@ai-matrx/data 0.14.2 → 0.15.0

package/dist/db.d.cts

@@ -523,4 +523,42 @@ declare function encodeActiveOrgSelection(selection: ActiveOrgSelection): string
 declare function decodeActiveOrgSelection(raw: string | null | undefined): ActiveOrgSelection | null;
 declare function createActiveOrgCookie(args: CreateActiveOrgCookieArgs): ActiveOrgCookie;
 
-export { type ActiveOrgCookie, type ActiveOrgCookieOptions, type ActiveOrgSelection, type AuthRetryableResult, type CreateActiveOrgCookieArgs, type CreateSessionRetryOptions, DEFAULT_ACTIVE_ORG_COOKIE_MAX_AGE, DEFAULT_ACTIVE_ORG_COOKIE_NAME, type GuardedUpdateArgs, type GuardedUpdateResult, IncompleteReadError, type JsonObject, type MergeJsonColumnArgs, type MergeJsonColumnResult, type PagedReadQuery, type PagedReadResult, type ReadAllRowsOptions, type ReadAllRowsRestOptions, type SessionSource, SessionUnavailableError, type VersionedRow, asJsonObject, createActiveOrgCookie, createSessionRetry, decodeActiveOrgSelection, encodeActiveOrgSelection, guardedUpdate, isMissingSessionError, mergeJsonColumn, readAllRows, readAllRowsRest, tryReadAllRows, tryReadAllRowsRest };
+/**
+ * OAuth-aware transport for a Supabase auth-js client.
+ *
+ * Supabase's ordinary GoTrue refresh endpoint is `/auth/v1/token`, while a
+ * session minted for a registered OAuth client must refresh at
+ * `/auth/v1/oauth/token` and include that client id.  auth-js owns session
+ * storage, locking, rotation and notifications; this module changes only the
+ * one outbound refresh request after proving that its refresh token belongs to
+ * an allowlisted OAuth client.  It never calls `auth.getSession()`.
+ */
+interface OAuthRefreshStorage {
+    getItem(key: string): string | null | Promise<string | null>;
+}
+interface CreateOAuthRefreshFetchArgs {
+    /** The exact Supabase project origin, e.g. `https://db.matrxserver.com`. */
+    supabaseUrl: string;
+    /** The same auth storage auth-js uses. */
+    storage: OAuthRefreshStorage;
+    /** The auth-js storage key containing the persisted session JSON. */
+    storageKey: string;
+    /** Public OAuth client ids this host is intentionally allowed to refresh. */
+    oauthClientIds: readonly string[];
+    /** Injectable only for tests and non-browser hosts. */
+    fetch?: typeof globalThis.fetch;
+}
+interface JwtClaims {
+    sub?: unknown;
+    client_id?: unknown;
+    exp?: unknown;
+}
+/** Decode routing metadata only. The server remains the authentication authority. */
+declare function decodeOAuthRefreshClaims(token: string): JwtClaims | null;
+/**
+ * Returns a fetch implementation suitable for `createClient(..., { global:
+ * { fetch } })`. Normal sessions and unrelated requests pass through exactly.
+ */
+declare function createOAuthRefreshFetch(args: CreateOAuthRefreshFetchArgs): typeof globalThis.fetch;
+
+export { type ActiveOrgCookie, type ActiveOrgCookieOptions, type ActiveOrgSelection, type AuthRetryableResult, type CreateActiveOrgCookieArgs, type CreateOAuthRefreshFetchArgs, type CreateSessionRetryOptions, DEFAULT_ACTIVE_ORG_COOKIE_MAX_AGE, DEFAULT_ACTIVE_ORG_COOKIE_NAME, type GuardedUpdateArgs, type GuardedUpdateResult, IncompleteReadError, type JsonObject, type MergeJsonColumnArgs, type MergeJsonColumnResult, type OAuthRefreshStorage, type PagedReadQuery, type PagedReadResult, type ReadAllRowsOptions, type ReadAllRowsRestOptions, type SessionSource, SessionUnavailableError, type VersionedRow, asJsonObject, createActiveOrgCookie, createOAuthRefreshFetch, createSessionRetry, decodeActiveOrgSelection, decodeOAuthRefreshClaims, encodeActiveOrgSelection, guardedUpdate, isMissingSessionError, mergeJsonColumn, readAllRows, readAllRowsRest, tryReadAllRows, tryReadAllRowsRest };

package/dist/db.d.ts

@@ -523,4 +523,42 @@ declare function encodeActiveOrgSelection(selection: ActiveOrgSelection): string
 declare function decodeActiveOrgSelection(raw: string | null | undefined): ActiveOrgSelection | null;
 declare function createActiveOrgCookie(args: CreateActiveOrgCookieArgs): ActiveOrgCookie;
 
