@rebasepro/server 0.9.1-canary.f2f61da → 0.9.1-canary.fd3754b

package/dist/api/rest/api-generator.d.ts

@@ -5,15 +5,12 @@ import { HonoEnv } from "../types";
  * Lightweight REST API generator that leverages existing Rebase DataDriver.
  * Supports `include` query parameter for eager-loading relations via Drizzle.
  */
-/** Rows accepted by a single POST /<collection>/bulk. See `maxBulkRows`. */
-export declare const DEFAULT_MAX_BULK_ROWS = 1000;
 export declare class RestApiGenerator {
     private collections;
     private router;
     private driver;
-    private maxBulkRows;
     private authAdapter?;
-    constructor(collections: CollectionConfig[], driver: DataDriver, authAdapter?: AuthAdapter, maxBulkRows?: number);
+    constructor(collections: CollectionConfig[], driver: DataDriver, authAdapter?: AuthAdapter);
     /**
      * Generate REST routes using existing DataDriver
      */
@@ -24,15 +21,6 @@ export declare class RestApiGenerator {
      * No-ops if the request is not authenticated via an API key.
      */
     private enforceApiKeyPermission;
-    /**
-     * API key permission check for nested paths. The operation targets the
-     * LAST collection in the path (e.g. "posts" for /authors/1/posts), so
-     * that is the slug the key must hold permission for — checking the
-     * parent instead would let a key scoped to "authors" write "posts".
-     * `parseSubPath` always yields a collectionPath ending in a collection
-     * slug, never an id.
-     */
-    private enforceSubcollectionApiKeyPermission;
     /**
      * Get the request-scoped driver. Throws if none is set — never falls
      * back to the unscoped `this.driver` to avoid bypassing RLS/auth.

package/dist/auth/api-keys/api-key-middleware.d.ts

@@ -10,18 +10,9 @@
  * 4. Sets `c.set("user", ...)` and `c.set("apiKey", ...)` for downstream use
  * 5. Scopes the DataDriver via `withAuth()` using the API key's service identity
  *
- * Authorization is double-gated for API keys: the key's own permission list
- * (checked by the REST generator) is one ceiling, and Postgres RLS is another,
- * independent one — `withAuth()` runs API-key requests as the restricted
- * `rebase_user` role like any other caller. An `admin` key passes RLS via the
- * injected `default_admin` policies; a non-admin key (roles `["service"]`,
- * uid `api-key:<id>`) only sees rows that a policy explicitly grants to the
- * `service` role or to the public. Owner-style policies
- * (`owner_id = auth.uid()`) never match an API key's synthetic uid.
- *
  * @module
  */
-import type { Context, MiddlewareHandler } from "hono";
+import type { Context } from "hono";
 import type { DataDriver } from "@rebasepro/types";
 import type { HonoEnv } from "../../api/types";
 import type { ApiKeyStore } from "./api-key-store";
@@ -46,53 +37,3 @@ export interface ApiKeyAuthOptions {
  * `createAuthMiddleware()` when a `rk_` prefixed token is detected.
  */
 export declare function validateApiKey(c: Context<HonoEnv>, token: string, options: ApiKeyAuthOptions): Promise<Response | true>;
-/**
- * Permission guard for API-key requests to the storage router.
- *
- * Storage previously did not accept API keys at all (`rk_` tokens were
- * misparsed as JWTs and 401'd). Now that the pre-auth middleware
- * authenticates them, this guard decides what they may do: the key needs a
- * `"storage"` permission entry (or the global `"*"` wildcard) covering the
- * operation derived from the HTTP method. Requests not authenticated via an
- * API key pass through to the storage router's own auth gates.
- *
- * TUS resumable-upload routes (`/tus`, `/tus/:id`) are classified as `write`
- * for EVERY method: the protocol's offset check is a GET and its cancel is a
- * DELETE, but both are steps of an upload — a write-scoped key must be able
- * to complete (and abort) its own resumable upload without also holding
- * `read`/`delete` on stored objects.
- */
-export declare function createStorageApiKeyGuard(): MiddlewareHandler<HonoEnv>;
-/**
- * Permission guard for API-key requests to the custom-functions router.
- *
- * The collection permission guard lives in the REST generator and never sees
- * function routes, so before this middleware existed ANY valid API key —
- * however narrowly scoped — could invoke every custom function. This guard
- * closes that: API-key requests must hold a `"functions"`/`"functions/<name>"`
- * permission entry (or the global `"*"` wildcard) for the derived operation.
- *
- * Non-API-key requests (JWT, service key, anonymous) pass through untouched —
- * functions decide their own auth for those, as before.
- *
- * @param mountPrefix - The path the functions router is mounted at
- *                      (e.g. `/api/functions`), used to extract the function
- *                      name from the request path.
- */
-export declare function createFunctionApiKeyGuard(mountPrefix: string): MiddlewareHandler<HonoEnv>;
-/**
- * Standalone pre-auth middleware for `rk_` bearer tokens.
- *
- * Routers whose auth gate is JWT-based (`requireAuth` / `createRequireAuth` —
- * the admin surfaces: admin users/roles, api-keys management, cron, backups,
- * logs, schema editor) don't know about API keys. Mounting this middleware in
- * front of them authenticates `rk_` tokens and populates the request context;
- * the downstream gates then see the already-resolved user and apply their
- * role checks (`requireAdmin`) as usual — so an `admin: true` key passes and
- * a non-admin key is rejected with 403.
- *
- * Requests without an `rk_` bearer token pass through untouched. An invalid,
- * revoked, or expired `rk_` token is rejected here (401) rather than falling
- * through to be misparsed as a JWT.
- */
-export declare function createApiKeyPreAuth(options: ApiKeyAuthOptions): MiddlewareHandler<HonoEnv>;

