@ankhorage/infra 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @ankhorage/infra
 
+## 0.2.0
+
+### Minor Changes
+
+- 6abebe9: Generate Supabase profile table metadata and migrations from `manifest.infra.auth.profile`.
+
 ## 0.1.0
 
 ### Minor Changes

package/dist/adapters/minikube/auth/supabase/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/minikube/auth/supabase/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAEhE,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,wBAAwB,CAiE3B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/minikube/auth/supabase/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAEhE,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,wBAAwB,CA6E3B"}

package/dist/adapters/minikube/auth/supabase/index.js

@@ -3,10 +3,12 @@ export function generateSupabaseAuthArtifacts(args) {
     const root = 'infra/minikube/k8s/auth/supabase';
     const resourceRoot = 'auth/supabase';
     const docsRoot = 'infra/minikube/auth';
+    const migrationRoot = 'infra/minikube/supabase/migrations';
     const scope = manifest.auth?.scope ?? 'global';
     const authzEngine = manifest.auth?.authorization.engine ?? 'native';
     const authzKind = manifest.auth?.authorization.kind ?? 'RBAC';
     const authFieldModel = resolveAuthFieldModel(manifest);
+    const profileModel = resolveProfileModel(manifest);
     const warnings = [];
     if (scope !== 'global') {
         warnings.push(`Auth scope "${scope}" is not fully modeled yet for Supabase. Baseline resources assume global auth.`);
@@ -21,6 +23,7 @@ export function generateSupabaseAuthArtifacts(args) {
                     authzEngine,
                     authzKind,
                     authFieldModel,
+                    profileModel,
                 }),
             },
             {
@@ -35,11 +38,20 @@ export function generateSupabaseAuthArtifacts(args) {
                     authzEngine,
                     authzKind,
                     authFieldModel,
+                    profileModel,
                 }),
             },
+            ...(profileModel.enabled
+                ? [
+                    {
+                        path: `${migrationRoot}/0001_auth_profiles.sql`,
+                        content: getSupabaseProfileMigration(profileModel),
+                    },
+                ]
+                : []),
             {
                 path: `${docsRoot}/supabase-runtime-wiring.md`,
-                content: getSupabaseRuntimeWiringGuide(),
+                content: getSupabaseRuntimeWiringGuide(profileModel),
             },
         ],
         resources: [
@@ -60,7 +72,7 @@ export function generateSupabaseAuthArtifacts(args) {
     };
 }
 function getSupabaseConfigMap(args) {
-    const { namespace, scope, authzEngine, authzKind, authFieldModel } = args;
+    const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;
     return `apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -76,6 +88,10 @@ data:
   AUTH_SIGN_UP_OPTIONAL_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}"
   AUTH_SIGN_UP_POLICY: "${authFieldModel.signUpPolicy}"
   AUTH_PROFILE_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}"
+  AUTH_PROFILE_TABLE: "${escapeYamlDoubleQuoted(profileModel.table)}"
+  AUTH_PROFILE_PRIMARY_KEY: "${profileModel.primaryKey}"
+  AUTH_PROFILE_CREATE_STRATEGY: "${profileModel.createStrategy}"
+  AUTH_PROFILE_UPDATE_STRATEGY: "${profileModel.updateStrategy}"
 `;
 }
 function getSupabaseSecret(namespace) {
@@ -95,7 +111,7 @@ stringData:
 `;
 }
 function getRuntimeAuthEnvConfigMap(args) {
-    const { namespace, scope, authzEngine, authzKind, authFieldModel } = args;
+    const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;
     return `apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -112,11 +128,31 @@ data:
   AUTH_SIGN_UP_OPTIONAL_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}"
   AUTH_SIGN_UP_POLICY: "${authFieldModel.signUpPolicy}"
   AUTH_PROFILE_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}"
+  AUTH_PROFILE_TABLE: "${escapeYamlDoubleQuoted(profileModel.table)}"
+  AUTH_PROFILE_PRIMARY_KEY: "${profileModel.primaryKey}"
+  AUTH_PROFILE_CREATE_STRATEGY: "${profileModel.createStrategy}"
+  AUTH_PROFILE_UPDATE_STRATEGY: "${profileModel.updateStrategy}"
   AUTH_TOKEN_HEADER: "Authorization"
   AUTH_TOKEN_PREFIX: "Bearer"
 `;
 }
-function getSupabaseRuntimeWiringGuide() {
+function getSupabaseRuntimeWiringGuide(profileModel) {
+    const profileSection = profileModel.enabled
+        ? `
+## App Profile Table
+
+Identity remains provider-owned in \`auth.users\`. App-facing profile data is generated in
+\`public.${profileModel.table}\` and linked through \`${profileModel.table}.id -> auth.users.id\`.
+
+The generated migration:
+
+- creates the profile table
+- enables row-level security
+- allows signed-in users to read and update their own profile row
+- protects the generated \`role\` column from self-service profile updates
+- creates a trigger for new auth users when \`AUTH_PROFILE_CREATE_STRATEGY=trigger\`
+`
+        : '';
     return `# Supabase Runtime Wiring
 
 This file documents the runtime conventions generated by the minikube Supabase adapter.
@@ -159,6 +195,10 @@ with \`optional: true\` for auth sources.
 - \`AUTH_SIGN_UP_OPTIONAL_FIELDS\`
 - \`AUTH_SIGN_UP_POLICY\`
 - \`AUTH_PROFILE_FIELDS\`
+- \`AUTH_PROFILE_TABLE\`
+- \`AUTH_PROFILE_PRIMARY_KEY\`
+- \`AUTH_PROFILE_CREATE_STRATEGY\`
+- \`AUTH_PROFILE_UPDATE_STRATEGY\`
 - \`SUPABASE_SECRET_SYNC_ENABLED\`
 - \`SUPABASE_URL\`
 - \`SUPABASE_ANON_KEY\`
@@ -166,7 +206,7 @@ with \`optional: true\` for auth sources.
