@rebasepro/types 0.6.1 → 0.8.0

package/src/controllers/navigation.ts

@@ -1,7 +1,7 @@
 import React from "react";
 import type { EntityReference } from "../types/entities";
 import type { EntityCollection } from "../types/collections";
-import type { RebasePlugin } from "../types/plugins";
+
 
 /**
  * Controller that handles URL path building and resolution.
@@ -104,17 +104,12 @@ export type NavigationStateController = {
     /**
      * Was there an error while loading the navigation data
      */
-    navigationLoadingError?: unknown;
+    navigationLoadingError?: Error;
 
     /**
      * Call this method to recalculate the navigation
      */
     refreshNavigation: () => void;
-
-    /**
-     * Plugin system allowing to extend the CMS functionality.
-     */
-    plugins?: RebasePlugin[];
 };
 
 export interface NavigateOptions {
@@ -126,13 +121,7 @@ export interface NavigateOptions {
     viewTransition?: boolean;
 }
 
-// currently not used, in favor of a single blocker in `RebaseRoute`
-export type NavigationBlocker = {
-    updateBlockListener: (path: string, block: boolean, basePath?: string) => () => void;
-    isBlocked: (path: string) => boolean;
-    proceed?: () => void;
-    reset?: () => void;
-};
+
 
 /**
  * Custom additional views created by the developer, added to the main
@@ -181,9 +170,13 @@ export interface AppView {
 
     /**
      * Component to be rendered. This can be any React component, and can use
-     * any of the provided hooks
+     * any of the provided hooks.
+     *
+     * Pass a `ComponentType` to enable lazy rendering — the component will
+     * only be instantiated when the route is visited. This is recommended
+     * for dynamic views generated from database data.
      */
-    view: React.ReactNode;
+    view: React.ReactNode | React.ComponentType;
 
     /**
      * If true, a wildcard route (slug/*) is automatically registered
@@ -191,6 +184,14 @@ export interface AppView {
      */
     nestedRoutes?: boolean;
 
+    /**
+     * Restrict this view to users with at least one of the listed roles.
+     * When omitted or empty, the view is visible to all authenticated users.
+     * Applied during view resolution — the view is filtered out entirely
+     * (not just hidden from nav) if the user lacks a matching role.
+     */
+    roles?: string[];
+
 }
 
 /**

package/src/controllers/registry.ts

@@ -1,10 +1,9 @@
 import { ReactNode } from "react";
 import type { EntityCollection } from "../types/collections";
-import type { EntityCollectionsBuilder } from "../types/builders";
+import type { EntityCollectionsBuilder, AppViewsBuilder } from "../types/builders";
 import type { EntityCustomView } from "../types/entity_views";
 import type { EntityAction } from "../types/entity_actions";
 import type { AppView, NavigationGroupMapping } from "./navigation";
-import type { RebasePlugin } from "../types/plugins";
 
 /**
  * Options to enable the built-in collection editor.
@@ -24,10 +23,17 @@ export interface CollectionEditorOptions {
 
 export interface RebaseCMSConfig<EC extends EntityCollection = EntityCollection> {
     collections?: EC[] | EntityCollectionsBuilder<EC>;
+
+    /**
+     * Custom top-level views added to the main navigation.
+     * Accepts a static array of views or an async builder function
+     * that receives the current user/auth context for role-based views.
+     */
+    views?: AppView[] | AppViewsBuilder;
+
     homePage?: ReactNode;
     entityViews?: EntityCustomView[];
     entityActions?: EntityAction[];
-    plugins?: RebasePlugin[];
 
