@aethex.os/supabase 1.0.0

package/README.md

@@ -0,0 +1,100 @@
+# @aethex.os/supabase
+
+Supabase client factories and Express auth middleware — stop copy-pasting the same Supabase boilerplate across every project.
+
+## Install
+
+```bash
+npm install @aethex.os/supabase @supabase/supabase-js
+```
+
+## Client factories
+
+```ts
+import { createAdminClient, createUserClient, configFromEnv } from "@aethex.os/supabase";
+
+const config = configFromEnv();
+// reads SUPABASE_URL, SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE from process.env
+
+const adminClient = createAdminClient(config);   // service role — full access
+const userClient  = createUserClient(config, accessToken); // scoped to user's RLS
+```
+
+Or pass config directly:
+
+```ts
+const config = {
+  url: "https://xxxx.supabase.co",
+  anonKey: "...",
+  serviceRoleKey: "...",
+};
+```
+
+## Express middleware
+
+```ts
+import express from "express";
+import { requireAuth, configFromEnv } from "@aethex.os/supabase";
+
+const app = express();
+const config = configFromEnv();
+
+// Protects all routes below
+app.use(requireAuth(config));
+
+app.get("/me", (req, res) => {
+  // req.user   → { id, email, role, metadata }
+  // req.supabase      → user-scoped client (respects RLS)
+  // req.supabaseAdmin → service-role client
+  res.json(req.user);
+});
+```
+
+Optionally load profile columns alongside auth:
+
+```ts
+app.use(requireAuth(config, "user_type, primary_arm, full_name"));
+// req.user.role     → profile.user_type
+// req.user.metadata → full profile row
+```
+
+## Manual token verification
+
+```ts
+import { authenticateToken, extractBearerToken } from "@aethex.os/supabase";
+
+const token = extractBearerToken(req.headers.authorization);
+if (!token) return res.status(401).json({ error: "No token" });
+
+const { user, adminClient, userClient, error } = await authenticateToken(token, config);
+if (!user) return res.status(401).json({ error });
+```
+
+## TypeScript augmentation
+
+Extend `Express.Request` with the user type:
+
+```ts
+declare global {
+  namespace Express {
+    interface Request {
+      user?: import("@aethex.os/supabase").AuthenticatedUser;
+    }
+  }
+}
+```
+
+## API
+
+| Export | Description |
+|--------|-------------|
+| `createAdminClient(config)` | Service-role Supabase client (bypasses RLS) |
+| `createUserClient(config, token)` | User-scoped Supabase client (respects RLS) |
+| `configFromEnv()` | Read config from environment variables |
+| `authenticateToken(token, config, select?)` | Verify Bearer token, returns user + clients |
+| `extractBearerToken(header)` | Parse `Authorization: Bearer <token>` |
+| `requireAuth(config, select?)` | Express middleware — guards routes, attaches `req.user` |
+
+---
+
+Part of the [`@aethex.os`](https://www.npmjs.com/search?q=%40aethex.os) toolkit.

package/lib/auth.d.ts

@@ -0,0 +1,18 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+import { type SupabaseConfig } from "./client";
+export interface AuthenticatedUser {
+    id: string;
+    email?: string;
+    role?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface AuthResult {
+    user: AuthenticatedUser | null;
+    error: string | null;
+    adminClient: SupabaseClient;
+    userClient: SupabaseClient | null;
+}
+export declare function authenticateToken(accessToken: string, config: SupabaseConfig, selectProfile?: string): Promise<AuthResult>;
+export declare function extractBearerToken(authHeader: string | undefined): string | null;
+export declare function requireAuth(config: SupabaseConfig, selectProfile?: string): (req: any, res: any, next: any) => Promise<void>;
+//# sourceMappingURL=auth.d.ts.map

package/lib/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAuC,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAEpF,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,cAAc,CAAC;IAC5B,UAAU,EAAE,cAAc,GAAG,IAAI,CAAC;CACnC;AAED,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,cAAc,EACtB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,UAAU,CAAC,CAgCrB;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAGhF;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,cAAc,EACtB,aAAa,CAAC,EAAE,MAAM,IAER,KAAK,GAAG,EAAE,KAAK,GAAG,EAAE,MAAM,GAAG,KAAG,OAAO,CAAC,IAAI,CAAC,CAkB5D"}

