@rebasepro/server 0.9.1-canary.fd3754b → 0.10.0

package/dist/init/middlewares.d.ts

@@ -2,6 +2,7 @@ import { Hono } from "hono";
 import { HonoEnv } from "../api/types";
 interface MiddlewareConfig {
     maxBodySize?: number;
+    compression?: boolean;
     csrf?: {
         origin: string | string[] | ((origin: string) => boolean);
     };

package/dist/init.d.ts

@@ -5,6 +5,7 @@ import { Server } from "http";
 import { Hono } from "hono";
 import { HonoEnv } from "./api/types";
 import { BackendStorageConfig, StorageController, StorageRegistry } from "./storage";
+import { type DataRateLimitConfig } from "./auth/rate-limiter";
 import { EmailConfig } from "./email";
 import type { OAuthProvider } from "./auth/interfaces";
 import type { AuthHooks } from "./auth/auth-hooks";
@@ -193,6 +194,17 @@ export interface RebaseBackendConfig {
     server: Server;
     app: Hono<HonoEnv>;
     basePath?: string;
+    /**
+     * Rate limiting for the data API, per caller: an API key by its id, a
+     * signed-in user by their uid, anyone else by IP.
+     *
+     * On by default with loose limits — a floor against a runaway client, not a
+     * quota. Counts live in this process's memory unless you pass a `store`, so
+     * N replicas enforce N times the limit between them; set real quotas at a
+     * proxy or supply a shared store if that matters. `{ enabled: false }` for
+     * a deployment whose edge already does this.
+     */
+    rateLimit?: DataRateLimitConfig;
     /**
      * How much of Rebase to run.
      *
@@ -275,6 +287,27 @@ export interface RebaseBackendConfig {
      * external storage) that the backend does not proxy.
      */
     storageSources?: import("@rebasepro/types").StorageSourceDefinition[];
+    /**
+     * Per-object access control for storage — the analogue of a collection's
+     * security rules, and the thing `requireAuth` / `publicRead` cannot
+     * express because they are global switches.
+     *
+     * Called after authentication on every storage route with the key, bucket,
+     * operation (`read` / `write` / `delete` / `list`) and resolved user.
+     * Return false to deny with a 403; throwing denies too.
+     *
+     * ```ts
+     * storageAuthorize: async ({ key, user, operation }) => {
+     *     if (!user) return false;
+     *     const [ownerId] = key.split("/");
+     *     return ownerId === user.uid || operation === "read";
+     * }
+     * ```
+     *
+     * Without it, any authenticated caller may read any key they can name, so
+     * multi-tenant apps should treat this as required rather than optional.
+     */
+    storageAuthorize?: import("./storage/types").StorageAuthorize;
     /**
      * Entity history / audit-log configuration.
      *
@@ -299,6 +332,20 @@ export interface RebaseBackendConfig {
      * `maxFileSize` property (default: 50MB), which takes precedence over this.
      */
     maxBodySize?: number;
+    /**
+     * Response compression for API routes. **Enabled by default.**
+     *
+     * Compresses responses with gzip/deflate, negotiated from the request's
+     * `Accept-Encoding`. Bodies that are already compressed (images, video),
+     * streamed (`text/event-stream`), or explicitly marked
+     * `Cache-Control: no-transform` are left untouched, so this is safe to
+     * leave on — a large JSON list response typically drops by ~20x.
+     *
+     * Set to `false` when something in front of the app already compresses
+     * (nginx, Cloudflare, or another reverse proxy / load balancer), to avoid
+     * paying for it twice.
+     */
+    compression?: boolean;
     /**
      * CSRF protection configuration. **Opt-in** — disabled by default.
      *
@@ -357,6 +404,21 @@ export interface RebaseBackendInstance {
     storageController?: StorageController;
     collectionRegistry: BackendCollectionRegistry;
     cronScheduler?: import("./cron").CronScheduler;
+    /**
+     * Attach collection callbacks AFTER initialization.
+     *
+     * Use this instead of mutating `collectionRegistry.get(slug).callbacks`.
+     * Every registry normalizes its collections through `{ ...c }`, so the
+     * backend registry and each driver's registry hold **separate copies** of
+     * the same collection — assigning callbacks to one is invisible to the
+     * driver that actually invokes them, and the hooks silently never fire.
+     * This writes to all of them.
+     *
+     * (Assignment, not `Object.defineProperty`: the driver resolves callbacks
+     * with a spread, which copies only enumerable properties, and
+     * defineProperty defaults `enumerable` to false.)
+     */
+    setCollectionCallbacks(slug: string, callbacks: import("@rebasepro/types").CollectionCallbacks): void;
     /**
      * Deep health check that verifies database connectivity.
      * Returns latency and component status.

