps its counts.
+ *
+ * Split out from the limiter itself because the two have different lifetimes:
+ * the policy (how many, how often, keyed by what) is a property of the route,
+ * and the storage is a property of the deployment. One process behind one
+ * proxy is happy with a Map; several replicas behind a load balancer are not,
+ * because a limit of 200 enforced independently by four of them is a limit of
+ * 800.
+ */
+export interface RateLimitDecision {
+    allowed: boolean;
+    /** Requests left in the current window. Zero when `allowed` is false. */
+    remaining: number;
+    /** How long until the oldest hit falls out of the window. */
+    retryAfterMs: number;
+}
+export interface RateLimitStore {
+    /**
+     * Record a hit against `key` and say whether it is allowed.
+     *
+     * Called once per request, so it must not be chatty. Implementations are
+     * expected to be atomic per key: two concurrent hits must not both read a
+     * count of `limit - 1` and both be allowed.
+     */
+    hit(key: string, windowMs: number, limit: number): Promise<RateLimitDecision>;
+    /** Release timers/connections. Tests need this; servers rarely do. */
+    dispose?(): void;
+}
+/**
+ * The default store: a sliding window in this process's memory.
+ *
+ * Sliding rather than fixed: a fixed window lets a caller spend its whole
+ * allowance in the last second of one window and again in the first second of
+ * the next, which is twice the limit over an instant. Timestamps outside the
+ * window are dropped on read, and swept periodically so an idle key does not
+ * pin its array forever.
+ *
+ * Per-process, so N replicas enforce N times the limit between them. That is
+ * the honest reason {@link RateLimitStore} exists.
+ */
+export declare class MemoryRateLimitStore implements RateLimitStore {
+    private store;
+    private cleanupInterval?;
+    constructor(sweepMs?: number);
+    hit(key: string, windowMs: number, limit: number): Promise<RateLimitDecision>;
+    private sweep;
+    dispose(): void;
+}

package/dist/auth/rate-limiter.d.ts

@@ -1,5 +1,12 @@
 import { MiddlewareHandler } from "hono";
 import { HonoEnv } from "../api/types";
+import { RateLimitStore } from "./rate-limit-store";
+/**
+ * Sliding-window rate limiting for Hono.
+ *
+ * The counting lives in a {@link RateLimitStore} — in this process's memory by
+ * default, which is a per-replica limit and says so. See `rate-limit-store.ts`.
+ */
 interface RateLimiterOptions {
     /** Time window in milliseconds (default: 15 minutes) */
     windowMs?: number;
@@ -9,13 +16,22 @@ interface RateLimiterOptions {
     keyGenerator?: (c: Parameters<MiddlewareHandler<HonoEnv>>[0]) => string;
     /** Custom message for rate limit responses */
     message?: string;
+    /**
+     * Where to keep the counts. Defaults to a private in-memory store — pass a
+     * shared one to have several limiters (or several processes) agree.
+     */
+    store?: RateLimitStore;
+    /**
+     * Per-request limit override, for buckets whose allowance is data rather
+     * than config (an API key's own `rate_limit`). Returning `undefined` uses
+     * `limit`; returning `null` skips the limiter for this request.
+     */
+    resolveLimit?: (c: Parameters<MiddlewareHandler<HonoEnv>>[0]) => number | null | undefined;
 }
 /**
  * Create a rate-limiting middleware.
  *
- * Uses a sliding window algorithm: only timestamps within the last
- * `windowMs` milliseconds are counted. Old entries are garbage-collected
- * every `windowMs` to prevent unbounded memory growth.
+ * Uses a sliding window: only hits within the last `windowMs` are counted.
  */
 export declare function createRateLimiter(options?: RateLimiterOptions): MiddlewareHandler<HonoEnv>;
 /**
@@ -36,12 +52,44 @@ export declare const strictAuthLimiter: MiddlewareHandler<HonoEnv>;
  * via an API key.
  */
 export declare function apiKeyKeyGenerator(c: Parameters<MiddlewareHandler<HonoEnv>>[0]): string;
+/** How the data API's limits are apportioned. All fields optional. */
+export interface DataRateLimitConfig {
+    /** Turn the whole thing off — for a deployment whose proxy already does it. */
+    enabled?: boolean;
+    windowMs?: number;
+    /** Fallback for an API key with no `rate_limit` of its own. Default 1000. */
+    apiKey?: number;
+    /** Per signed-in user. Default 1000. */
+    user?: number;
+    /** Per IP, for requests with no principal at all. Default 300. */
+    anonymous?: number;
+    /** Share counts across replicas. Defaults to this process's memory. */
+    store?: RateLimitStore;
+}
+/**
+ * Rate limiting for the data API.
+ *
+ * Every request is in exactly one bucket, resolved most-specific first: an API
+ * key by its id, a signed-in user by their uid, anyone else by IP. Previously
+ * only the first of those was limited at all — the middleware returned early
+ * for any request without an API key — so JWT and anonymous traffic to
+ * `/api/data/*` was unbounded, which is most of the traffic a BaaS gets.
+ *
+ * Per bucket, not per route: the point is to bound what one caller costs, and
+ * they can spend it wherever they like.
+ *
+ * The defaults are deliberately loose. This is a floor against a runaway client
+ * or a naive scraper, not a quota — a deployment that wants real quotas should
+ * set them, and one that already has a proxy doing this should pass
+ * `enabled: false` rather than pay for it twice.
+ */
+export declare function createDataRateLimiter(config?: DataRateLimitConfig): MiddlewareHandler<HonoEnv>;
 /**
  * Create a rate limiter specifically for API key requests.
  *
- * When a request is authenticated via an API key that has a `rate_limit`
- * configured, this limiter enforces per-key limits using the key's ID
- * as the rate limit bucket.
+ * @deprecated Use {@link createDataRateLimiter}, which limits signed-in users
+ * and anonymous callers too. This one skips every request that is not
+ * API-key-authenticated, which was most of them.
  *
  * @param defaultLimit - Fallback limit when the key has no `rate_limit` set.
  * @param windowMs     - Time window in milliseconds (default: 15 minutes).