 - \`SUPABASE_JWT_SECRET\`
 - \`EXPO_PUBLIC_SUPABASE_URL\`
 - \`EXPO_PUBLIC_SUPABASE_ANON_KEY\`
-
+${profileSection}
 ## Secret Sync
 
 When \`SUPABASE_SECRET_SYNC_ENABLED=true\`, \`scripts/up.sh\` will create/update
@@ -178,6 +218,9 @@ const DEFAULT_SIGN_UP_REQUIRED_FIELDS = ['email', 'password'];
 const DEFAULT_SIGN_UP_OPTIONAL_FIELDS = ['firstName', 'lastName'];
 const DEFAULT_SIGN_UP_POLICY = 'autoSignIn';
 const DEFAULT_PROFILE_FIELDS = ['email', 'firstName', 'lastName'];
+const DEFAULT_PROFILE_PRIMARY_KEY = 'authUserId';
+const DEFAULT_PROFILE_CREATE_STRATEGY = 'trigger';
+const DEFAULT_PROFILE_UPDATE_STRATEGY = 'api';
 function resolveAuthFieldModel(manifest) {
     const signInIdentifiers = normalizeFieldList(manifest.auth?.signIn?.identifiers, DEFAULT_SIGN_IN_IDENTIFIERS);
     const signUpRequiredFields = normalizeFieldList(manifest.auth?.signUp?.requiredFields, DEFAULT_SIGN_UP_REQUIRED_FIELDS);
@@ -192,6 +235,144 @@ function resolveAuthFieldModel(manifest) {
         profileFieldsCsv: profileFields.join(','),
     };
 }
+function resolveProfileModel(manifest) {
+    const table = normalizeIdentifier(manifest.auth?.profile?.table ?? '');
+    const fields = normalizeFieldList(manifest.auth?.profile?.fields, DEFAULT_PROFILE_FIELDS);
+    return {
+        enabled: table.length > 0,
+        table,
+        primaryKey: manifest.auth?.profile?.primaryKey ?? DEFAULT_PROFILE_PRIMARY_KEY,
+        createStrategy: manifest.auth?.profile?.createStrategy ?? DEFAULT_PROFILE_CREATE_STRATEGY,
+        updateStrategy: manifest.auth?.profile?.updateStrategy ?? DEFAULT_PROFILE_UPDATE_STRATEGY,
+        columns: resolveProfileColumns(fields),
+    };
+}
+function getSupabaseProfileMigration(profileModel) {
+    const table = quoteIdentifier(profileModel.table);
+    const functionName = quoteIdentifier(`handle_new_${profileModel.table}_user`);
+    const triggerName = quoteIdentifier(`on_auth_user_created_${profileModel.table}`);
+    const columnDefinitions = profileModel.columns
+        .map((column) => `  ${quoteIdentifier(column.column)} ${column.sqlType}`)
+        .join(',\n');
+    const insertColumns = ['id', ...profileModel.columns.map((column) => column.column)]
+        .map(quoteIdentifier)
+        .join(', ');
+    const insertValues = ['new.id', ...profileModel.columns.map((column) => column.fromNewUser)].join(', ');
+    const updateAssignments = profileModel.columns
+        .filter((column) => column.field === 'email')
+        .map((column) => `${quoteIdentifier(column.column)} = excluded.${quoteIdentifier(column.column)}`);
+    const conflictUpdate = [...updateAssignments, 'updated_at = now()'].join(',\n    ');
+    const updateGrantColumns = profileModel.columns.map((column) => quoteIdentifier(column.column));
+    const updateGrantSql = updateGrantColumns.length > 0
+        ? `grant update (${updateGrantColumns.join(', ')}) on table public.${table} to authenticated;\n`
+        : '';
+    const triggerSql = profileModel.createStrategy === 'trigger'
+        ? `
+create or replace function public.${functionName}()
+returns trigger
+language plpgsql
+security definer
+set search_path = public
+as $$
+begin
+  insert into public.${table} (${insertColumns})
+  values (${insertValues})
+  on conflict (id) do update set
+    ${conflictUpdate};
+
+  return new;
+end;
+$$;
+
+drop trigger if exists ${triggerName} on auth.users;
+create trigger ${triggerName}
+  after insert on auth.users
+  for each row execute function public.${functionName}();
+`
+        : '';
+    return `-- Generated by @ankhorage/infra from manifest.infra.auth.profile.
+-- Supabase Auth owns identity in auth.users. App-facing profile data lives in public.${profileModel.table}.