package/lib/auth.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authenticateToken = authenticateToken;
+exports.extractBearerToken = extractBearerToken;
+exports.requireAuth = requireAuth;
+const client_1 = require("./client");
+async function authenticateToken(accessToken, config, selectProfile) {
+    const adminClient = (0, client_1.createAdminClient)(config);
+    const { data: { user }, error: authError } = await adminClient.auth.getUser(accessToken);
+    if (authError || !user) {
+        return { user: null, error: "Invalid or expired token", adminClient, userClient: null };
+    }
+    let role;
+    let metadata;
+    if (selectProfile) {
+        const { data: profile } = await adminClient
+            .from("user_profiles")
+            .select(selectProfile)
+            .eq("id", user.id)
+            .single();
+        if (profile) {
+            role = profile.user_type ?? profile.role;
+            metadata = profile;
+        }
+    }
+    const userClient = (0, client_1.createUserClient)(config, accessToken);
+    return {
+        user: { id: user.id, email: user.email, role, metadata },
+        error: null,
+        adminClient,
+        userClient,
+    };
+}
+function extractBearerToken(authHeader) {
+    if (!authHeader?.startsWith("Bearer "))
+        return null;
+    return authHeader.slice(7);
+}
+function requireAuth(config, selectProfile) {
+    return async (req, res, next) => {
+        const token = extractBearerToken(req.headers.authorization);
+        if (!token) {
+            res.status(401).json({ error: "Unauthorized — Bearer token required" });
+            return;
+        }
+        const result = await authenticateToken(token, config, selectProfile);
+        if (!result.user) {
+            res.status(401).json({ error: result.error });
+            return;
+        }
+        req.user = result.user;
+        req.supabase = result.userClient;
+        req.supabaseAdmin = result.adminClient;
+        next();
+    };
+}
+//# sourceMappingURL=auth.js.map

package/lib/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":";;AAiBA,8CAoCC;AAED,gDAGC;AAED,kCAsBC;AAjFD,qCAAoF;AAgB7E,KAAK,UAAU,iBAAiB,CACrC,WAAmB,EACnB,MAAsB,EACtB,aAAsB;IAEtB,MAAM,WAAW,GAAG,IAAA,0BAAiB,EAAC,MAAM,CAAC,CAAC;IAE9C,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAEzF,IAAI,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,0BAA0B,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC1F,CAAC;IAED,IAAI,IAAwB,CAAC;IAC7B,IAAI,QAA6C,CAAC;IAElD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,WAAW;aACxC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,aAAa,CAAC;aACrB,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;aACjB,MAAM,EAAE,CAAC;QACZ,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;YACzC,QAAQ,GAAG,OAAO,CAAC;QACrB,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,yBAAgB,EAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAEzD,OAAO;QACL,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxD,KAAK,EAAE,IAAI;QACX,WAAW;QACX,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAgB,kBAAkB,CAAC,UAA8B;IAC/D,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,SAAgB,WAAW,CACzB,MAAsB,EACtB,aAAsB;IAEtB,OAAO,KAAK,EAAE,GAAQ,EAAE,GAAQ,EAAE,IAAS,EAAiB,EAAE;QAC5D,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACvB,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC;QACjC,GAAG,CAAC,aAAa,GAAG,MAAM,CAAC,WAAW,CAAC;QACvC,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/lib/client.d.ts

@@ -0,0 +1,10 @@
+import { type SupabaseClient } from "@supabase/supabase-js";
+export interface SupabaseConfig {
+    url: string;
+    anonKey: string;
+    serviceRoleKey?: string;
+}
+export declare function createAdminClient(config: SupabaseConfig): SupabaseClient;
+export declare function createUserClient(config: SupabaseConfig, accessToken: string): SupabaseClient;
+export declare function configFromEnv(): SupabaseConfig;
+//# sourceMappingURL=client.d.ts.map

package/lib/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE1E,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,CAKxE;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,GAAG,cAAc,CAK5F;AAED,wBAAgB,aAAa,IAAI,cAAc,CAO9C"}