package/dist/auth/api-keys/api-key-permission-guard.d.ts

@@ -30,36 +30,3 @@ export declare function httpMethodToOperation(method: string): ApiKeyOperation;
  * @returns `true` if the operation is permitted.
  */
 export declare function isOperationAllowed(permissions: ApiKeyPermission[], collection: string, operation: ApiKeyOperation): boolean;
-/**
- * Check whether the given permissions array allows a storage operation.
- *
- * Storage, like functions, lives outside the collection namespace: an entry
- * with collection `"storage"` grants storage access for the listed
- * operations (GET routes → `read`, upload/folder/tus → `write`,
- * DELETE routes → `delete`), and the global `"*"` wildcard also matches.
- * A collection-scoped key gets no storage access at all.
- *
- * Matching is exactly {@link isOperationAllowed} with `"storage"` as the
- * resource name — delegated so the semantics can never drift.
- */
-export declare function isStorageAllowed(permissions: ApiKeyPermission[], operation: ApiKeyOperation): boolean;
-/**
- * Check whether the given permissions array allows invoking a custom function.
- *
- * Functions live outside the collection namespace, so they have their own
- * resource names in the permission list:
- *
- * - `{ collection: "functions", ... }` grants every function
- * - `{ collection: "functions/<name>", ... }` grants a single function
- * - the global `"*"` wildcard (full-access keys) also matches
- *
- * The operation is derived from the HTTP method as usual (GET → read,
- * POST/PUT/PATCH → write, DELETE → delete). The functions index route is
- * checked as `functionName === ""`, which only the `"functions"` and `"*"`
- * entries can grant.
- *
- * A collection-scoped key (e.g. read-only on `events`) therefore can NOT
- * invoke functions — before this guard existed, any valid key could call
- * every function.
- */
-export declare function isFunctionAllowed(permissions: ApiKeyPermission[], functionName: string, operation: ApiKeyOperation): boolean;