+
+create table if not exists public.${table} (
+  id uuid primary key references auth.users(id) on delete cascade${columnDefinitions ? `,\n${columnDefinitions}` : ''},
+  role text not null default 'user',
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+alter table public.${table} enable row level security;
+
+revoke all on table public.${table} from anon, authenticated;
+grant select on table public.${table} to authenticated;
+${updateGrantSql}
+create policy ${quoteIdentifier(`${profileModel.table}_select_own`)}
+  on public.${table}
+  for select
+  using (auth.uid() = id);
+
+create policy ${quoteIdentifier(`${profileModel.table}_update_own`)}
+  on public.${table}
+  for update
+  using (auth.uid() = id)
+  with check (auth.uid() = id);
+${triggerSql}`;
+}
+function resolveProfileColumns(fields) {
+    const columns = new Map();
+    for (const field of fields) {
+        const column = mapProfileFieldToColumn(field);
+        if (!column || columns.has(column.column)) {
+            continue;
+        }
+        columns.set(column.column, column);
+    }
+    return [...columns.values()];
+}
+function mapProfileFieldToColumn(field) {
+    switch (field) {
+        case 'email':
+            return { field, column: 'email', sqlType: 'text', fromNewUser: 'new.email' };
+        case 'displayName':
+            return {
+                field,
+                column: 'display_name',
+                sqlType: 'text',
+                fromNewUser: "coalesce(new.raw_user_meta_data->>'displayName', new.raw_user_meta_data->>'display_name', split_part(new.email, '@', 1))",
+            };
+        case 'firstName':
+            return {
+                field,
+                column: 'first_name',
+                sqlType: 'text',
+                fromNewUser: "coalesce(new.raw_user_meta_data->>'firstName', new.raw_user_meta_data->>'first_name')",
+            };
+        case 'lastName':
+            return {
+                field,
+                column: 'last_name',
+                sqlType: 'text',
+                fromNewUser: "coalesce(new.raw_user_meta_data->>'lastName', new.raw_user_meta_data->>'last_name')",
+            };
+        case 'avatarUrl':
+            return {
+                field,
+                column: 'avatar_url',
+                sqlType: 'text',
+                fromNewUser: "coalesce(new.raw_user_meta_data->>'avatarUrl', new.raw_user_meta_data->>'avatar_url')",
+            };
+        case 'username':
+            return {
+                field,
+                column: 'username',
+                sqlType: 'text',
+                fromNewUser: "new.raw_user_meta_data->>'username'",
+            };
+        case 'phone':
+            return { field, column: 'phone', sqlType: 'text', fromNewUser: 'new.phone' };
+        default:
+            return null;
+    }
+}
 function normalizeFieldList(values, fallback) {
     const source = values ?? fallback;
     const next = [];
@@ -207,6 +388,18 @@ function normalizeFieldList(values, fallback) {
     }
     return [...fallback];
 }
+function normalizeIdentifier(value) {
+    const trimmed = value.trim();
+    if (!trimmed)
+        return '';
+    if (!/^[a-z_][a-z0-9_]*$/.test(trimmed)) {
+        throw new Error(`Invalid Supabase profile table identifier "${trimmed}". Use snake_case letters, numbers, and underscores.`);
+    }
+    return trimmed;
+}
+function quoteIdentifier(value) {
+    return `"${value.replaceAll('"', '""')}"`;
+}
 function escapeYamlDoubleQuoted(value) {
     return value.replaceAll('\\', '\\\\').replaceAll('"', '\\"');
 }

package/dist/adapters/minikube/auth/supabase/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/auth/supabase/index.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,6BAA6B,CAAC,IAG7C;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAErC,MAAM,IAAI,GAAG,kCAAkC,CAAC;IAChD,MAAM,YAAY,GAAG,eAAe,CAAC;IACrC,MAAM,QAAQ,GAAG,qBAAqB,CAAC;IACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,QAAQ,CAAC;IAC/C,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,IAAI,QAAQ,CAAC;IACpE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,IAAI,MAAM,CAAC;IAC9D,MAAM,cAAc,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,eAAe,KAAK,iFAAiF,CACtG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,GAAG,IAAI,+BAA+B;gBAC5C,OAAO,EAAE,oBAAoB,CAAC;oBAC5B,SAAS;oBACT,KAAK;oBACL,WAAW;oBACX,SAAS;oBACT,cAAc;iBACf,CAAC;aACH;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,4BAA4B;gBACzC,OAAO,EAAE,iBAAiB,CAAC,SAAS,CAAC;aACtC;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,sCAAsC;gBACnD,OAAO,EAAE,0BAA0B,CAAC;oBAClC,SAAS;oBACT,KAAK;oBACL,WAAW;oBACX,SAAS;oBACT,cAAc;iBACf,CAAC;aACH;YACD;gBACE,IAAI,EAAE,GAAG,QAAQ,6BAA6B;gBAC9C,OAAO,EAAE,6BAA6B,EAAE;aACzC;SACF;QACD,SAAS,EAAE;YACT,GAAG,YAAY,+BAA+B;YAC9C,GAAG,YAAY,4BAA4B;YAC3C,GAAG,YAAY,sCAAsC;SACtD;QACD,UAAU,EAAE;YACV,mCAAmC;YACnC,eAAe;YACf,oBAAoB;YACpB,4BAA4B;YAC5B,sBAAsB;YACtB,2BAA2B;YAC3B,gCAAgC;SACjC;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAM7B;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAE1E,OAAO;;;;eAIM,SAAS;;;iBAGP,KAAK;mBACH,WAAW;iBACb,SAAS;+BACK,sBAAsB,CAAC,cAAc,CAAC,oBAAoB,CAAC;mCACvD,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;mCAC9D,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;0BACvE,cAAc,CAAC,YAAY;0BAC3B,sBAAsB,CAAC,cAAc,CAAC,gBAAgB,CAAC;CAChF,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,OAAO;;;;eAIM,SAAS;;;;;;;;;CASvB,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B,CAAC,IAMnC;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAE1E,OAAO;;;;eAIM,SAAS;;;;iBAIP,KAAK;mBACH,WAAW;iBACb,SAAS;+BACK,sBAAsB,CAAC,cAAc,CAAC,oBAAoB,CAAC;mCACvD,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;mCAC9D,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;0BACvE,cAAc,CAAC,YAAY;0BAC3B,sBAAsB,CAAC,cAAc,CAAC,gBAAgB,CAAC;;;CAGhF,CAAC;AACF,CAAC;AAED,SAAS,6BAA6B;IACpC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsDR,CAAC;AACF,CAAC;AAED,MAAM,2BAA2B,GAAG,CAAC,OAAO,CAAC,CAAC;AAC9C,MAAM,+BAA+B,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC9D,MAAM,+BAA+B,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;AAClE,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAC5C,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAUlE,SAAS,qBAAqB,CAAC,QAA4B;IACzD,MAAM,iBAAiB,GAAG,kBAAkB,CAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAClC,2BAA2B,CAC5B,CAAC;IACF,MAAM,oBAAoB,GAAG,kBAAkB,CAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EACrC,+BAA+B,CAChC,CAAC;IACF,MAAM,oBAAoB,GAAG,kBAAkB,CAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EACrC,+BAA+B,CAChC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,IAAI,sBAAsB,CAAC;IACnF,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAEjG,OAAO;QACL,oBAAoB,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QACjD,uBAAuB,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QACvD,uBAAuB,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QACvD,YAAY;QACZ,gBAAgB,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAqC,EACrC,QAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC;IAClC,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC","sourcesContent":["import type { InfraManifestInput } from '../../../../types';\nimport type { MinikubeAdapterArtifacts } from '../../contracts';\n\nexport function generateSupabaseAuthArtifacts(args: {\n  manifest: InfraManifestInput;\n  namespace: string;\n}): MinikubeAdapterArtifacts {\n  const { manifest, namespace } = args;\n\n  const root = 'infra/minikube/k8s/auth/supabase';\n  const resourceRoot = 'auth/supabase';\n  const docsRoot = 'infra/minikube/auth';\n  const scope = manifest.auth?.scope ?? 'global';\n  const authzEngine = manifest.auth?.authorization.engine ?? 'native';\n  const authzKind = manifest.auth?.authorization.kind ?? 'RBAC';\n  const authFieldModel = resolveAuthFieldModel(manifest);\n\n  const warnings: string[] = [];\n  if (scope !== 'global') {\n    warnings.push(\n      `Auth scope \"${scope}\" is not fully modeled yet for Supabase. Baseline resources assume global auth.`,\n    );\n  }\n\n  return {\n    files: [\n      {\n        path: `${root}/supabase-auth.configmap.yaml`,\n        content: getSupabaseConfigMap({\n          namespace,\n          scope,\n          authzEngine,\n          authzKind,\n          authFieldModel,\n        }),\n      },\n      {\n        path: `${root}/supabase-auth.secret.yaml`,\n        content: getSupabaseSecret(namespace),\n      },\n      {\n        path: `${root}/app-runtime-auth.env.configmap.yaml`,\n        content: getRuntimeAuthEnvConfigMap({\n          namespace,\n          scope,\n          authzEngine,\n          authzKind,\n          authFieldModel,\n        }),\n      },\n      {\n        path: `${docsRoot}/supabase-runtime-wiring.md`,\n        content: getSupabaseRuntimeWiringGuide(),\n      },\n    ],\n    resources: [\n      `${resourceRoot}/supabase-auth.configmap.yaml`,\n      `${resourceRoot}/supabase-auth.secret.yaml`,\n      `${resourceRoot}/app-runtime-auth.env.configmap.yaml`,\n    ],\n    envEntries: [\n      'SUPABASE_SECRET_SYNC_ENABLED=true',\n      'SUPABASE_URL=',\n      'SUPABASE_ANON_KEY=',\n      'SUPABASE_SERVICE_ROLE_KEY=',\n      'SUPABASE_JWT_SECRET=',\n      'EXPO_PUBLIC_SUPABASE_URL=',\n      'EXPO_PUBLIC_SUPABASE_ANON_KEY=',\n    ],\n    warnings,\n  };\n}\n\nfunction getSupabaseConfigMap(args: {\n  namespace: string;\n  scope: string;\n  authzEngine: string;\n  authzKind: string;\n  authFieldModel: ResolvedAuthFieldModel;\n}) {\n  const { namespace, scope, authzEngine, authzKind, authFieldModel } = args;\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: supabase-auth-config\n  namespace: ${namespace}\ndata:\n  AUTH_PROVIDER: \"supabase\"\n  AUTH_SCOPE: \"${scope}\"\n  AUTHZ_ENGINE: \"${authzEngine}\"\n  AUTHZ_KIND: \"${authzKind}\"\n  AUTH_SIGN_IN_IDENTIFIERS: \"${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}\"\n  