-export { type ActiveOrgCookie, type ActiveOrgCookieOptions, type ActiveOrgSelection, type AuthRetryableResult, type CreateActiveOrgCookieArgs, type CreateSessionRetryOptions, DEFAULT_ACTIVE_ORG_COOKIE_MAX_AGE, DEFAULT_ACTIVE_ORG_COOKIE_NAME, type GuardedUpdateArgs, type GuardedUpdateResult, IncompleteReadError, type JsonObject, type MergeJsonColumnArgs, type MergeJsonColumnResult, type PagedReadQuery, type PagedReadResult, type ReadAllRowsOptions, type ReadAllRowsRestOptions, type SessionSource, SessionUnavailableError, type VersionedRow, asJsonObject, createActiveOrgCookie, createSessionRetry, decodeActiveOrgSelection, encodeActiveOrgSelection, guardedUpdate, isMissingSessionError, mergeJsonColumn, readAllRows, readAllRowsRest, tryReadAllRows, tryReadAllRowsRest };
+/**
+ * OAuth-aware transport for a Supabase auth-js client.
+ *
+ * Supabase's ordinary GoTrue refresh endpoint is `/auth/v1/token`, while a
+ * session minted for a registered OAuth client must refresh at
+ * `/auth/v1/oauth/token` and include that client id.  auth-js owns session
+ * storage, locking, rotation and notifications; this module changes only the
+ * one outbound refresh request after proving that its refresh token belongs to
+ * an allowlisted OAuth client.  It never calls `auth.getSession()`.
+ */
+interface OAuthRefreshStorage {
+    getItem(key: string): string | null | Promise<string | null>;
+}
+interface CreateOAuthRefreshFetchArgs {
+    /** The exact Supabase project origin, e.g. `https://db.matrxserver.com`. */
+    supabaseUrl: string;
+    /** The same auth storage auth-js uses. */
+    storage: OAuthRefreshStorage;
+    /** The auth-js storage key containing the persisted session JSON. */
+    storageKey: string;
+    /** Public OAuth client ids this host is intentionally allowed to refresh. */
+    oauthClientIds: readonly string[];
+    /** Injectable only for tests and non-browser hosts. */
+    fetch?: typeof globalThis.fetch;
+}
+interface JwtClaims {
+    sub?: unknown;
+    client_id?: unknown;
+    exp?: unknown;
+}
+/** Decode routing metadata only. The server remains the authentication authority. */
+declare function decodeOAuthRefreshClaims(token: string): JwtClaims | null;
+/**
+ * Returns a fetch implementation suitable for `createClient(..., { global:
+ * { fetch } })`. Normal sessions and unrelated requests pass through exactly.
+ */
+declare function createOAuthRefreshFetch(args: CreateOAuthRefreshFetchArgs): typeof globalThis.fetch;
+
+export { type ActiveOrgCookie, type ActiveOrgCookieOptions, type ActiveOrgSelection, type AuthRetryableResult, type CreateActiveOrgCookieArgs, type CreateOAuthRefreshFetchArgs, type CreateSessionRetryOptions, DEFAULT_ACTIVE_ORG_COOKIE_MAX_AGE, DEFAULT_ACTIVE_ORG_COOKIE_NAME, type GuardedUpdateArgs, type GuardedUpdateResult, IncompleteReadError, type JsonObject, type MergeJsonColumnArgs, type MergeJsonColumnResult, type OAuthRefreshStorage, type PagedReadQuery, type PagedReadResult, type ReadAllRowsOptions, type ReadAllRowsRestOptions, type SessionSource, SessionUnavailableError, type VersionedRow, asJsonObject, createActiveOrgCookie, createOAuthRefreshFetch, createSessionRetry, decodeActiveOrgSelection, decodeOAuthRefreshClaims, encodeActiveOrgSelection, guardedUpdate, isMissingSessionError, mergeJsonColumn, readAllRows, readAllRowsRest, tryReadAllRows, tryReadAllRowsRest };

