@ai-matrx/auth 0.0.0 → 0.1.0

package/dist/node.d.cts

@@ -0,0 +1,33 @@
+/**
+ * Session storage per platform — where a Supabase session lives between runs.
+ *
+ * supabase-js takes any `{ getItem, setItem, removeItem }` (sync or async). These are the ones
+ * every Matrx client needs, written once:
+ *
+ *   browser   — `browserStorage("local")` (supabase-js's own default; `"session"` = this tab only)
+ *   Next.js   — the cookie-backed clients in `@ai-matrx/auth/next` (the domain-wide auth cookie)
+ *   extension — `extensionStorage()` over `chrome.storage.local` (shared by popup, side panel and
+ *               service worker; `localStorage` does not exist in a service worker)
+ *   desktop   — `keyValueStorage({ get, set, remove })` over the host's store (Tauri store, keychain)
+ *   Node      — `fileStorage(path)` in `@ai-matrx/auth/node`, or `memoryStorage()` for a one-shot run
+ *
+ * None of these is ever silently swapped for another: a storage the platform does not have throws
+ * a named error at creation, never a quiet in-memory fallback that signs the person out on reload.
+ */
+/** The storage contract supabase-js reads (sync or async methods). */
+interface SessionStorage {
+    getItem(key: string): string | null | Promise<string | null>;
+    setItem(key: string, value: string): void | Promise<void>;
+    removeItem(key: string): void | Promise<void>;
+}
+
+/**
+ * @ai-matrx/auth/node — session storage for Node scripts and CLIs: the session survives between
+ * runs in one JSON file (mode 0600), so a script signs in once and refreshes after.
+ *
+ *   const supabase = createAuthClient({ url, key, storage: fileStorage(".matrx-session.json") });
+ */
+
+declare function fileStorage(path: string): SessionStorage;
+
+export { fileStorage };

package/dist/node.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Session storage per platform — where a Supabase session lives between runs.
+ *
+ * supabase-js takes any `{ getItem, setItem, removeItem }` (sync or async). These are the ones
+ * every Matrx client needs, written once:
+ *
+ *   browser   — `browserStorage("local")` (supabase-js's own default; `"session"` = this tab only)
+ *   Next.js   — the cookie-backed clients in `@ai-matrx/auth/next` (the domain-wide auth cookie)
+ *   extension — `extensionStorage()` over `chrome.storage.local` (shared by popup, side panel and
+ *               service worker; `localStorage` does not exist in a service worker)
+ *   desktop   — `keyValueStorage({ get, set, remove })` over the host's store (Tauri store, keychain)
+ *   Node      — `fileStorage(path)` in `@ai-matrx/auth/node`, or `memoryStorage()` for a one-shot run
+ *
+ * None of these is ever silently swapped for another: a storage the platform does not have throws
+ * a named error at creation, never a quiet in-memory fallback that signs the person out on reload.
+ */
+/** The storage contract supabase-js reads (sync or async methods). */
+interface SessionStorage {
+    getItem(key: string): string | null | Promise<string | null>;
+    setItem(key: string, value: string): void | Promise<void>;
+    removeItem(key: string): void | Promise<void>;
+}
+
+/**
+ * @ai-matrx/auth/node — session storage for Node scripts and CLIs: the session survives between
+ * runs in one JSON file (mode 0600), so a script signs in once and refreshes after.