AUTH_SIGN_UP_REQUIRED_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}\"\n  AUTH_SIGN_UP_OPTIONAL_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}\"\n  AUTH_SIGN_UP_POLICY: \"${authFieldModel.signUpPolicy}\"\n  AUTH_PROFILE_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}\"\n`;\n}\n\nfunction getSupabaseSecret(namespace: string) {\n  return `apiVersion: v1\nkind: Secret\nmetadata:\n  name: supabase-auth-secrets\n  namespace: ${namespace}\ntype: Opaque\nstringData:\n  SUPABASE_URL: \"\"\n  SUPABASE_ANON_KEY: \"\"\n  SUPABASE_SERVICE_ROLE_KEY: \"\"\n  SUPABASE_JWT_SECRET: \"\"\n  EXPO_PUBLIC_SUPABASE_URL: \"\"\n  EXPO_PUBLIC_SUPABASE_ANON_KEY: \"\"\n`;\n}\n\nfunction getRuntimeAuthEnvConfigMap(args: {\n  namespace: string;\n  scope: string;\n  authzEngine: string;\n  authzKind: string;\n  authFieldModel: ResolvedAuthFieldModel;\n}) {\n  const { namespace, scope, authzEngine, authzKind, authFieldModel } = args;\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: app-runtime-auth-env\n  namespace: ${namespace}\ndata:\n  AUTH_REQUIRED: \"true\"\n  AUTH_PROVIDER: \"supabase\"\n  AUTH_SCOPE: \"${scope}\"\n  AUTHZ_ENGINE: \"${authzEngine}\"\n  AUTHZ_KIND: \"${authzKind}\"\n  AUTH_SIGN_IN_IDENTIFIERS: \"${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}\"\n  AUTH_SIGN_UP_REQUIRED_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}\"\n  AUTH_SIGN_UP_OPTIONAL_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}\"\n  AUTH_SIGN_UP_POLICY: \"${authFieldModel.signUpPolicy}\"\n  AUTH_PROFILE_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}\"\n  AUTH_TOKEN_HEADER: \"Authorization\"\n  AUTH_TOKEN_PREFIX: \"Bearer\"\n`;\n}\n\nfunction getSupabaseRuntimeWiringGuide() {\n  return `# Supabase Runtime Wiring\n\nThis file documents the runtime conventions generated by the minikube Supabase adapter.\n\n## Generated Kubernetes Objects\n\n- \\`ConfigMap/supabase-auth-config\\`: high-level auth metadata.\n- \\`Secret/supabase-auth-secrets\\`: Supabase keys and public runtime keys.\n- \\`ConfigMap/app-runtime-auth-env\\`: auth runtime feature flags and authz metadata.\n\n## App Runtime Convention\n\nYour app runtime deployment should import both:\n\n- \\`app-runtime-auth-env\\` (configMap)\n- \\`supabase-auth-secrets\\` (secret)\n\nExample deployment fragment:\n\n\\`\\`\\`yaml\nenvFrom:\n  - configMapRef:\n      name: app-runtime-auth-env\n  - secretRef:\n      name: supabase-auth-secrets\n\\`\\`\\`\n\nThe generated base deployment at \\`k8s/app/deployment.yaml\\` already includes this wiring\nwith \\`optional: true\\` for auth sources.\n\n## Expected Environment Variables\n\n- \\`AUTH_REQUIRED\\`\n- \\`AUTH_PROVIDER\\`\n- \\`AUTH_SCOPE\\`\n- \\`AUTHZ_ENGINE\\`\n- \\`AUTHZ_KIND\\`\n- \\`AUTH_SIGN_IN_IDENTIFIERS\\`\n- \\`AUTH_SIGN_UP_REQUIRED_FIELDS\\`\n- \\`AUTH_SIGN_UP_OPTIONAL_FIELDS\\`\n- \\`AUTH_SIGN_UP_POLICY\\`\n- \\`AUTH_PROFILE_FIELDS\\`\n- \\`SUPABASE_SECRET_SYNC_ENABLED\\`\n- \\`SUPABASE_URL\\`\n- \\`SUPABASE_ANON_KEY\\`\n- \\`SUPABASE_SERVICE_ROLE_KEY\\`\n- \\`SUPABASE_JWT_SECRET\\`\n- \\`EXPO_PUBLIC_SUPABASE_URL\\`\n- \\`EXPO_PUBLIC_SUPABASE_ANON_KEY\\`\n\n## Secret Sync\n\nWhen \\`SUPABASE_SECRET_SYNC_ENABLED=true\\`, \\`scripts/up.sh\\` will create/update\n\\`Secret/supabase-auth-secrets\\` from the loaded environment values.\n`;\n}\n\nconst DEFAULT_SIGN_IN_IDENTIFIERS = ['email'];\nconst DEFAULT_SIGN_UP_REQUIRED_FIELDS = ['email', 'password'];\nconst DEFAULT_SIGN_UP_OPTIONAL_FIELDS = ['firstName', 'lastName'];\nconst DEFAULT_SIGN_UP_POLICY = 'autoSignIn';\nconst DEFAULT_PROFILE_FIELDS = ['email', 'firstName', 'lastName'];\n\ninterface ResolvedAuthFieldModel {\n  signInIdentifiersCsv: string;\n  signUpRequiredFieldsCsv: string;\n  signUpOptionalFieldsCsv: string;\n  signUpPolicy: string;\n  profileFieldsCsv: string;\n}\n\nfunction resolveAuthFieldModel(manifest: InfraManifestInput): ResolvedAuthFieldModel {\n  const signInIdentifiers = normalizeFieldList(\n    manifest.auth?.signIn?.identifiers,\n    DEFAULT_SIGN_IN_IDENTIFIERS,\n  );\n  const signUpRequiredFields = normalizeFieldList(\n    manifest.auth?.signUp?.requiredFields,\n    DEFAULT_SIGN_UP_REQUIRED_FIELDS,\n  );\n  const signUpOptionalFields = normalizeFieldList(\n    manifest.auth?.signUp?.optionalFields,\n    DEFAULT_SIGN_UP_OPTIONAL_FIELDS,\n  ).filter((field) => !signUpRequiredFields.includes(field));\n  const signUpPolicy = manifest.auth?.signUp?.signUpPolicy ?? DEFAULT_SIGN_UP_POLICY;\n  const profileFields = normalizeFieldList(manifest.auth?.profile?.fields, DEFAULT_PROFILE_FIELDS);\n\n  return {\n    signInIdentifiersCsv: signInIdentifiers.join(','),\n    signUpRequiredFieldsCsv: signUpRequiredFields.join(','),\n    signUpOptionalFieldsCsv: signUpOptionalFields.join(','),\n    signUpPolicy,\n    profileFieldsCsv: profileFields.join(','),\n  };\n}\n\nfunction normalizeFieldList(\n  values: readonly string[] | undefined,\n  fallback: readonly string[],\n): string[] {\n  const source = values ?? fallback;\n  const next: string[] = [];\n\n  for (const value of source) {\n    const normalized = value.trim();\n    if (!normalized || next.includes(normalized)) {\n      continue;\n    }\n    next.push(normalized);\n  }\n\n  if (next.length > 0) {\n    return next;\n  }\n\n  return [...fallback];\n}\n\nfunction escapeYamlDoubleQuoted(value: string): string {\n  return value.replaceAll('\\\\', '\\\\\\\\').replaceAll('\"', '\\\\\"');\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/auth/supabase/index.