     /**
      * Centralized configuration for how collections and views are grouped
@@ -48,7 +54,7 @@ export interface RebaseCMSConfig<EC extends EntityCollection = EntityCollection>
 }
 
 export interface RebaseStudioConfig {
-    tools?: ("sql" | "js" | "rls" | "schema" | "storage" | "cron" | "schema-visualizer" | "branches" | "api" | "logs")[];
+    tools?: ("sql" | "js" | "rls" | "schema" | "storage" | "cron" | "schema-visualizer" | "branches" | "api" | "logs" | "api-keys")[];
     homePage?: ReactNode;
     devViews?: AppView[];
 }

package/src/types/api_keys.ts

@@ -0,0 +1,52 @@
+/** A single permission entry scoping an API key to a collection and its allowed operations. */
+export interface ApiKeyPermission {
+    collection: string;
+    operations: ("read" | "write" | "delete")[];
+}
+
+/** An API key with the secret portion masked (returned by list / get / update). */
+export interface ApiKeyMasked {
+    id: string;
+    name: string;
+    key_prefix: string;
+    permissions: ApiKeyPermission[];
+    admin: boolean;
+    rate_limit: number | null;
+    created_by: string;
+    created_at: string;
+    updated_at: string;
+    last_used_at: string | null;
+    expires_at: string | null;
+    revoked_at: string | null;
+}
+
+/** An API key including the full secret (returned only on creation). */
+export interface ApiKeyWithSecret extends ApiKeyMasked {
+    key: string;
+}
+
+/** Payload for creating a new API key. */
+export interface CreateApiKeyRequest {
+    name: string;
+    permissions: ApiKeyPermission[];
+    admin?: boolean;
+    rate_limit?: number | null;
+    expires_at?: string | null;
+}
+
+/** Payload for updating an existing API key. */
+export interface UpdateApiKeyRequest {
+    name?: string;
+    permissions?: ApiKeyPermission[];
+    admin?: boolean;
+    rate_limit?: number | null;
+    expires_at?: string | null;
+}
+
+export interface ApiKeysAPI {
+    listKeys(): Promise<{ keys: ApiKeyMasked[] }>;
+    getKey(id: string): Promise<{ key: ApiKeyMasked }>;
+    createKey(data: CreateApiKeyRequest): Promise<{ key: ApiKeyWithSecret }>;
+    updateKey(id: string, data: UpdateApiKeyRequest): Promise<{ key: ApiKeyMasked }>;
+    revokeKey(id: string): Promise<{ success: boolean }>;
+}