+ *
+ *   const supabase = createAuthClient({ url, key, storage: fileStorage(".matrx-session.json") });
+ */
+
+declare function fileStorage(path: string): SessionStorage;
+
+export { fileStorage };

package/dist/node.js

@@ -0,0 +1,36 @@
+// src/node.ts
+function builtin(name) {
+  const get = globalThis.process?.getBuiltinModule;
+  if (!get) throw new Error(`fileStorage needs Node >= 20.16 (process.getBuiltinModule) to reach node:${name}`);
+  return get(`node:${name}`);
+}
+function fileStorage(path) {
+  const { mkdirSync, readFileSync, writeFileSync, chmodSync } = builtin("fs");
+  const { dirname } = builtin("path");
+  const readAll = () => {
+    try {
+      const parsed = JSON.parse(readFileSync(path, "utf8"));
+      return parsed && typeof parsed === "object" ? parsed : {};
+    } catch (e) {
+      if (e.code === "ENOENT") return {};
+      throw new Error(`fileStorage: the session file ${path} could not be read: ${e.message}`);
+    }
+  };
+  const writeAll = (items) => {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(items), { mode: 384 });
+    chmodSync(path, 384);
+  };
+  return {
+    getItem: (key) => readAll()[key] ?? null,
+    setItem: (key, value) => writeAll({ ...readAll(), [key]: value }),
+    removeItem: (key) => {
+      const items = readAll();
+      delete items[key];
+      writeAll(items);
+    }
+  };
+}
+export {
+  fileStorage
+};

package/dist/organizations.cjs

@@ -0,0 +1,389 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/organizations.ts
+var organizations_exports = {};
+__export(organizations_exports, {
+  NoActiveOrganizationError: () => NoActiveOrganizationError,
+  NotAMemberError: () => NotAMemberError,
+  ORGANIZATION_ENTITY_TYPE: () => ORGANIZATION_ENTITY_TYPE,
+  classifyOrganizationRefusal: () => classifyOrganizationRefusal,
+  createActiveOrganization: () => createActiveOrganization,
+  memoryHeldOrganization: () => memoryHeldOrganization,
+  oldestMembership: () => oldestMembership,
+  orderOrganizations: () => orderOrganizations,
+  organizationMatches: () => organizationMatches,
+  readAccountOrganizationChoices: () => readAccountOrganizationChoices,
+  readMemberships: () => readMemberships,
+  readOrganizationFavourites: () => readOrganizationFavourites,
+  resolveActiveOrganization: () => resolveActiveOrganization,
+  resolveActiveOrganizationLazily: () => resolveActiveOrganizationLazily,
+  setOrganizationFavourite: () => setOrganizationFavourite,
+  storageHeldOrganization: () => storageHeldOrganization,
+  toAccountOrganizationChoices: () => toAccountOrganizationChoices,
+  writeLastActiveOrganization: () => writeLastActiveOrganization,
+  writeStartupOrganization: () => writeStartupOrganization
+});
+module.exports = __toCommonJS(organizations_exports);
+
+// src/organization-ladder.ts
+function resolveActiveOrganization(input) {
+  const { memberships } = input;
+  if (memberships.length === 0) return null;
+  const member = (id) => id ? memberships.find((m) => m.id === id) ?? null : null;
+  const held = member(input.held);
+  if (held) return { organization: held, rung: "held" };
+  const last = member(input.account?.lastActiveOrganizationId);
+  if (last) return { organization: last, rung: "last-active" };
+  const startup = member(input.account?.startupOrganizationId);
+  if (startup) return { organization: startup, rung: "startup" };
+  const first = input.first && member(input.first.id) || oldestMembership(memberships);
+  return first ? { organization: first, rung: "first" } : null;
+}
+async function resolveActiveOrganizationLazily(input) {
+  const { memberships } = input;
+  if (memberships.length === 0) return null;
+  const quick = resolveActiveOrganization({ memberships, held: input.held ?? null, account: null, first: null });
+  if (quick?.rung === "held") return quick;
+  const account = await input.readAccount();
+  const named = resolveActiveOrganization({ memberships, held: null, account, first: null });
+  if (named && named.rung !== "first") return named;
+  const first = input.first ? await input.first() : null;