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,6BAA6B,CAAC,IAG7C;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAErC,MAAM,IAAI,GAAG,kCAAkC,CAAC;IAChD,MAAM,YAAY,GAAG,eAAe,CAAC;IACrC,MAAM,QAAQ,GAAG,qBAAqB,CAAC;IACvC,MAAM,aAAa,GAAG,oCAAoC,CAAC;IAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,QAAQ,CAAC;IAC/C,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,IAAI,QAAQ,CAAC;IACpE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,IAAI,MAAM,CAAC;IAC9D,MAAM,cAAc,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAEnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,eAAe,KAAK,iFAAiF,CACtG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,GAAG,IAAI,+BAA+B;gBAC5C,OAAO,EAAE,oBAAoB,CAAC;oBAC5B,SAAS;oBACT,KAAK;oBACL,WAAW;oBACX,SAAS;oBACT,cAAc;oBACd,YAAY;iBACb,CAAC;aACH;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,4BAA4B;gBACzC,OAAO,EAAE,iBAAiB,CAAC,SAAS,CAAC;aACtC;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,sCAAsC;gBACnD,OAAO,EAAE,0BAA0B,CAAC;oBAClC,SAAS;oBACT,KAAK;oBACL,WAAW;oBACX,SAAS;oBACT,cAAc;oBACd,YAAY;iBACb,CAAC;aACH;YACD,GAAG,CAAC,YAAY,CAAC,OAAO;gBACtB,CAAC,CAAC;oBACE;wBACE,IAAI,EAAE,GAAG,aAAa,yBAAyB;wBAC/C,OAAO,EAAE,2BAA2B,CAAC,YAAY,CAAC;qBACnD;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP;gBACE,IAAI,EAAE,GAAG,QAAQ,6BAA6B;gBAC9C,OAAO,EAAE,6BAA6B,CAAC,YAAY,CAAC;aACrD;SACF;QACD,SAAS,EAAE;YACT,GAAG,YAAY,+BAA+B;YAC9C,GAAG,YAAY,4BAA4B;YAC3C,GAAG,YAAY,sCAAsC;SACtD;QACD,UAAU,EAAE;YACV,mCAAmC;YACnC,eAAe;YACf,oBAAoB;YACpB,4BAA4B;YAC5B,sBAAsB;YACtB,2BAA2B;YAC3B,gCAAgC;SACjC;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAO7B;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAExF,OAAO;;;;eAIM,SAAS;;;iBAGP,KAAK;mBACH,WAAW;iBACb,SAAS;+BACK,sBAAsB,CAAC,cAAc,CAAC,oBAAoB,CAAC;mCACvD,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;mCAC9D,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;0BACvE,cAAc,CAAC,YAAY;0BAC3B,sBAAsB,CAAC,cAAc,CAAC,gBAAgB,CAAC;yBACxD,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC;+BACpC,YAAY,CAAC,UAAU;mCACnB,YAAY,CAAC,cAAc;mCAC3B,YAAY,CAAC,cAAc;CAC7D,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,OAAO;;;;eAIM,SAAS;;;;;;;;;CASvB,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B,CAAC,IAOnC;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAExF,OAAO;;;;eAIM,SAAS;;;;iBAIP,KAAK;mBACH,WAAW;iBACb,SAAS;+BACK,sBAAsB,CAAC,cAAc,CAAC,oBAAoB,CAAC;mCACvD,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;mCAC9D,sBAAsB,CAAC,cAAc,CAAC,uBAAuB,CAAC;0BACvE,cAAc,CAAC,YAAY;0BAC3B,sBAAsB,CAAC,cAAc,CAAC,gBAAgB,CAAC;yBACxD,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC;+BACpC,YAAY,CAAC,UAAU;mCACnB,YAAY,CAAC,cAAc;mCAC3B,YAAY,CAAC,cAAc;;;CAG7D,CAAC;AACF,CAAC;AAED,SAAS,6BAA6B,CAAC,YAAkC;IACvE,MAAM,cAAc,GAAG,YAAY,CAAC,OAAO;QACzC,CAAC,CAAC;;;;WAIK,YAAY,CAAC,KAAK,2BAA2B,YAAY,CAAC,KAAK;;;;;;;;;CASzE;QACG,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqDP,cAAc;;;;;CAKf,CAAC;AACF,CAAC;AAED,MAAM,2BAA2B,GAAG,CAAC,OAAO,CAAC,CAAC;AAC9C,MAAM,+BAA+B,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC9D,MAAM,+BAA+B,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;AAClE,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAC5C,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAClE,MAAM,2BAA2B,GAAG,YAAY,CAAC;AACjD,MAAM,+BAA+B,GAAG,SAAS,CAAC;AAClD,MAAM,+BAA+B,GAAG,KAAK,CAAC;AA0B9C,SAAS,qBAAqB,CAAC,QAA4B;IACzD,MAAM,iBAAiB,GAAG,kBAAkB,CAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAClC,2BAA2B,CAC5B,CAAC;IACF,MAAM,oBAAoB,GAAG,kBAAkB,CAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EACrC,+BAA+B,CAChC,CAAC;IACF,MAAM,oBAAoB,GAAG,kBAAkB,CAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EACrC,+BAA+B,CAChC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,IAAI,sBAAsB,CAAC;IACnF,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAEjG,OAAO;QACL,oBAAoB,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QACjD,uBAAuB,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QACvD,uBAAuB,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QACvD,YAAY;QACZ,gBAAgB,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,QAA4B;IACvD,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAE1F,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,IAAI,2BAA2B;QAC7E,cAAc,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,IAAI,+BAA+B;QACzF,cAAc,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,IAAI,+BAA+B;QACzF,