package/dist/auth/api-keys/api-key-types.d.ts

@@ -10,13 +10,10 @@
 /**
  * A single permission entry scoping an API key to a collection and set of operations.
  *
- * Use `"*"` as the collection value to grant access to all collections
- * (and all custom functions). Custom functions are addressed with the
- * `functions` namespace: `"functions"` grants every function,
- * `"functions/<name>"` grants a single one.
+ * Use `"*"` as the collection value to grant access to all collections.
  */
 export interface ApiKeyPermission {
-    /** Collection slug, `"functions"`/`"functions/<name>"`, or `"*"` for everything. */
+    /** Collection slug, or `"*"` for all collections. */
     collection: string;
     /** Allowed operations on the collection. */
     operations: ("read" | "write" | "delete")[];
@@ -33,19 +30,9 @@ export interface ApiKey {
     /** SHA-256 hash of the full plaintext key. */
     key_hash: string;
     permissions: ApiKeyPermission[];
-    /**
-     * When true, the key is granted the `admin` role: it passes the
-     * admin-gated routes (users, roles, cron, backups, logs, API keys) and
-     * the RLS `default_admin` policies. Non-admin keys carry only the
-     * `service` role — RLS grants them nothing unless a collection policy
-     * explicitly names that role.
-     */
+    /** When true, the key is granted the `admin` role (access to admin routes). */
     admin: boolean;
-    /**
-     * Requests per 15-minute window. `null` means "no per-key override" —
-     * the data rate limiter then applies its default API-key limit
-     * (1000/window unless configured otherwise), not unlimited.
-     */
+    /** Requests per 15-minute window. `null` means unlimited. */
     rate_limit: number | null;
     created_by: string;
     created_at: string;
@@ -63,7 +50,7 @@ export interface ApiKeyMasked {
     name: string;
     key_prefix: string;
     permissions: ApiKeyPermission[];
-    /** When true, the key is granted the `admin` role (admin routes + RLS `default_admin` policies). */
+    /** When true, the key is granted the `admin` role (access to admin routes). */
     admin: boolean;
     rate_limit: number | null;
     created_by: string;
@@ -79,9 +66,9 @@ export interface ApiKeyMasked {
 export interface CreateApiKeyRequest {
     name: string;
     permissions: ApiKeyPermission[];
-    /** When true, grants the `admin` role (admin routes + RLS `default_admin` policies). */
+    /** When true, grants the `admin` role — allows access to admin routes. */
     admin?: boolean;
-    /** Requests per 15-minute window. Omit or `null` to use the server default (1000/window). */
+    /** Requests per 15-minute window. Omit or `null` for unlimited. */
     rate_limit?: number | null;
     /** ISO-8601 expiration timestamp. Omit for no expiration. */
     expires_at?: string | null;
@@ -93,7 +80,7 @@ export interface CreateApiKeyRequest {
 export interface UpdateApiKeyRequest {
     name?: string;
     permissions?: ApiKeyPermission[];
-    /** When true, grants the `admin` role (admin routes + RLS `default_admin` policies). */
+    /** When true, grants the `admin` role — allows access to admin routes. */
     admin?: boolean;
     rate_limit?: number | null;
     expires_at?: string | null;

package/dist/auth/api-keys/index.d.ts

@@ -9,9 +9,9 @@
 export type { ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest } from "./api-key-types";
 export { createApiKeyStore } from "./api-key-store";
 export type { ApiKeyStore } from "./api-key-store";
-export { isApiKeyToken, validateApiKey, createApiKeyPreAuth, createFunctionApiKeyGuard, createStorageApiKeyGuard } from "./api-key-middleware";
+export { isApiKeyToken, validateApiKey } from "./api-key-middleware";
 export type { ApiKeyAuthOptions } from "./api-key-middleware";
-export { httpMethodToOperation, isOperationAllowed, isFunctionAllowed, isStorageAllowed } from "./api-key-permission-guard";
+export { httpMethodToOperation, isOperationAllowed } from "./api-key-permission-guard";
 export type { ApiKeyOperation } from "./api-key-permission-guard";
 export { createApiKeyRoutes } from "./api-key-routes";
 export type { ApiKeyRouteOptions } from "./api-key-routes";

package/dist/auth/index.d.ts

@@ -28,10 +28,7 @@ export type { AuthModuleConfig, CookieAuthConfig } from "./routes";
 export { mountMagicLinkRoutes } from "./magic-link-routes";
 export { createResetPasswordRoute } from "./reset-password-admin";
 export type { ResetPasswordRouteConfig } from "./reset-password-admin";
-export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter, createApiKeyRateLimiter, createDataRateLimiter, apiKeyKeyGenerator } from "./rate-limiter";
-export type { DataRateLimitConfig } from "./rate-limiter";
-export { MemoryRateLimitStore } from "./rate-limit-store";
-export type { RateLimitStore, RateLimitDecision } from "./rate-limit-store";
+export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter, createApiKeyRateLimiter, apiKeyKeyGenerator } from "./rate-limiter";
 export { createApiKeyStore, createApiKeyRoutes, isApiKeyToken, validateApiKey, httpMethodToOperation, isOperationAllowed } from "./api-keys";
 export type { ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest, ApiKeyStore, ApiKeyOperation } from "./api-keys";
 export { createBuiltinAuthAdapter } from "./builtin-auth-adapter";

