@rebasepro/server 0.9.1-canary.fd3754b → 0.10.0

package/dist/auth/mfa-routes.d.ts

@@ -4,4 +4,4 @@ import { HonoEnv } from "../api/types";
 import type { AuthModuleConfig } from "./routes";
 import { resolveAuthHooks } from "./auth-hooks";
 import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
-export declare function mountMfaRoutes(router: Hono<HonoEnv>, config: AuthModuleConfig, ops: ReturnType<typeof resolveAuthHooks>, parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T, applyTransformHook?: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, userId: string) => Promise<AuthResponsePayload>): void;
+export declare function mountMfaRoutes(router: Hono<HonoEnv>, config: AuthModuleConfig, ops: ReturnType<typeof resolveAuthHooks>, parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T, applyTransformHook?: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, uid: string) => Promise<AuthResponsePayload>): void;

package/dist/auth/middleware.d.ts

@@ -1,17 +1,17 @@
 import { MiddlewareHandler, Context } from "hono";
 import { DataDriver } from "@rebasepro/types";
 import { AccessTokenPayload } from "./jwt";
-import { HonoEnv } from "../api/types";
+import type { HonoEnv } from "../api/types";
 import type { ApiKeyStore } from "./api-keys/api-key-store";
 /**
  * Result from a custom auth validator.
  * - `false`/`null`/`undefined` = not authenticated
  * - `true` = authenticated as default user
- * - object with `userId` or `uid` = authenticated with user info
+ * - object with `uid` (or legacy `userId`) = authenticated with user info
  */
 export type AuthResult = boolean | null | undefined | {
-    userId?: string;
     uid?: string;
+    userId?: string;
     roles?: string[];
     [key: string]: unknown;
 };
@@ -150,6 +150,27 @@ export declare const queryTokenAuth: MiddlewareHandler<HonoEnv>;
  * untouched, so they still require a valid token.
  */
 export declare const publicObjectAuth: MiddlewareHandler<HonoEnv>;
+/**
+ * Helper to match paths for scoped file tokens.
+ * Matches exact paths or prefixes (exact folder prefixes or ending with /).
+ *
+ * The traversal check is defence in depth, not the load-bearing defence.
+ *
+ * A prefix comparison is a lie for any path containing `..`: `user1/../user2/x`
+ * starts with `user1/`, so a token scoped to `user1/` would authorize reading
+ * user2's file — and the storage controller would not object, because its own
+ * guard stops a path escaping the *bucket*, and that one resolves to `user2/x`,
+ * comfortably inside it. The grant is what would be escaped, and this is the
+ * only layer that knows what was granted.
+ *
+ * Nothing arrives here in that shape today: the URL parser resolves `..` (and
+ * `%2e%2e`, which the WHATWG spec treats as a dot for normalization) before
+ * Hono routes the request, so this comparison already runs on a resolved path.
+ * But that is a guarantee of the runtime rather than of this code, and it is
+ * one line to not depend on it. The same rule already guards the public-object
+ * path — see `isPublicStoragePath`.
+ */
+export declare function isPathMatch(requested: string, allowed: string): boolean;
 /**
  * Middleware that authenticates file-serving routes using scoped download tokens.
  * It enforces that only scoped "file-read" tokens can access "/file/*" and "?token=" query params.

package/dist/auth/rate-limit-store.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Where a rate limiter keeps its counts.
+ *
+ * Split out from the limiter itself because the two have different lifetimes:
+ * the policy (how many, how often, keyed by what) is a property of the route,
+ * and the storage is a property of the deployment. One process behind one
+ * proxy is happy with a Map; several replicas behind a load balancer are not,
+ * because a limit of 200 enforced independently by four of them is a limit of
+ * 800.
+ */
+export interface RateLimitDecision {
+    allowed: boolean;
+    /** Requests left in the current window. Zero when `allowed` is false. */
+    remaining: number;
+    /** How long until the oldest hit falls out of the window. */
+    retryAfterMs: number;
+}
+export interface RateLimitStore {
+    /**
+     * Record a hit against `key` and say whether it is allowed.
+     *
+     * Called once per request, so it must not be chatty. Implementations are
+     * expected to be atomic per key: two concurrent hits must not both read a
+     * count of `limit - 1` and both be allowed.
+     */
+    hit(key: string, windowMs: number, limit: number): Promise<RateLimitDecision>;
+    /** Release timers/connections. Tests need this; servers rarely do. */
+    dispose?(): void;
+}
+/**
+ * The default store: a sliding window in this process's memory.
+ *
+ * Sliding rather than fixed: a fixed window lets a caller spend its whole
+ * allowance in the last second of one window and again in the first second of
+ * the next, which is twice the limit over an instant. Timestamps outside the
+ * window are dropped on read, and swept periodically so an idle key does not
+ * pin its array forever.
+ *
+ * Per-process, so N replicas enforce N times the limit between them. That is
+ * the honest reason {@link RateLimitStore} exists.
+ */
+export declare class MemoryRateLimitStore implements RateLimitStore {
+    private store;
+    private cleanupInterval?;
+    constructor(sweepMs?: number);
+    hit(key: string, windowMs: number, limit: number): Promise<RateLimitDecision>;
+    private sweep;
+    dispose(): void;
+}