+  return resolveActiveOrganization({ memberships, held: null, account: null, first });
+}
+function oldestMembership(memberships) {
+  let best = null;
+  for (const m of memberships) {
+    if (!best) best = m;
+    else if (m.joinedAt && (!best.joinedAt || m.joinedAt < best.joinedAt)) best = m;
+  }
+  return best;
+}
+function orderOrganizations(organizations, favouriteIds) {
+  const favourites = new Set(favouriteIds);
+  const rank = (o) => favourites.has(o.id) ? 0 : o.isOwn ? 1 : 2;
+  return [...organizations].sort((a, b) => rank(a) - rank(b));
+}
+function organizationMatches(org, query) {
+  const q = query.trim().toLowerCase();
+  if (!q) return true;
+  if (org.name.toLowerCase().includes(q)) return true;
+  const abbreviation = org.abbreviation?.trim().toLowerCase();
+  return !!abbreviation && abbreviation.includes(q);
+}
+var MEMBERSHIP_PAGE = 500;
+var ID_CHUNK = 100;
+async function readMemberships(db, userId) {
+  const memberships = [];
+  for (let from = 0; ; from += MEMBERSHIP_PAGE) {
+    const { data, error } = await db.rpc("mbr_for_user", { p_container_type: "organization" }).order("id", { ascending: true }).range(from, from + MEMBERSHIP_PAGE - 1);
+    if (error) throw new Error(`Your organizations could not be read: ${error.message}`);
+    const page = Array.isArray(data) ? data : [];
+    memberships.push(...page);
+    if (page.length < MEMBERSHIP_PAGE) break;
+  }
+  const active = /* @__PURE__ */ new Map();
+  for (const m of memberships) {
+    if (m.status !== "active") continue;
+    const seen = active.get(m.container_id);
+    if (!seen || m.created_at < seen.created_at) active.set(m.container_id, m);
+  }
+  const ids = [...active.keys()];
+  if (ids.length === 0) return [];
+  const rows = [];
+  for (let i = 0; i < ids.length; i += ID_CHUNK) {
+    const { data, error } = await db.schema("iam").from("organizations").select("id, name, slug, abbreviation, logo_url, created_by, settings, archived_at").in("id", ids.slice(i, i + ID_CHUNK));
+    if (error) throw new Error(`Your organizations could not be read: ${error.message}`);
+    rows.push(...data ?? []);
+  }
+  return rows.filter((r) => !r.archived_at).map((r) => {
+    const m = active.get(r.id);
+    const settings = r.settings && typeof r.settings === "object" ? r.settings : {};
+    return {
+      id: r.id,
+      name: r.name?.trim() || "Untitled organization",
+      slug: r.slug ?? null,
+      abbreviation: r.abbreviation?.trim() || null,
+      logoUrl: r.logo_url?.trim() || null,
+      role: m?.role ?? "member",
+      isOwn: !!r.created_by && r.created_by === userId,
+      isTestFixture: settings["test_fixture"] === true,
+      joinedAt: m?.created_at ?? ""
+    };
+  }).sort((a, b) => a.name.localeCompare(b.name));
+}
+function toAccountOrganizationChoices(row) {
+  return {
+    lastActiveOrganizationId: row?.last_active_organization_id ?? null,
+    startupOrganizationId: row?.startup_organization_id ?? null
+  };
+}
+async function readAccountOrganizationChoices(db, userId) {
+  const { data, error } = await db.schema("users").from("user_preferences").select("last_active_organization_id, startup_organization_id").eq("user_id", userId).maybeSingle();
+  if (error) throw new Error(`The account's organization read failed: ${error.message}`);
+  return toAccountOrganizationChoices(data);
+}
+async function writeLastActiveOrganization(db, organizationId) {
+  const { error } = await db.schema("users").rpc("set_last_active_organization", { p_organization_id: organizationId });
+  if (error) throw new Error(error.message);
+}
+async function writeStartupOrganization(db, organizationId) {
+  const { error } = await db.schema("users").rpc("set_startup_organization", { p_organization_id: organizationId });
+  if (error) throw new Error(error.message);
+}
+var ORGANIZATION_ENTITY_TYPE = "organization";
+async function readOrganizationFavourites(db) {
+  const { data, error } = await db.rpc("ues_list", { p_kind: "favorite" });
+  if (error) throw new Error(`Your favourite organizations could not be read: ${error.message}`);