package/dist/{jwt-BwIn8xmk.js → jwt-B3zjddCa.js}

@@ -1,9 +1,44 @@
 import { createRequire as __createRequire } from "module";
 import process from "process";
-__createRequire(import.meta.url);
-import { a as __require, i as __exportAll, n as __commonJSMin, s as __toESM, t as require_ms } from "./ms-DnYXB-Wd.js";
+const require = __createRequire(import.meta.url);
 import { t as logger } from "./logger-BYU66ENZ.js";
 import { createHash, randomBytes } from "crypto";
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, { get: (a, b) => (typeof require !== "undefined" ? require : a)[b] }) : x)(function(x) {
+	if (typeof require !== "undefined") return require.apply(this, arguments);
+	throw Error("Calling `require` for \"" + x + "\" in an environment that doesn't expose the `require` function. See https://rolldown.rs/in-depth/bundling-cjs#require-external-modules for more details.");
+});
+//#endregion
 //#region ../../node_modules/.pnpm/safe-buffer@5.2.1/node_modules/safe-buffer/index.js
 var require_safe_buffer = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	/*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */
@@ -674,6 +709,124 @@ var require_TokenExpiredError = /* @__PURE__ */ __commonJSMin(((exports, module)
 	module.exports = TokenExpiredError;
 }));
 //#endregion
+//#region ../../node_modules/.pnpm/ms@2.1.3/node_modules/ms/index.js
+var require_ms = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	/**
+	* Helpers.
+	*/
+	var s = 1e3;
+	var m = s * 60;
+	var h = m * 60;
+	var d = h * 24;
+	var w = d * 7;
+	var y = d * 365.25;
+	/**
+	* Parse or format the given `val`.
+	*
+	* Options:
+	*
+	*  - `long` verbose formatting [false]
+	*
+	* @param {String|Number} val
+	* @param {Object} [options]
+	* @throws {Error} throw an error if val is not a non-empty string or a number
+	* @return {String|Number}
+	* @api public
+	*/
+	module.exports = function(val, options) {
+		options = options || {};
+		var type = typeof val;
+		if (type === "string" && val.length > 0) return parse(val);
+		else if (type === "number" && isFinite(val)) return options.long ? fmtLong(val) : fmtShort(val);
+		throw new Error("val is not a non-empty string or a valid number. val=" + JSON.stringify(val));
+	};
+	/**
+	* Parse the given `str` and return milliseconds.
+	*
+	* @param {String} str
+	* @return {Number}
+	* @api private
+	*/
+	function parse(str) {
+		str = String(str);
+		if (str.length > 100) return;
+		var match = /^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(str);
+		if (!match) return;
+		var n = parseFloat(match[1]);
+		switch ((match[2] || "ms").toLowerCase()) {
+			case "years":
+			case "year":
+			case "yrs":
+			case "yr":
+			case "y": return n * y;
+			case "weeks":
+			case "week":
+			case "w": return n * w;
+			case "days":
+			case "day":
+			case "d": return n * d;
+			case "hours":
+			case "hour":
+			case "hrs":
+			case "hr":
+			case "h": return n * h;
+			case "minutes":
+			case "minute":
+			case "mins":
+			case "min":
+			case "m": return n * m;
+			case "seconds":
+			case "second":
+			case "secs":
+			case "sec":
+			case "s": return n * s;
+			case "milliseconds":
+			case "millisecond":
+			case "msecs":
+			case "msec":
+			case "ms": return n;
+			default: return;
+		}
+	}
+	/**
+	* Short format for `ms`.
+	*
+	* @param {Number} ms
+	* @return {String}
+	* @api private
+	*/
+	function fmtShort(ms) {
+		var msAbs = Math.abs(ms);
+		if (msAbs >= d) return Math.round(ms / d) + "d";
+		if (msAbs >= h) return Math.round(ms / h) + "h";
+		if (msAbs >= m) return Math.round(ms / m) + "m";
+		if (msAbs >= s) return Math.round(ms / s) + "s";
+		return ms + "ms";