package/dist/auth/rate-limiter.d.ts

@@ -1,5 +1,12 @@
 import { MiddlewareHandler } from "hono";
 import { HonoEnv } from "../api/types";
+import { RateLimitStore } from "./rate-limit-store";
+/**
+ * Sliding-window rate limiting for Hono.
+ *
+ * The counting lives in a {@link RateLimitStore} — in this process's memory by
+ * default, which is a per-replica limit and says so. See `rate-limit-store.ts`.
+ */
 interface RateLimiterOptions {
     /** Time window in milliseconds (default: 15 minutes) */
     windowMs?: number;
@@ -9,13 +16,32 @@ interface RateLimiterOptions {
     keyGenerator?: (c: Parameters<MiddlewareHandler<HonoEnv>>[0]) => string;
     /** Custom message for rate limit responses */
     message?: string;
+    /**
+     * Where to keep the counts. Defaults to a private in-memory store — pass a
+     * shared one to have several limiters (or several processes) agree.
+     */
+    store?: RateLimitStore;
+    /**
+     * Per-request limit override, for buckets whose allowance is data rather
+     * than config (an API key's own `rate_limit`). Returning `undefined` uses
+     * `limit`; returning `null` skips the limiter for this request.
+     */
+    resolveLimit?: (c: Parameters<MiddlewareHandler<HonoEnv>>[0]) => number | null | undefined;
+    /**
+     * Number of trusted reverse-proxy hops in front of this server. Each hop
+     * appends the address it saw to `X-Forwarded-For`, so the real client IP is
+     * the Nth entry from the right. Anything further left is client-supplied and
+     * ignored — which is what stops a caller spoofing `X-Forwarded-For` to
+     * rotate rate-limit keys. Defaults to `TRUSTED_PROXY_HOPS` (env) or `1`.
+     * Set to `0` when the server is exposed directly (no proxy): `X-Forwarded-For`
+     * is then ignored entirely in favour of `X-Real-IP`.
+     */
+    trustedProxyHops?: number;
 }
 /**
  * Create a rate-limiting middleware.
  *
- * Uses a sliding window algorithm: only timestamps within the last
- * `windowMs` milliseconds are counted. Old entries are garbage-collected
- * every `windowMs` to prevent unbounded memory growth.
+ * Uses a sliding window: only hits within the last `windowMs` are counted.
  */
 export declare function createRateLimiter(options?: RateLimiterOptions): MiddlewareHandler<HonoEnv>;
 /**
@@ -36,12 +62,48 @@ export declare const strictAuthLimiter: MiddlewareHandler<HonoEnv>;
  * via an API key.
  */
 export declare function apiKeyKeyGenerator(c: Parameters<MiddlewareHandler<HonoEnv>>[0]): string;
+/** How the data API's limits are apportioned. All fields optional. */
+export interface DataRateLimitConfig {
+    /** Turn the whole thing off — for a deployment whose proxy already does it. */
+    enabled?: boolean;
+    windowMs?: number;
+    /** Fallback for an API key with no `rate_limit` of its own. Default 1000. */
+    apiKey?: number;
+    /** Per signed-in user. Default 1000. */
+    user?: number;
+    /**
+     * Per IP, for requests with no principal at all. Default 300.
+     * `null` disables the anonymous bucket entirely — used for routers whose
+     * anonymous traffic must not be throttled (public webhook functions).
+     */
+    anonymous?: number | null;
+    /** Share counts across replicas. Defaults to this process's memory. */
+    store?: RateLimitStore;
+}
+/**
+ * Rate limiting for the data API.
+ *
+ * Every request is in exactly one bucket, resolved most-specific first: an API
+ * key by its id, a signed-in user by their uid, anyone else by IP. Previously
+ * only the first of those was limited at all — the middleware returned early
+ * for any request without an API key — so JWT and anonymous traffic to
+ * `/api/data/*` was unbounded, which is most of the traffic a BaaS gets.
+ *
+ * Per bucket, not per route: the point is to bound what one caller costs, and
+ * they can spend it wherever they like.
+ *
+ * The defaults are deliberately loose. This is a floor against a runaway client
+ * or a naive scraper, not a quota — a deployment that wants real quotas should
+ * set them, and one that already has a proxy doing this should pass
+ * `enabled: false` rather than pay for it twice.
+ */
+export declare function createDataRateLimiter(config?: DataRateLimitConfig): MiddlewareHandler<HonoEnv>;
 /**
  * Create a rate limiter specifically for API key requests.
  *
- * When a request is authenticated via an API key that has a `rate_limit`
- * configured, this limiter enforces per-key limits using the key's ID
- * as the rate limit bucket.
+ * @deprecated Use {@link createDataRateLimiter}, which limits signed-in users
+ * and anonymous callers too. This one skips every request that is not
+ * API-key-authenticated, which was most of them.
  *
  * @param defaultLimit - Fallback limit when the key has no `rate_limit` set.
  * @param windowMs     - Time window in milliseconds (default: 15 minutes).