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,YAAkC;IACrE,MAAM,KAAK,GAAG,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,eAAe,CAAC,cAAc,YAAY,CAAC,KAAK,OAAO,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,eAAe,CAAC,wBAAwB,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;IAClF,MAAM,iBAAiB,GAAG,YAAY,CAAC,OAAO;SAC3C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;SACxE,IAAI,CAAC,KAAK,CAAC,CAAC;IACf,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;SACjF,GAAG,CAAC,eAAe,CAAC;SACpB,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAC/F,IAAI,CACL,CAAC;IACF,MAAM,iBAAiB,GAAG,YAAY,CAAC,OAAO;SAC3C,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC;SAC5C,GAAG,CACF,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAC7F,CAAC;IACJ,MAAM,cAAc,GAAG,CAAC,GAAG,iBAAiB,EAAE,oBAAoB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpF,MAAM,kBAAkB,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAChG,MAAM,cAAc,GAClB,kBAAkB,CAAC,MAAM,GAAG,CAAC;QAC3B,CAAC,CAAC,iBAAiB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,KAAK,sBAAsB;QAChG,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,UAAU,GACd,YAAY,CAAC,cAAc,KAAK,SAAS;QACvC,CAAC,CAAC;oCAC4B,YAAY;;;;;;;uBAOzB,KAAK,KAAK,aAAa;YAClC,YAAY;;MAElB,cAAc;;;;;;yBAMK,WAAW;iBACnB,WAAW;;yCAEa,YAAY;CACpD;QACK,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;wFAC+E,YAAY,CAAC,KAAK;;oCAEtE,KAAK;mEAErC,iBAAiB,CAAC,CAAC,CAAC,MAAM,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAClD;;;;;;qBAMmB,KAAK;;6BAEG,KAAK;+BACH,KAAK;EAClC,cAAc;gBACA,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,aAAa,CAAC;cACrD,KAAK;;;;gBAIH,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,aAAa,CAAC;cACrD,KAAK;;;;EAIjB,UAAU,EAAE,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAyB;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IAErD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;QAC/E,KAAK,aAAa;YAChB,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,MAAM;gBACf,WAAW,EACT,0HAA0H;aAC7H,CAAC;QACJ,KAAK,WAAW;YACd,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,MAAM;gBACf,WAAW,EACT,uFAAuF;aAC1F,CAAC;QACJ,KAAK,UAAU;YACb,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,MAAM;gBACf,WAAW,EACT,qFAAqF;aACxF,CAAC;QACJ,KAAK,WAAW;YACd,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,MAAM;gBACf,WAAW,EACT,uFAAuF;aAC1F,CAAC;QACJ,KAAK,UAAU;YACb,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,UAAU;gBAClB,OAAO,EAAE,MAAM;gBACf,WAAW,EAAE,qCAAqC;aACnD,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;QAC/E;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAqC,EACrC,QAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC;IAClC,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAExB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,8CAA8C,OAAO,sDAAsD,CAC5G,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC","sourcesContent":["import type { InfraManifestInput } from '../../../../types';\nimport type { MinikubeAdapterArtifacts } from '../../contracts';\n\nexport function generateSupabaseAuthArtifacts(args: {\n  manifest: InfraManifestInput;\n  namespace: string;\n}): MinikubeAdapterArtifacts {\n  const { manifest, namespace } = args;\n\n  const root = 'infra/minikube/k8s/auth/supabase';\n  const resourceRoot = 'auth/supabase';\n  const docsRoot = 'infra/minikube/auth';\n  const migrationRoot = 'infra/minikube/supabase/migrations';\n  const scope = manifest.auth?.scope ?? 'global';\n  const authzEngine = manifest.auth?.authorization.engine ?? 'native';\n  const authzKind = manifest.auth?.authorization.kind ?? 'RBAC';\n  const authFieldModel = resolveAuthFieldModel(manifest);\n  const profileModel = resolveProfileModel(manifest);\n\n  const warnings: string[] = [];\n  if (scope !== 'global') {\n    warnings.push(\n      `Auth scope \"${scope}\" is not fully modeled yet for Supabase. Baseline resources assume global auth.`,\n    );\n  }\n\n  return {\n    files: [\n      {\n        path: `${root}/supabase-auth.configmap.yaml`,\n        content: getSupabaseConfigMap({\n          namespace,\n          scope,\n          authzEngine,\n          authzKind,\n          authFieldModel,\n          profileModel,\n        }),\n      },\n      {\n        path: `${root}/supabase-auth.secret.yaml`,\n        content: getSupabaseSecret(namespace),\n      },\n      {\n        path: `${root}/app-runtime-auth.env.configmap.yaml`,\n        content: getRuntimeAuthEnvConfigMap({\n          namespace,\n          scope,\n          authzEngine,\n          authzKind,\n          authFieldModel,\n          profileModel,\n        }),\n      },\n      ...