package/dist/auth/jwt.d.ts

@@ -38,18 +38,7 @@ export declare function getAccessTokenExpiryMs(): number;
  */
 export declare function getAccessTokenExpiry(): number;
 /**
- * Verify and decode an access token.
- *
- * Every token this server issues is signed with the same secret, so what a
- * token *is* comes from its claims, not from its signature. A download token
- * ({@link generateDownloadToken}) is therefore a validly-signed string that
- * must never authenticate anybody: it is scoped to one file path and handed out
- * in URLs, which is a far weaker thing to hold than a session.
- *
- * Today it is rejected below for want of an id — but only by luck, since
- * nothing stops a future download token from carrying one. So the purpose is
- * checked explicitly: a token minted for reading a file is not a token for
- * being a user.
+ * Verify and decode an access token
  */
 export declare function verifyAccessToken(token: string): AccessTokenPayload | null;
 /**

package/dist/auth/middleware.d.ts

@@ -150,27 +150,6 @@ export declare const queryTokenAuth: MiddlewareHandler<HonoEnv>;
  * untouched, so they still require a valid token.
  */
 export declare const publicObjectAuth: MiddlewareHandler<HonoEnv>;
-/**
- * Helper to match paths for scoped file tokens.
- * Matches exact paths or prefixes (exact folder prefixes or ending with /).
- *
- * The traversal check is defence in depth, not the load-bearing defence.
- *
- * A prefix comparison is a lie for any path containing `..`: `user1/../user2/x`
- * starts with `user1/`, so a token scoped to `user1/` would authorize reading
- * user2's file — and the storage controller would not object, because its own
- * guard stops a path escaping the *bucket*, and that one resolves to `user2/x`,
- * comfortably inside it. The grant is what would be escaped, and this is the
- * only layer that knows what was granted.
- *
- * Nothing arrives here in that shape today: the URL parser resolves `..` (and
- * `%2e%2e`, which the WHATWG spec treats as a dot for normalization) before
- * Hono routes the request, so this comparison already runs on a resolved path.
- * But that is a guarantee of the runtime rather than of this code, and it is
- * one line to not depend on it. The same rule already guards the public-object
- * path — see `isPublicStoragePath`.
- */
-export declare function isPathMatch(requested: string, allowed: string): boolean;
 /**
  * Middleware that authenticates file-serving routes using scoped download tokens.
  * It enforces that only scoped "file-read" tokens can access "/file/*" and "?token=" query params.