package/dist/db.js

@@ -475,6 +475,159 @@ function createActiveOrgCookie(args) {
 
 // src/db/realtime.ts
 import { uniqueChannelTopic } from "@ai-matrx/realtime";
+
+// src/db/oauth-refresh-transport.ts
+function object(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function text(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+function decodeOAuthRefreshClaims(token) {
+  const payload = token.split(".")[1];
+  if (!payload) return null;
+  try {
+    const normalized = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = normalized + "=".repeat((4 - normalized.length % 4) % 4);
+    const json = typeof atob === "function" ? atob(padded) : Buffer.from(padded, "base64").toString("utf8");
+    return object(JSON.parse(json)) ?? null;
+  } catch {
+    return null;
+  }
+}
+function isOrdinaryRefreshRequest(input, init, origin) {
+  const request = input instanceof Request ? input : null;
+  const url = new URL(request?.url ?? String(input), origin);
+  const method = (init?.method ?? request?.method ?? "GET").toUpperCase();
+  return method === "POST" && url.origin === origin && url.pathname === "/auth/v1/token" && url.searchParams.get("grant_type") === "refresh_token";
+}
+async function refreshTokenFrom(input, init) {
+  let body = init?.body;
+  if (body === void 0 && input instanceof Request) body = await input.clone().text();
+  if (body instanceof URLSearchParams) return body.get("refresh_token");
+  if (typeof body !== "string") return null;
+  try {
+    return text(object(JSON.parse(body))?.refresh_token);
+  } catch {
+    return new URLSearchParams(body).get("refresh_token");
+  }
+}
+function rewrittenInit(input, init, headers, body) {
+  const request = input instanceof Request ? input : null;
+  const copied = {
+    // init takes precedence, just as native fetch does. Copying Request fields
+    // preserves the public Fetch contract after replacing its body.
+    method: "POST",
+    headers,
+    body
+  };
+  const inherited = {
+    credentials: init?.credentials ?? request?.credentials,
+    cache: init?.cache ?? request?.cache,
+    redirect: init?.redirect ?? request?.redirect,
+    referrer: init?.referrer ?? request?.referrer,
+    referrerPolicy: init?.referrerPolicy ?? request?.referrerPolicy,
+    integrity: init?.integrity ?? request?.integrity,
+    keepalive: init?.keepalive ?? request?.keepalive,
+    signal: init?.signal ?? request?.signal
+  };
+  for (const [key, value] of Object.entries(inherited)) {
+    if (value !== void 0) Object.assign(copied, { [key]: value });
+  }
+  return copied;
+}
+async function storedSession(storage, key) {
+  const raw = await storage.getItem(key);
+  if (!raw) return null;
+  try {
+    return object(JSON.parse(raw));
+  } catch {
+    return null;
+  }
+}
+function sameSubject(previousAccessToken, refreshedAccessToken, clientId) {
+  const previous = decodeOAuthRefreshClaims(previousAccessToken);
+  const refreshed = decodeOAuthRefreshClaims(refreshedAccessToken);
+  return text(previous?.sub) !== null && previous?.sub === refreshed?.sub && previous?.client_id === clientId && refreshed?.client_id === clientId;
+}
+function retryableRefusal(message) {
+  return new Response(JSON.stringify({ error: "temporarily_unavailable", error_description: message }), {
+    status: 503,
+    headers: { "content-type": "application/json", "retry-after": "1" }
+  });
+}
+async function normalizeOAuthResponse(response, session, clientId) {
+  if (!response.ok) return response;
+  const previousAccessToken = text(session.access_token);
+  const previousUser = session.user;
+  const previousSubject = previousAccessToken ? text(decodeOAuthRefreshClaims(previousAccessToken)?.sub) : null;
+  if (!previousAccessToken || !previousSubject || text(object(previousUser)?.id) !== previousSubject) {
+    return retryableRefusal("Stored OAuth identity does not match its credential. Restore the account connection.");
+  }
+  let payload = null;
+  try {
