@rebasepro/types 0.12.0 → 0.12.1-canary.g06f263c

package/dist/controllers/client.d.ts

@@ -83,6 +83,20 @@ export interface AuthClient {
      * Manually refresh the session token
      */
     refreshSession(): Promise<RebaseSession>;
+    /**
+     * Whether a session could exist that this client has not loaded yet.
+     *
+     * `false` means the only way this client can hold a session is an explicit
+     * sign-in during this page's lifetime: it neither persists sessions nor
+     * carries an httpOnly auth cookie, so there is nothing on disk or in the
+     * browser to restore from. A caller that would otherwise probe the server
+     * — `getUser()` on mount, say — can skip it, because the answer is already
+     * known and the request can only ever fail.
+     *
+     * Optional so that alternative {@link AuthClient} implementations need not
+     * supply it; treat a missing implementation as "unknown, go ahead and ask".
+     */
+    canRestoreSession?: () => boolean;
 }
 /**
  * User record as returned by the Admin API (`GET /admin/users`, etc.).
@@ -337,6 +351,16 @@ export interface RebaseClient<DB = unknown> {
     apiKeys?: ApiKeysAPI;
     /** Base HTTP URL of the backend server */
     baseUrl?: string;
+    /**
+     * The path every API route is mounted under, appended to {@link baseUrl}.
+     *
+     * `"/api"` unless the backend was configured with a different `basePath`
+     * and the client told to match. Exposed because code that builds a URL by
+     * hand — rather than going through the client's own methods — otherwise has
+     * to guess, and guessing `/api` is wrong for exactly the projects that set
+     * the option.
+     */
+    apiPath?: string;
     /** WebSocket client for realtime subscriptions */
     ws?: RebaseWebSocket;
     /** Set the auth token for subsequent requests */
@@ -435,6 +459,16 @@ export interface RebaseBrowserClient<DB = unknown> {
     apiKeys?: ApiKeysAPI;
     /** Base HTTP URL of the backend server */
     baseUrl?: string;
+    /**
+     * The path every API route is mounted under, appended to {@link baseUrl}.
+     *
+     * `"/api"` unless the backend was configured with a different `basePath`
+     * and the client told to match. Exposed because code that builds a URL by
+     * hand — rather than going through the client's own methods — otherwise has
+     * to guess, and guessing `/api` is wrong for exactly the projects that set
+     * the option.
+     */
+    apiPath?: string;
     /** WebSocket client for realtime subscriptions */
     ws?: RebaseWebSocket;
     /** Set the auth token for subsequent requests */