package/lib/client.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAdminClient = createAdminClient;
+exports.createUserClient = createUserClient;
+exports.configFromEnv = configFromEnv;
+const supabase_js_1 = require("@supabase/supabase-js");
+function createAdminClient(config) {
+    if (!config.serviceRoleKey)
+        throw new Error("serviceRoleKey required for admin client");
+    return (0, supabase_js_1.createClient)(config.url, config.serviceRoleKey, {
+        auth: { autoRefreshToken: false, persistSession: false },
+    });
+}
+function createUserClient(config, accessToken) {
+    return (0, supabase_js_1.createClient)(config.url, config.anonKey, {
+        auth: { autoRefreshToken: false, persistSession: false },
+        global: { headers: { Authorization: `Bearer ${accessToken}` } },
+    });
+}
+function configFromEnv() {
+    const url = process.env.VITE_SUPABASE_URL ?? process.env.SUPABASE_URL ?? "";
+    const anonKey = process.env.VITE_SUPABASE_ANON_KEY ?? process.env.SUPABASE_ANON_KEY ?? "";
+    const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE ?? process.env.SUPABASE_SERVICE_ROLE_KEY;
+    if (!url || !anonKey)
+        throw new Error("SUPABASE_URL and SUPABASE_ANON_KEY must be set");
+    return { url, anonKey, serviceRoleKey };
+}
+//# sourceMappingURL=client.js.map

package/lib/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";;AAQA,8CAKC;AAED,4CAKC;AAED,sCAOC;AA7BD,uDAA0E;AAQ1E,SAAgB,iBAAiB,CAAC,MAAsB;IACtD,IAAI,CAAC,MAAM,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACxF,OAAO,IAAA,0BAAY,EAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,EAAE;QACrD,IAAI,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE;KACzD,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,gBAAgB,CAAC,MAAsB,EAAE,WAAmB;IAC1E,OAAO,IAAA,0BAAY,EAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE;QAC9C,IAAI,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE;QACxD,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE;KAChE,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,aAAa;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;IAC5E,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAC1F,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAElG,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACxF,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AAC1C,CAAC"}

package/lib/index.d.ts

@@ -0,0 +1,5 @@
+export { createAdminClient, createUserClient, configFromEnv } from "./client";
+export type { SupabaseConfig } from "./client";
+export { authenticateToken, extractBearerToken, requireAuth } from "./auth";
+export type { AuthenticatedUser, AuthResult } from "./auth";
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9E,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC"}

package/lib/index.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireAuth = exports.extractBearerToken = exports.authenticateToken = exports.configFromEnv = exports.createUserClient = exports.createAdminClient = void 0;
+var client_1 = require("./client");
+Object.defineProperty(exports, "createAdminClient", { enumerable: true, get: function () { return client_1.createAdminClient; } });
+Object.defineProperty(exports, "createUserClient", { enumerable: true, get: function () { return client_1.createUserClient; } });
+Object.defineProperty(exports, "configFromEnv", { enumerable: true, get: function () { return client_1.configFromEnv; } });
+var auth_1 = require("./auth");
+Object.defineProperty(exports, "authenticateToken", { enumerable: true, get: function () { return auth_1.authenticateToken; } });
+Object.defineProperty(exports, "extractBearerToken", { enumerable: true, get: function () { return auth_1.extractBearerToken; } });
+Object.defineProperty(exports, "requireAuth", { enumerable: true, get: function () { return auth_1.requireAuth; } });
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,mCAA8E;AAArE,2GAAA,iBAAiB,OAAA;AAAE,0GAAA,gBAAgB,OAAA;AAAE,uGAAA,aAAa,OAAA;AAG3D,+BAA4E;AAAnE,yGAAA,iBAAiB,OAAA;AAAE,0GAAA,kBAAkB,OAAA;AAAE,mGAAA,WAAW,OAAA"}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@aethex.os/supabase",
+  "version": "1.0.0",
+  "description": "Supabase client factories and Express auth middleware — admin client, user client, and Bearer token authentication for Node.js servers",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "files": [
+    "lib"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch"
+  },
+  "keywords": [
+    "supabase",
+    "auth",
+    "express",
+    "middleware",
+    "jwt",
+    "bearer",
+    "node",
+    "aethex"
+  ],
+  "author": "AeThex Corporation",
+  "license": "MIT",
+  "homepage": "https://aethex.dev",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/AeThex-Corporation/AeThex-OS.git",
+    "directory": "packages/aethex-supabase"
+  },
+  "peerDependencies": {
+    "@supabase/supabase-js": ">=2.0.0"
+  },
+  "devDependencies": {
+    "@supabase/supabase-js": "^2.0.0",
+    "@types/node": "^20.0.0",
+    "typescript": "^5.3.0"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}