+    payload = object(await response.clone().json());
+  } catch {
+    return retryableRefusal("OAuth refresh returned an invalid response.");
+  }
+  const refreshedAccessToken = text(payload?.access_token);
+  if (!payload || !refreshedAccessToken || !sameSubject(previousAccessToken, refreshedAccessToken, clientId)) {
+    return retryableRefusal("OAuth refresh returned a credential for an unexpected identity or client.");
+  }
+  if (payload.user !== void 0 && text(object(payload.user)?.id) !== previousSubject) {
+    return retryableRefusal("OAuth refresh returned a user that does not match its credential.");
+  }
+  if (payload.user === void 0) payload.user = previousUser;
+  if (text(payload.refresh_token) === null) payload.refresh_token = session.refresh_token;
+  const headers = new Headers(response.headers);
+  headers.set("content-type", "application/json");
+  return new Response(JSON.stringify(payload), {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+async function replacementAfterRejectedRefresh(response, storage, storageKey, previous, clientId) {
+  if (response.status !== 400 && response.status !== 401) return response;
+  const replacement = await storedSession(storage, storageKey);
+  const previousRefresh = text(previous.refresh_token);
+  const replacementRefresh = text(replacement?.refresh_token);
+  const previousAccess = text(previous.access_token);
+  const replacementAccess = text(replacement?.access_token);
+  if (!replacement || !previousRefresh || !replacementRefresh || replacementRefresh === previousRefresh || !previousAccess || !replacementAccess || !sameSubject(previousAccess, replacementAccess, clientId) || replacement.user === void 0) return response;
+  return new Response(JSON.stringify(replacement), {
+    status: 200,
+    headers: { "content-type": "application/json" }
+  });
+}
+function createOAuthRefreshFetch(args) {
+  const origin = new URL(args.supabaseUrl).origin;
+  const upstream = args.fetch ?? globalThis.fetch;
+  const allowed = new Set(args.oauthClientIds);
+  return async (input, init) => {
+    if (!isOrdinaryRefreshRequest(input, init, origin)) return upstream(input, init);
+    const refreshToken = await refreshTokenFrom(input, init);
+    const session = await storedSession(args.storage, args.storageKey);
+    const storedRefreshToken = text(session?.refresh_token);
+    const accessToken = text(session?.access_token);
+    const clientId = accessToken ? text(decodeOAuthRefreshClaims(accessToken)?.client_id) : null;
+    if (!session || !clientId) {
+      return upstream(input, init);
+    }
+    if (!allowed.has(clientId)) return retryableRefusal("This OAuth client is not allowed to refresh in this host.");
+    if (!refreshToken || refreshToken !== storedRefreshToken) {
+      return retryableRefusal("OAuth refresh token no longer matches the stored session; resolve the session again.");
+    }
+    const request = input instanceof Request ? input : null;
+    const headers = new Headers(init?.headers ?? request?.headers);
+    headers.set("content-type", "application/x-www-form-urlencoded");
+    const body = new URLSearchParams({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: clientId });
+    const response = await upstream(`${origin}/auth/v1/oauth/token`, rewrittenInit(input, init, headers, body));
+    const adopted = await replacementAfterRejectedRefresh(response, args.storage, args.storageKey, session, clientId);
+    const responseSession = adopted === response ? session : await storedSession(args.storage, args.storageKey) ?? session;
+    return normalizeOAuthResponse(adopted, responseSession, clientId);
+  };
+}
 export {
   DEFAULT_ACTIVE_ORG_COOKIE_MAX_AGE,
   DEFAULT_ACTIVE_ORG_COOKIE_NAME,
@@ -484,8 +637,10 @@ export {
   asJsonObject,
   createActiveOrgCookie,
   createAuthCookie,
+  createOAuthRefreshFetch,
   createSessionRetry,
   decodeActiveOrgSelection,
+  decodeOAuthRefreshClaims,
   encodeActiveOrgSelection,
   guardedUpdate,
   isMissingSessionError,