@voidbase-cloud/voidbase 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 Entries after 0.1.0 are compiled by release-please from the Conventional Commits merged since the previous release
 (docs/releasing.md); 0.1.0 was written by hand.
 
+## [0.2.2](https://github.com/voidbase-cloud/voidbase/compare/v0.2.1...v0.2.2) (2026-09-06)
+
+
+### Bug Fixes
+
+* **migrations:** later pb_migrations see collections created earlier in the same run ([35b0e94](https://github.com/voidbase-cloud/voidbase/commit/35b0e9499c0862de5c5c76d1696c2104cc205b32))
+
+
+### Documentation
+
+* **surface:** template marketplace in the control plane ([48b09ae](https://github.com/voidbase-cloud/voidbase/commit/48b09ae5d74b760fcdb64c3315b4df7d61e5ab81))
+
+## [0.2.1](https://github.com/voidbase-cloud/voidbase/compare/v0.2.0...v0.2.1) (2026-09-06)
+
+
+### Bug Fixes
+
+* **oauth2:** Cloudflare sign-in without the openid scope ([16d660d](https://github.com/voidbase-cloud/voidbase/commit/16d660de61728b705e1aa385b71b2fdf9397a216))
+
 ## [0.2.0](https://github.com/voidbase-cloud/voidbase/compare/v0.1.0...v0.2.0) (2026-09-06)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voidbase-cloud/voidbase",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "PocketBase-compatible backend on Cloudflare Workers (D1, R2, Queues, Durable Objects) via Void, or a single Bun process",
   "license": "MIT",
   "repository": {

package/src/node/embedded.ts

@@ -6,6 +6,8 @@ export interface Embedded { version: string; migrations: Record<string, string>;
 let cached: Embedded | null | undefined;
 export async function embedded(): Promise<Embedded | null> {
   if (cached !== undefined) return cached;
+  // the file exists only while scripts/build-exe.ts compiles; consumers typecheck this module without it
+  // @ts-ignore
   try { cached = ((await import("./embedded.generated.json", { with: { type: "json" } })) as { default: Embedded }).default; } catch { cached = null; }
   return cached;
 }

package/src/server/hooks/migrations.ts

@@ -50,6 +50,8 @@ async function runPending(db: D1Database, globals: Record<string, unknown>): Pro
       throw err;
     }
     invalidateCollections();
+    // the next migration must see what this one created (PocketBase reloads its collections cache the same way)
+    const store = hookStore.getStore(); if (store) { const fresh = await loadCollections(db); store.collections.clear(); for (const [k, v] of fresh) store.collections.set(k, v); }
     await stmt(db, "INSERT OR IGNORE INTO `_pbMigrations` (file, applied) VALUES (?, ?)", [m.name, Date.now()]).run();
     done.push(m.name);
   }

package/src/server/oauth2/providers.ts

@@ -7,11 +7,14 @@ export interface ProviderContext { name: string; clientId: string; clientSecret:
 type Raw = Record<string, unknown>;
 
 const oidc: ProviderDefaults = { displayName: "OIDC", pkce: true, scopes: ["openid", "email", "profile"] };
-// Cloudflare OAuth (developers.cloudflare.com/fundamentals/oauth): plain OIDC on dash.cloudflare.com whose userinfo
-// carries only `sub`, so identity comes from the API's GET /user. Resource scopes (API token permission names such
-// as workers-platform.write) are added per provider with extra.scopes; extra.apiBase overrides the API for tests.
+// Cloudflare OAuth (developers.cloudflare.com/fundamentals/oauth): OAuth 2.0 on dash.cloudflare.com, not OIDC: `openid`
+// is not a Cloudflare scope and a request carrying it is refused (invalid_scope). Identity comes from the API's GET
+// /user (scope user-details.read); the userinfo endpoint, when it answers, only adds `sub`. Resource scopes (API token
+// permission ids such as workers-scripts.write, plus offline_access for a refresh token) must be registered on the
+// client and are added per provider with extra.scopes; extra.apiBase overrides the API for tests. The client
+// authenticates with HTTP Basic at the token endpoint (the token exchange tries that first).
 export const CF_API_BASE = "https://api.cloudflare.com/client/v4";
-const cloudflare: ProviderDefaults = { displayName: "Cloudflare", pkce: true, scopes: ["openid", "offline_access"], authURL: "https://dash.cloudflare.com/oauth2/auth", tokenURL: "https://dash.cloudflare.com/oauth2/token", userInfoURL: "https://dash.cloudflare.com/oauth2/userinfo" };
+const cloudflare: ProviderDefaults = { displayName: "Cloudflare", pkce: true, scopes: ["user-details.read"], authURL: "https://dash.cloudflare.com/oauth2/auth", tokenURL: "https://dash.cloudflare.com/oauth2/token", userInfoURL: "https://dash.cloudflare.com/oauth2/userinfo" };
 export const PROVIDER_DEFAULTS: Record<string, ProviderDefaults> = {
   oidc, oidc2: oidc, oidc3: oidc, cloudflare,
   apple: { displayName: "Apple", pkce: true, scopes: ["name", "email"], authURL: "https://appleid.apple.com/auth/authorize", tokenURL: "https://appleid.apple.com/auth/token" },
@@ -72,7 +75,9 @@ export async function fetchRawUser(p: ProviderContext, token: Token): Promise<Ra
       if (!token.id_token) throw new Error("empty id_token");
       return jwtClaims(String(token.id_token));
     case "cloudflare": {
-      const info = p.userInfoURL ? await getJSON(p.userInfoURL, token) : (token.id_token ? jwtClaims(String(token.id_token)) : {});
+      let info: Raw = {};
+      if (p.userInfoURL) { try { info = await getJSON(p.userInfoURL, token); } catch { /* no openid: identity comes from GET /user */ } }
+      else if (token.id_token) info = jwtClaims(String(token.id_token));
       const base = String(p.extra.apiBase || CF_API_BASE).replace(/\/$/, "");
       const me = await getJSON(`${base}/user`, token);
       return { ...info, cf_user: (me.result ?? me) as Raw };

package/src/node/generated.d.ts

@@ -1,2 +0,0 @@
-// src/node/embedded.generated.json exists only while scripts/build-exe.ts compiles the executables
-declare module "*embedded.generated.json" { const value: import("./embedded").Embedded; export default value; }