@rebasepro/server 0.9.1-canary.f2f61da → 0.9.1-canary.faee831

package/dist/init.d.ts

@@ -287,6 +287,27 @@ export interface RebaseBackendConfig {
      * external storage) that the backend does not proxy.
      */
     storageSources?: import("@rebasepro/types").StorageSourceDefinition[];
+    /**
+     * Per-object access control for storage — the analogue of a collection's
+     * security rules, and the thing `requireAuth` / `publicRead` cannot
+     * express because they are global switches.
+     *
+     * Called after authentication on every storage route with the key, bucket,
+     * operation (`read` / `write` / `delete` / `list`) and resolved user.
+     * Return false to deny with a 403; throwing denies too.
+     *
+     * ```ts
+     * storageAuthorize: async ({ key, user, operation }) => {
+     *     if (!user) return false;
+     *     const [ownerId] = key.split("/");
+     *     return ownerId === user.userId || operation === "read";
+     * }
+     * ```
+     *
+     * Without it, any authenticated caller may read any key they can name, so
+     * multi-tenant apps should treat this as required rather than optional.
+     */
+    storageAuthorize?: import("./storage/types").StorageAuthorize;
     /**
      * Entity history / audit-log configuration.
      *

package/dist/{jwt-BJzQOa8a.js → jwt-B3zjddCa.js}

@@ -4218,10 +4218,10 @@ function configureJwt(config) {
 /**
 * Generate an access token (short-lived, 1 hour by default)
 */
-function generateAccessToken(userId, roles, aal = "aal1", customClaims) {
+function generateAccessToken(uid, roles, aal = "aal1", customClaims) {
 	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
 	const payload = {
-		userId,
+		uid,
 		roles,
 		aal,
 		...customClaims
@@ -4274,14 +4274,14 @@ function verifyAccessToken(token) {
 			logger.error("[JWT] Verification failed: a purpose-scoped token is not an access token", { purpose: decoded.purpose });
 			return null;
 		}
-		const id = decoded.userId || decoded.uid || decoded.sub;
+		const id = decoded.uid || decoded.userId || decoded.sub;
 		if (!id) {
 			logger.error("[JWT] Verification failed: missing id in payload", { detail: decoded });
 			return null;
 		}
 		const aal = decoded.aal === "aal1" || decoded.aal === "aal2" ? decoded.aal : "aal1";
 		return {
-			userId: id,
+			uid: id,
 			roles: decoded.roles || [],
 			aal
 		};
@@ -4365,4 +4365,4 @@ function verifyDownloadToken(token) {
 //#endregion
 export { getAccessTokenExpiry as a, jwt_exports as c, require_jsonwebtoken as d, __commonJSMin as f, __toESM as h, generateRefreshToken as i, verifyAccessToken as l, __require as m, generateAccessToken as n, getRefreshTokenExpiry as o, __exportAll as p, generateDownloadToken as r, hashRefreshToken as s, configureJwt as t, verifyDownloadToken as u };
 
-//# sourceMappingURL=jwt-BJzQOa8a.js.map
+//# sourceMappingURL=jwt-B3zjddCa.js.map