package/dist/auth/reset-password-admin.d.ts

@@ -24,6 +24,6 @@ export interface ResetPasswordRouteConfig {
 /**
  * Create a standalone admin route for resetting user passwords.
  *
- * Mounts: POST /users/:userId/reset-password
+ * Mounts: POST /users/:uid/reset-password
  */
 export declare function createResetPasswordRoute(config: ResetPasswordRouteConfig): Hono<HonoEnv>;

package/dist/auth/session-routes.d.ts

@@ -18,12 +18,12 @@ interface SessionRoutesConfig {
         isAnonymous?: boolean;
         metadata?: Record<string, unknown> | null;
     }, roleIds: string[], accessToken: string, refreshToken: string, providerId: string) => unknown;
-    createSessionAndTokens: (userId: string, userAgent: string, ipAddress: string) => Promise<{
+    createSessionAndTokens: (uid: string, userAgent: string, ipAddress: string) => Promise<{
         roleIds: string[];
         accessToken: string;
         refreshToken: string;
     }>;
-    applyTransformHook: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, userId: string) => Promise<AuthResponsePayload>;
+    applyTransformHook: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, uid: string) => Promise<AuthResponsePayload>;
 }
 export declare function mountSessionRoutes(opts: SessionRoutesConfig): void;
 export {};

package/dist/cron/cron-store.d.ts

@@ -28,5 +28,23 @@ export interface CronStore {
         totalFailures: number;
         lastRunAt?: string;
     }>>;
+    /**
+     * Atomically claim a scheduled run slot for a job.
+     *
+     * `slot` is the *scheduled* fire time (ISO string) derived from the cron
+     * expression — deterministic across instances regardless of timer drift,
+     * so all instances contend on the same (jobId, slot) key. Exactly one
+     * caller wins the insert against the unique constraint and executes;
+     * the rest skip.
+     *
+     * Fails open (returns true) on unexpected store errors, so a broken
+     * claims table degrades to uncoordinated execution rather than silently
+     * never running jobs.
+     *
+     * Optional so custom stores written against the pre-claims interface
+     * keep working — the scheduler treats a missing implementation as
+     * uncoordinated (always run).
+     */
+    tryClaimRun?(jobId: string, slot: string): Promise<boolean>;
 }
 export declare function createCronStore(driver: DataDriver): CronStore | undefined;

package/dist/env.d.ts

@@ -42,6 +42,7 @@ declare const rebaseEnvSchema: z.ZodObject<{
     STORAGE_TYPE: z.ZodDefault<z.ZodEnum<{
         local: "local";
         s3: "s3";
+        gcs: "gcs";
     }>>;
     STORAGE_PATH: z.ZodOptional<z.ZodString>;
     S3_BUCKET: z.ZodOptional<z.ZodString>;
@@ -54,6 +55,9 @@ declare const rebaseEnvSchema: z.ZodObject<{
         true: "true";
         false: "false";
     }>>, z.ZodTransform<boolean, "" | "true" | "false" | undefined>>;
+    GCS_BUCKET: z.ZodOptional<z.ZodString>;
+    GCS_PROJECT_ID: z.ZodOptional<z.ZodString>;
+    GCS_KEY_FILENAME: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /** Inferred type of the validated environment. */
 export type RebaseEnv = z.infer<typeof rebaseEnvSchema>;

package/dist/index.d.ts

@@ -7,7 +7,7 @@
  * by specialized driver packages like `@rebasepro/server-postgres`.
  */
 export { initializeRebaseBackend, isAuthAdapter, isDatabaseAdapter } from "./init";
-export type { RebaseBackendConfig, RebaseBackendInstance, RebaseAuthConfig } from "./init";
+export type { RebaseBackendConfig, RebaseBackendInstance, RebaseAuthConfig, BaasOptions } from "./init";
 export { rebase, _setRebaseMock, _resetRebaseMock } from "./singleton";
 export { loadCollectionsFromDirectory, applyCollectionDefaults, type CollectionDefaults } from "./collections/loader";
 export * from "./db/interfaces";