package/dist/index.es.js

@@ -222,7 +222,7 @@ var REST_TO_CANONICAL = {
 * Operators that test for null/not-null and therefore ignore their value.
 * Codecs normalize the value of these conditions to `null`.
 */
-var NULL_OPS = new Set(["is-null", "is-not-null"]);
+var NULL_OPS = /* @__PURE__ */ new Set(["is-null", "is-not-null"]);
 /**
 * Every canonical operator, in a stable order. Useful for engine capability
 * declarations ({@link DataSourceCapabilities.filterOperators}) and for
@@ -602,12 +602,46 @@ function isToMany(relation) {
 *
 * The consequence for policy authors is that **`auth.uid() IS NOT NULL` is a
 * tautology on the user path** — it is true for anonymous visitors too. Use
-* {@link policy.authenticated} (or `auth.uid() <> 'anonymous'`) to mean "signed
-* in", and {@link policy.serverContext} to mean "the trusted server context".
+* {@link policy.authenticated} to mean "signed in", and
+* {@link policy.serverContext} to mean "the trusted server context". Do not
+* hand-write the comparison: see {@link ANONYMOUS_USER_IDS} for why one
+* literal is not enough.
 *
 * @group Models
 */
 var ANONYMOUS_USER_ID = "anonymous";
+/**
+* Every uid that has ever meant "nobody is signed in" — newest first.
+*
+* There are two because there were two. The types, the policy compiler, the
+* JavaScript evaluator and the linter were all built on
+* {@link ANONYMOUS_USER_ID}, while the request path scoped unauthenticated
+* callers as `'anon'` — so `policy.authenticated()`, which compiled to
+* `auth.uid() <> 'anonymous'`, was *true* for an anonymous visitor. The
+* sanctioned way to write "signed in" granted to everyone, and the linter
+* flagged the spelling that actually worked as a foreign convention.
+*
+* The request path now reports {@link ANONYMOUS_USER_ID}. `'anon'` stays here
+* because policies outlive the server that generated them: a database still
+* holding policies from before the fix, or a project whose server has not been
+* upgraded yet, must not become a grant in either direction. Compile against
+* this list, not against a single literal.
+*
+* No real user id is ever one of these, so a match is always "not signed in".
+*
+* @group Models
+*/
+var ANONYMOUS_USER_IDS = [ANONYMOUS_USER_ID, "anon"];
+/**
+* Whether a uid stands for "no one is signed in", in any spelling rebase has
+* used. `null`/`undefined` is the trusted server context, not an anonymous
+* caller, and is therefore **not** anonymous — see {@link ANONYMOUS_USER_ID}.
+*
+* @group Models
+*/
+function isAnonymousUid(uid) {
+	return typeof uid === "string" && ANONYMOUS_USER_IDS.includes(uid);
+}
 /** @group Models */
 var policy = {
 	true: () => ({ kind: "true" }),
@@ -1145,6 +1179,6 @@ function isPublicStoragePath(path) {
 	return p.startsWith("public/") || p.startsWith(`default/public/`);
 }
 //#endregion
-export { ADMIN_COLLECTION_KEYS, ADMIN_PROPERTY_KEYS, ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, BUNDLE_FORMAT_VERSION, CANONICAL_TO_REST, DEFAULT_CAPABILITIES, DEFAULT_DATA_SOURCE_KEY, DEFAULT_FILTERABLE_RELATION_KINDS, DEFAULT_LIST_LIMIT, DEFAULT_STORAGE_SOURCE_KEY, DEFAULT_VECTOR_LIST_LIMIT, EntityReference, EntityRelation, FIREBASE_CAPABILITIES, GeoPoint, MAX_LIST_LIMIT, MONGODB_CAPABILITIES, NULL_OPS, POSTGRES_CAPABILITIES, PUBLIC_STORAGE_PREFIX, REST_TO_CANONICAL, RUNTIME_CONTRACT_VERSION, RebaseApiError, RebaseClientError, SCHEMA_VERSION_HEADER, Vector, canonicalSchemaPayload, computeSchemaVersion, deserializeCollections, findStorageSuffixCollision, getCollectionDataPath, getDataSourceCapabilities, getDeclaredSubcollections, hasForeignKeyOnTarget, isBranchAdmin, isChannelBusInstance, isDocumentAdmin, isFirebaseCollectionConfig, isLazyComponentRef, isManyToMany, isMongoDBCollectionConfig, isPostgresCollectionConfig, isPublicStoragePath, isRelationalCollectionConfig, isSQLAdmin, isSchemaAdmin, isSerializedCollectionRef, isToMany, normalizeStorageSources, policy, registerDataSourceCapabilities, resolveClientListLimit, serializeCollections, storageEnvSuffix, toCanonicalOp };
+export { ADMIN_COLLECTION_KEYS, ADMIN_PROPERTY_KEYS, ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, ANONYMOUS_USER_IDS, BUNDLE_FORMAT_VERSION, CANONICAL_TO_REST, DEFAULT_CAPABILITIES, DEFAULT_DATA_SOURCE_KEY, DEFAULT_FILTERABLE_RELATION_KINDS, DEFAULT_LIST_LIMIT, DEFAULT_STORAGE_SOURCE_KEY, DEFAULT_VECTOR_LIST_LIMIT, EntityReference, EntityRelation, FIREBASE_CAPABILITIES, GeoPoint, MAX_LIST_LIMIT, MONGODB_CAPABILITIES, NULL_OPS, POSTGRES_CAPABILITIES, PUBLIC_STORAGE_PREFIX, REST_TO_CANONICAL, RUNTIME_CONTRACT_VERSION, RebaseApiError, RebaseClientError, SCHEMA_VERSION_HEADER, Vector, canonicalSchemaPayload, computeSchemaVersion, deserializeCollections, findStorageSuffixCollision, getCollectionDataPath, getDataSourceCapabilities, getDeclaredSubcollections, hasForeignKeyOnTarget, isAnonymousUid, isBranchAdmin, isChannelBusInstance, isDocumentAdmin, isFirebaseCollectionConfig, isLazyComponentRef, isManyToMany, isMongoDBCollectionConfig, isPostgresCollectionConfig, isPublicStoragePath, isRelationalCollectionConfig, isSQLAdmin, isSchemaAdmin, isSerializedCollectionRef, isToMany, normalizeStorageSources, policy, registerDataSourceCapabilities, resolveClientListLimit, serializeCollections, storageEnvSuffix, toCanonicalOp };
 
 //# sourceMappingURL=index.es.js.map