+  return (Array.isArray(data) ? data : []).filter((r) => r.entity_type === ORGANIZATION_ENTITY_TYPE && r.is_favorite).map((r) => r.entity_id);
+}
+async function setOrganizationFavourite(db, organizationId, favourite) {
+  const { error } = await db.rpc("ues_set", { p_entity_type: ORGANIZATION_ENTITY_TYPE, p_entity_id: organizationId, p_is_favorite: favourite });
+  if (error) throw new Error(error.message);
+}
+function classifyOrganizationRefusal(status, body) {
+  const detail = body && typeof body === "object" ? body["detail"] ?? body : null;
+  const admission = detail && typeof detail === "object" ? detail["organization_admission"] : null;
+  if (status === 400 && (admission === "denied" || admission === "unknown" || admission === "archived")) return "lapsed";
+  if (status === 503 && admission === "unverifiable") return "retry";
+  return null;
+}
+
+// src/session.ts
+var SignInError = class extends Error {
+  constructor(door, message, status, code) {
+    super(`${door}: ${message}`);
+    this.door = door;
+    this.status = status;
+    this.code = code;
+    this.name = "SignInError";
+  }
+  door;
+  status;
+  code;
+};
+function check(door, data, error) {
+  if (error) throw new SignInError(door, error.message, error.status, error.code);
+  return data;
+}
+async function getPerson(client) {
+  const { data, error } = await client.auth.getUser();
+  if (error && (error.name === "AuthSessionMissingError" || error.status === 401)) return null;
+  return check("getPerson", data, error).user;
+}
+function onSessionChange(client, cb) {
+  const { data } = client.auth.onAuthStateChange(cb);
+  return () => data.subscription.unsubscribe();
+}
+
+// src/active-organization.ts
+var NoActiveOrganizationError = class extends Error {
+  constructor(reason, detail) {
+    super(
+      reason === "signed-out" ? "No organization: nobody is signed in." : reason === "no-memberships" ? "No organization: this account is not an active member of any organization." : `No organization: your organizations could not be checked${detail ? ` (${detail})` : ""}.`
+    );
+    this.reason = reason;
+    this.name = "NoActiveOrganizationError";
+  }
+  reason;
+};
+var NotAMemberError = class extends Error {
+  constructor(organizationId) {
+    super(`You are not an active member of organization ${organizationId}.`);
+    this.organizationId = organizationId;
+    this.name = "NotAMemberError";
+  }
+  organizationId;
+};
+var HELD_KEY = "ai-matrx.auth.active-organization";
+function storageHeldOrganization(storage, key = HELD_KEY) {
+  return {
+    read(userId) {
+      try {
+        const raw = storage.getItem(key);
+        if (!raw) return null;
+        const parsed = JSON.parse(raw);
+        return parsed.userId === userId && typeof parsed.organizationId === "string" ? parsed.organizationId : null;
+      } catch {
+        return null;
+      }
+    },
+    write(userId, organizationId) {
+      storage.setItem(key, JSON.stringify({ userId, organizationId }));
+    },
+    clear() {
+      storage.removeItem(key);
+    }
+  };
+}
+function memoryHeldOrganization() {
+  let held = null;
+  return {
+    read: (userId) => held && held.userId === userId ? held.organizationId : null,
+    write: (userId, organizationId) => {
+      held = { userId, organizationId };
+    },
+    clear: () => {
+      held = null;
+    }
+  };
+}
+function defaultHeld() {
+  const session = globalThis.sessionStorage;
+  return session ? storageHeldOrganization(session) : memoryHeldOrganization();
+}
+var IDLE = Object.freeze({
+  status: "idle",
+  userId: null,
+  organizationId: null,
+  organization: null,
+  memberships: Object.freeze([]),
+  rung: null,
+  error: null
+});
+function createActiveOrganization(options) {
+  const { client } = options;
+  const held = options.held ?? defaultHeld();
+  const listeners = /* @__PURE__ */ new Set();
+  let current = IDLE;
+  let inflight = null;
+  let generation = 0;
+  let waiters = [];
+  let disposed = false;
+  const publish = (next) => {
+    current = Object.freeze(next);
+    if (current.status !== "resolving" && current.status !== "idle") {
+      const ready = waiters;