+	}
+	/**
+	* Long format for `ms`.
+	*
+	* @param {Number} ms
+	* @return {String}
+	* @api private
+	*/
+	function fmtLong(ms) {
+		var msAbs = Math.abs(ms);
+		if (msAbs >= d) return plural(ms, msAbs, d, "day");
+		if (msAbs >= h) return plural(ms, msAbs, h, "hour");
+		if (msAbs >= m) return plural(ms, msAbs, m, "minute");
+		if (msAbs >= s) return plural(ms, msAbs, s, "second");
+		return ms + " ms";
+	}
+	/**
+	* Pluralization helper.
+	*/
+	function plural(ms, msAbs, n, name) {
+		var isPlural = msAbs >= n * 1.5;
+		return Math.round(ms / n) + " " + name + (isPlural ? "s" : "");
+	}
+}));
+//#endregion
 //#region ../../node_modules/.pnpm/jsonwebtoken@9.0.3/node_modules/jsonwebtoken/lib/timespan.js
 var require_timespan = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var ms = require_ms();
@@ -4065,10 +4218,10 @@ function configureJwt(config) {
 /**
 * Generate an access token (short-lived, 1 hour by default)
 */
-function generateAccessToken(userId, roles, aal = "aal1", customClaims) {
+function generateAccessToken(uid, roles, aal = "aal1", customClaims) {
 	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
 	const payload = {
-		userId,
+		uid,
 		roles,
 		aal,
 		...customClaims
@@ -4100,20 +4253,35 @@ function getAccessTokenExpiry() {
 	return Date.now() + getAccessTokenExpiryMs();
 }
 /**
-* Verify and decode an access token
+* Verify and decode an access token.
+*
+* Every token this server issues is signed with the same secret, so what a
+* token *is* comes from its claims, not from its signature. A download token
+* ({@link generateDownloadToken}) is therefore a validly-signed string that
+* must never authenticate anybody: it is scoped to one file path and handed out
+* in URLs, which is a far weaker thing to hold than a session.
+*
+* Today it is rejected below for want of an id — but only by luck, since
+* nothing stops a future download token from carrying one. So the purpose is
+* checked explicitly: a token minted for reading a file is not a token for
+* being a user.
 */
 function verifyAccessToken(token) {
 	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
 	try {
 		const decoded = import_jsonwebtoken.default.verify(token, jwtConfig.secret, { algorithms: ["HS256"] });
-		const id = decoded.userId || decoded.uid || decoded.sub;
+		if (decoded.purpose) {
+			logger.error("[JWT] Verification failed: a purpose-scoped token is not an access token", { purpose: decoded.purpose });
+			return null;
+		}
+		const id = decoded.uid || decoded.userId || decoded.sub;
 		if (!id) {
 			logger.error("[JWT] Verification failed: missing id in payload", { detail: decoded });
 			return null;
 		}
 		const aal = decoded.aal === "aal1" || decoded.aal === "aal2" ? decoded.aal : "aal1";
 		return {
-			userId: id,
+			uid: id,
 			roles: decoded.roles || [],
 			aal
 		};
@@ -4195,6 +4363,6 @@ function verifyDownloadToken(token) {
 	}
 }
 //#endregion
-export { getAccessTokenExpiry as a, jwt_exports as c, require_jsonwebtoken as d, generateRefreshToken as i, verifyAccessToken as l, generateAccessToken as n, getRefreshTokenExpiry as o, generateDownloadToken as r, hashRefreshToken as s, configureJwt as t, verifyDownloadToken as u };
+export { getAccessTokenExpiry as a, jwt_exports as c, require_jsonwebtoken as d, __commonJSMin as f, __toESM as h, generateRefreshToken as i, verifyAccessToken as l, __require as m, generateAccessToken as n, getRefreshTokenExpiry as o, __exportAll as p, generateDownloadToken as r, hashRefreshToken as s, configureJwt as t, verifyDownloadToken as u };
 
-//# sourceMappingURL=jwt-BwIn8xmk.js.map
+//# sourceMappingURL=jwt-B3zjddCa.js.map