package/src/types/auth_adapter.ts

@@ -4,8 +4,8 @@
  * Pluggable authentication abstraction for Rebase.
  *
  * An `AuthAdapter` decouples authentication from the database layer,
- * allowing users to bring their own auth system (Clerk, Auth0, Firebase Auth,
- * custom JWT, etc.) while keeping the Rebase admin frontend fully functional.
+ * allowing users to bring their own auth system (Clerk, Auth0, or other
+ * external providers) while keeping the Rebase admin frontend fully functional.
  *
  * @example Built-in auth (default — zero config change)
  * ```ts
@@ -93,6 +93,8 @@ export interface AuthAdapterCapabilities {
     profileUpdate: boolean;
     /** Supports email verification. */
     emailVerification: boolean;
+    /** Supports passwordless magic link login. */
+    magicLink: boolean;
     /** List of enabled OAuth provider IDs (e.g. `["google", "github"]`). */
     enabledProviders: string[];
 
@@ -218,6 +220,49 @@ export interface UserCreationFinalizeResult {
     invitationSent: boolean;
 }
 
+// ─── Auth Response Transform ─────────────────────────────────────────────────
+
+/**
+ * The auth response payload shape that flows through `transformAuthResponse`.
+ *
+ * For login, register, OAuth, anonymous, and magic-link flows the payload
+ * contains both `user` and `tokens`. For refresh and MFA flows the payload
+ * contains only `tokens` (no `user`).
+ *
+ * @group Auth
+ */
+export interface AuthResponsePayload {
+    user?: {
+        uid: string;
+        email: string;
+        displayName: string | null;
+        photoURL: string | null;
+        roles: string[];
+        metadata: Record<string, unknown>;
+    };
+    tokens: {
+        accessToken: string;
+        refreshToken: string;
+        accessTokenExpiresAt: number;
+        /** Additional tokens injected by `transformAuthResponse`. */
+        [key: string]: unknown;
+    };
+}
+
+/**
+ * Context passed to the `transformAuthResponse` hook.
+ *
+ * @group Auth
+ */
+export interface TransformAuthResponseContext {
+    /** The authenticated user's ID. */
+    userId: string;
+    /** The auth method that triggered this response. */
+    method: "login" | "register" | "oauth" | "refresh" | "anonymous" | "magic-link" | "mfa";
+    /** The raw HTTP request (for reading headers, IP, etc.). */
+    request: Request;
+}
+
 // ─── Auth Adapter ────────────────────────────────────────────────────────────
 
 /**
@@ -232,7 +277,7 @@ export interface UserCreationFinalizeResult {
  * 4. Advertise its capabilities so the frontend can adapt
  *
  * The built-in Rebase auth implements this interface internally.
- * External providers (Clerk, Auth0, Firebase Auth) provide their own adapters.
+ * External providers (Clerk, Auth0, or others) provide their own adapters.
  * Users with custom auth can use `createCustomAuthAdapter()` for a minimal setup.
  *
  * @group Auth
@@ -241,7 +286,7 @@ export interface AuthAdapter {
     /**
      * Unique identifier for this auth adapter.
      *
-     * @example "rebase-builtin", "clerk", "auth0", "firebase", "custom"
+     * @example "rebase-builtin", "clerk", "auth0", "external-provider", "custom"
      */
     readonly id: string;
 
@@ -379,6 +424,28 @@ export interface AuthAdapter {
      * normal token verification and are granted admin-level access.
      */
     serviceKey?: string;
+
+    // ── Response Transform ───────────────────────────────────────────────
+
+    /**
+     * Transform the auth response before sending it to the client.
+     *
+     * Called after successful login, register, refresh, OAuth, anonymous,
+     * magic-link, and MFA flows. The hook receives the fully-formed
+     * response and returns a (potentially enriched) response.
+     *
+     * Use cases:
+     * - Inject tokens from external auth systems (custom provider tokens, etc.)
+     * - Add project-specific metadata to the response
+     * - Enrich the user object with data from external sources
+     *
+     * The hook runs in the request path — keep it fast.
+     * Heavy work should be offloaded to `onAuthenticated` (fire-and-forget).
+     */
+    transformAuthResponse?(
+        response: AuthResponsePayload,
+        context: TransformAuthResponseContext
+    ): Promise<AuthResponsePayload>;
 }
 
 // ─── Custom Auth Adapter Options ─────────────────────────────────────────────
@@ -413,4 +480,13 @@ export interface CustomAuthAdapterOptions {
 
     /** Override default capabilities. */
     capabilities?: Partial<AuthAdapterCapabilities>;
+
+    /**
+     * Transform the auth response before sending it to the client.
+     * Same semantics as `AuthAdapter.transformAuthResponse`.
+     */
+    transformAuthResponse?: (
+        response: AuthResponsePayload,
+        context: TransformAuthResponseContext
+    ) => Promise<AuthResponsePayload>;
 }

package/src/types/backend.ts

@@ -325,6 +325,11 @@ export interface CollectionRegistryInterface {
      * Get all registered collections
      */
     getCollections(): EntityCollection[];
+
+    /**
+     * Get the currently registered global callbacks, if any.
+     */
+    getGlobalCallbacks(): any | undefined;
 }
 
 // =============================================================================
@@ -367,7 +372,7 @@ export interface SQLAdmin {
     /**
      * Execute raw SQL against the database.
      */
-    executeSql(sql: string, options?: { database?: string; role?: string }): Promise<Record<string, unknown>[]>;
+    executeSql(sql: string, options?: { database?: string; role?: string; params?: unknown[] }): Promise<Record<string, unknown>[]>;
 
     /**
      * Fetch the available databases on the server.