+      waiters = [];
+      for (const w of ready) w();
+    }
+    for (const l of [...listeners]) l();
+  };
+  const run = async (gen) => {
+    publish({ ...current, status: "resolving", error: null });
+    try {
+      const person = await getPerson(client);
+      if (gen !== generation) return current;
+      if (!person) {
+        publish({ ...IDLE, status: "none", error: "signed-out" });
+        return current;
+      }
+      const memberships = await readMemberships(client, person.id);
+      if (gen !== generation) return current;
+      const linked = options.linked?.() ?? null;
+      const heldId = (linked && memberships.some((m) => m.id === linked) ? linked : null) ?? await held.read(person.id);
+      const resolved = await resolveActiveOrganizationLazily({
+        memberships,
+        held: heldId,
+        readAccount: () => readAccountOrganizationChoices(client, person.id)
+      });
+      if (gen !== generation) return current;
+      if (!resolved) {
+        publish({ ...IDLE, status: "none", userId: person.id, error: "no-memberships" });
+        return current;
+      }
+      await held.write(person.id, resolved.organization.id);
+      publish({
+        status: "ready",
+        userId: person.id,
+        organizationId: resolved.organization.id,
+        organization: resolved.organization,
+        memberships,
+        rung: resolved.rung,
+        error: null
+      });
+      return current;
+    } catch (e) {
+      if (gen !== generation) return current;
+      publish({ ...current, status: "error", error: e?.message ?? String(e) });
+      return current;
+    }
+  };
+  const load = () => {
+    if (disposed) return Promise.resolve(current);
+    generation += 1;
+    inflight = run(generation).finally(() => {
+      inflight = null;
+    });
+    return inflight;
+  };
+  const stopSession = onSessionChange(client, (event, session) => {
+    if (event === "SIGNED_OUT" || !session) {
+      generation += 1;
+      void held.clear();
+      publish({ ...IDLE, status: "none", error: "signed-out" });
+      return;
+    }
+    const userId = session.user?.id ?? null;
+    if (event === "SIGNED_IN" && userId !== current.userId) void load();
+  });
+  const settled = async () => {
+    if (current.status === "idle") return load();
+    if (current.status === "resolving") {
+      await new Promise((resolve) => waiters.push(resolve));
+    }
+    return current;
+  };
+  const api = {
+    snapshot: () => current,
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+    load,
+    current: () => current.status === "ready" ? current.organizationId : null,
+    async ensureOrgId(recordOrganizationId) {
+      if (recordOrganizationId) return recordOrganizationId;
+      const snap = await settled();
+      if (snap.status === "ready" && snap.organizationId) return snap.organizationId;
+      if (snap.status === "error") throw new NoActiveOrganizationError("unreadable", snap.error ?? void 0);
+      throw new NoActiveOrganizationError(snap.error === "signed-out" ? "signed-out" : "no-memberships");
+    },
+    async switchTo(organizationId) {
+      const snap = await settled();
+      const organization = snap.memberships.find((m) => m.id === organizationId);
+      if (!organization || !snap.userId) throw new NotAMemberError(organizationId);
+      generation += 1;
+      await held.write(snap.userId, organizationId);
+      publish({ ...snap, status: "ready", organizationId, organization, rung: "switched", error: null });
+      await writeLastActiveOrganization(client, organizationId);
+    },
+    async handleRefusal(status, body) {
+      const kind = classifyOrganizationRefusal(status, body);
+      if (kind === "lapsed") {
+        if (current.userId) await held.clear();
+        await load();
+      }
+      return kind;
+    },
+    dispose() {
+      disposed = true;
+      generation += 1;
+      stopSession();
+      listeners.clear();
+      const pending = waiters;
+      waiters = [];
+      for (const w of pending) w();
+    }
+  };
+  if (options.autoLoad ?? true) void load();
+  return api;
+}