package/dist/auth/rate-limiter.d.ts

@@ -1,12 +1,5 @@
 import { MiddlewareHandler } from "hono";
 import { HonoEnv } from "../api/types";
-import { RateLimitStore } from "./rate-limit-store";
-/**
- * Sliding-window rate limiting for Hono.
- *
- * The counting lives in a {@link RateLimitStore} — in this process's memory by
- * default, which is a per-replica limit and says so. See `rate-limit-store.ts`.
- */
 interface RateLimiterOptions {
     /** Time window in milliseconds (default: 15 minutes) */
     windowMs?: number;
@@ -16,32 +9,13 @@ interface RateLimiterOptions {
     keyGenerator?: (c: Parameters<MiddlewareHandler<HonoEnv>>[0]) => string;
     /** Custom message for rate limit responses */
     message?: string;
-    /**
-     * Where to keep the counts. Defaults to a private in-memory store — pass a
-     * shared one to have several limiters (or several processes) agree.
-     */
-    store?: RateLimitStore;
-    /**
-     * Per-request limit override, for buckets whose allowance is data rather
-     * than config (an API key's own `rate_limit`). Returning `undefined` uses
-     * `limit`; returning `null` skips the limiter for this request.
-     */
-    resolveLimit?: (c: Parameters<MiddlewareHandler<HonoEnv>>[0]) => number | null | undefined;
-    /**
-     * Number of trusted reverse-proxy hops in front of this server. Each hop
-     * appends the address it saw to `X-Forwarded-For`, so the real client IP is
-     * the Nth entry from the right. Anything further left is client-supplied and
-     * ignored — which is what stops a caller spoofing `X-Forwarded-For` to
-     * rotate rate-limit keys. Defaults to `TRUSTED_PROXY_HOPS` (env) or `1`.
-     * Set to `0` when the server is exposed directly (no proxy): `X-Forwarded-For`
-     * is then ignored entirely in favour of `X-Real-IP`.
-     */
-    trustedProxyHops?: number;
 }
 /**
  * Create a rate-limiting middleware.
  *
- * Uses a sliding window: only hits within the last `windowMs` are counted.
+ * Uses a sliding window algorithm: only timestamps within the last
+ * `windowMs` milliseconds are counted. Old entries are garbage-collected
+ * every `windowMs` to prevent unbounded memory growth.
  */
 export declare function createRateLimiter(options?: RateLimiterOptions): MiddlewareHandler<HonoEnv>;
 /**
@@ -62,48 +36,12 @@ export declare const strictAuthLimiter: MiddlewareHandler<HonoEnv>;
  * via an API key.
  */
 export declare function apiKeyKeyGenerator(c: Parameters<MiddlewareHandler<HonoEnv>>[0]): string;
-/** How the data API's limits are apportioned. All fields optional. */
-export interface DataRateLimitConfig {
-    /** Turn the whole thing off — for a deployment whose proxy already does it. */
-    enabled?: boolean;
-    windowMs?: number;
-    /** Fallback for an API key with no `rate_limit` of its own. Default 1000. */
-    apiKey?: number;
-    /** Per signed-in user. Default 1000. */
-    user?: number;
-    /**
-     * Per IP, for requests with no principal at all. Default 300.
-     * `null` disables the anonymous bucket entirely — used for routers whose
-     * anonymous traffic must not be throttled (public webhook functions).
-     */
-    anonymous?: number | null;
-    /** Share counts across replicas. Defaults to this process's memory. */
-    store?: RateLimitStore;
-}
-/**
- * Rate limiting for the data API.
- *
- * Every request is in exactly one bucket, resolved most-specific first: an API
- * key by its id, a signed-in user by their uid, anyone else by IP. Previously
- * only the first of those was limited at all — the middleware returned early
- * for any request without an API key — so JWT and anonymous traffic to
- * `/api/data/*` was unbounded, which is most of the traffic a BaaS gets.
- *
- * Per bucket, not per route: the point is to bound what one caller costs, and
- * they can spend it wherever they like.
- *
- * The defaults are deliberately loose. This is a floor against a runaway client
- * or a naive scraper, not a quota — a deployment that wants real quotas should
- * set them, and one that already has a proxy doing this should pass
- * `enabled: false` rather than pay for it twice.
- */
-export declare function createDataRateLimiter(config?: DataRateLimitConfig): MiddlewareHandler<HonoEnv>;
 /**
  * Create a rate limiter specifically for API key requests.
  *
- * @deprecated Use {@link createDataRateLimiter}, which limits signed-in users
- * and anonymous callers too. This one skips every request that is not
- * API-key-authenticated, which was most of them.
+ * When a request is authenticated via an API key that has a `rate_limit`
+ * configured, this limiter enforces per-key limits using the key's ID
+ * as the rate limit bucket.
  *
  * @param defaultLimit - Fallback limit when the key has no `rate_limit` set.
  * @param windowMs     - Time window in milliseconds (default: 15 minutes).

package/dist/env.d.ts

@@ -42,7 +42,6 @@ declare const rebaseEnvSchema: z.ZodObject<{
     STORAGE_TYPE: z.ZodDefault<z.ZodEnum<{
         local: "local";
         s3: "s3";
-        gcs: "gcs";
     }>>;
     STORAGE_PATH: z.ZodOptional<z.ZodString>;
     S3_BUCKET: z.ZodOptional<z.ZodString>;

package/dist/index.d.ts

@@ -7,7 +7,7 @@
  * by specialized driver packages like `@rebasepro/server-postgres`.
  */
 export { initializeRebaseBackend, isAuthAdapter, isDatabaseAdapter } from "./init";
-export type { RebaseBackendConfig, RebaseBackendInstance, RebaseAuthConfig, BaasOptions } from "./init";
+export type { RebaseBackendConfig, RebaseBackendInstance, RebaseAuthConfig } from "./init";
 export { rebase, _setRebaseMock, _resetRebaseMock } from "./singleton";
 export { loadCollectionsFromDirectory, applyCollectionDefaults, type CollectionDefaults } from "./collections/loader";
 export * from "./db/interfaces";