(profileModel.enabled\n        ? [\n            {\n              path: `${migrationRoot}/0001_auth_profiles.sql`,\n              content: getSupabaseProfileMigration(profileModel),\n            },\n          ]\n        : []),\n      {\n        path: `${docsRoot}/supabase-runtime-wiring.md`,\n        content: getSupabaseRuntimeWiringGuide(profileModel),\n      },\n    ],\n    resources: [\n      `${resourceRoot}/supabase-auth.configmap.yaml`,\n      `${resourceRoot}/supabase-auth.secret.yaml`,\n      `${resourceRoot}/app-runtime-auth.env.configmap.yaml`,\n    ],\n    envEntries: [\n      'SUPABASE_SECRET_SYNC_ENABLED=true',\n      'SUPABASE_URL=',\n      'SUPABASE_ANON_KEY=',\n      'SUPABASE_SERVICE_ROLE_KEY=',\n      'SUPABASE_JWT_SECRET=',\n      'EXPO_PUBLIC_SUPABASE_URL=',\n      'EXPO_PUBLIC_SUPABASE_ANON_KEY=',\n    ],\n    warnings,\n  };\n}\n\nfunction getSupabaseConfigMap(args: {\n  namespace: string;\n  scope: string;\n  authzEngine: string;\n  authzKind: string;\n  authFieldModel: ResolvedAuthFieldModel;\n  profileModel: ResolvedProfileModel;\n}) {\n  const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: supabase-auth-config\n  namespace: ${namespace}\ndata:\n  AUTH_PROVIDER: \"supabase\"\n  AUTH_SCOPE: \"${scope}\"\n  AUTHZ_ENGINE: \"${authzEngine}\"\n  AUTHZ_KIND: \"${authzKind}\"\n  AUTH_SIGN_IN_IDENTIFIERS: \"${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}\"\n  AUTH_SIGN_UP_REQUIRED_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}\"\n  AUTH_SIGN_UP_OPTIONAL_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}\"\n  AUTH_SIGN_UP_POLICY: \"${authFieldModel.signUpPolicy}\"\n  AUTH_PROFILE_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}\"\n  AUTH_PROFILE_TABLE: \"${escapeYamlDoubleQuoted(profileModel.table)}\"\n  AUTH_PROFILE_PRIMARY_KEY: \"${profileModel.primaryKey}\"\n  AUTH_PROFILE_CREATE_STRATEGY: \"${profileModel.createStrategy}\"\n  AUTH_PROFILE_UPDATE_STRATEGY: \"${profileModel.updateStrategy}\"\n`;\n}\n\nfunction getSupabaseSecret(namespace: string) {\n  return `apiVersion: v1\nkind: Secret\nmetadata:\n  name: supabase-auth-secrets\n  namespace: ${namespace}\ntype: Opaque\nstringData:\n  SUPABASE_URL: \"\"\n  SUPABASE_ANON_KEY: \"\"\n  SUPABASE_SERVICE_ROLE_KEY: \"\"\n  SUPABASE_JWT_SECRET: \"\"\n  EXPO_PUBLIC_SUPABASE_URL: \"\"\n  EXPO_PUBLIC_SUPABASE_ANON_KEY: \"\"\n`;\n}\n\nfunction getRuntimeAuthEnvConfigMap(args: {\n  namespace: string;\n  scope: string;\n  authzEngine: string;\n  authzKind: string;\n  authFieldModel: ResolvedAuthFieldModel;\n  profileModel: ResolvedProfileModel;\n}) {\n  const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: app-runtime-auth-env\n  namespace: ${namespace}\ndata:\n  AUTH_REQUIRED: \"true\"\n  AUTH_PROVIDER: \"supabase\"\n  AUTH_SCOPE: \"${scope}\"\n  AUTHZ_ENGINE: \"${authzEngine}\"\n  AUTHZ_KIND: \"${authzKind}\"\n  AUTH_SIGN_IN_IDENTIFIERS: \"${escapeYamlDoubleQuoted(authFieldModel.signInIdentifiersCsv)}\"\n  AUTH_SIGN_UP_REQUIRED_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpRequiredFieldsCsv)}\"\n  AUTH_SIGN_UP_OPTIONAL_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}\"\n  AUTH_SIGN_UP_POLICY: \"${authFieldModel.signUpPolicy}\"\n  AUTH_PROFILE_FIELDS: \"${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}\"\n  AUTH_PROFILE_TABLE: \"${escapeYamlDoubleQuoted(profileModel.table)}\"\n  AUTH_PROFILE_PRIMARY_KEY: \"${profileModel.primaryKey}\"\n  AUTH_PROFILE_CREATE_STRATEGY: \"${profileModel.createStrategy}\"\n  AUTH_PROFILE_UPDATE_STRATEGY: \"${profileModel.updateStrategy}\"\n  AUTH_TOKEN_HEADER: \"Authorization\"\n  AUTH_TOKEN_PREFIX: \"Bearer\"\n`;\n}\n\nfunction getSupabaseRuntimeWiringGuide(profileModel: ResolvedProfileModel) {\n  const profileSection = profileModel.enabled\n    ? `\n## App Profile Table\n\nIdentity remains provider-owned in \\`auth.users\\`. App-facing profile data is generated in\n\\`public.${profileModel.table}\\` and linked through \\`${profileModel.table}.id -> auth.users.id\\`.\n\nThe generated migration:\n\n- creates the profile table\n- enables row-level security\n- allows signed-in users to read and update their own profile row\n- protects the generated \\`role\\` column from self-service profile updates\n- creates a trigger for new auth users when \\`AUTH_PROFILE_CREATE_STRATEGY=trigger\\`\n`\n    : '';\n\n  return `# Supabase Runtime Wiring\n\nThis file documents the runtime conventions generated by the minikube Supabase adapter.\n\n## Generated Kubernetes Objects\n\n- \\`ConfigMap/supabase-auth-config\\`: high-level auth metadata.\n- \\`Secret/supabase-auth-secrets\\`: Supabase keys and public runtime keys.\n- \\`ConfigMap/app-runtime-auth-env\\`: auth runtime feature flags and authz metadata.\n\n## App Runtime Convention\n\nYour app runtime deployment should import both:\n\n- \\`app-runtime-auth-env\\` (configMap)\n- \\`supabase-auth-secrets\\` (secret)\n\nExample deployment fragment:\n\n\\`\\`\\`yaml\nenvFrom:\n  - configMapRef:\n      name: app-runtime-auth-env\n  - secretRef:\n      name: supabase-auth-secrets\n\\`\\`\\`\n\nThe generated base deployment at \\`k8s/app/deployment.yaml\\` already includes this wiring\nwith \\`optional: true\\` for auth sources.\n\n## Expected Environment Variables\n\n- \\`AUTH_REQUIRED\\`\n- \\`AUTH_PROVIDER\\`\n- \\`AUTH_SCOPE\\`\n- \\`AUTHZ_ENGINE\\`\n- \\`AUTHZ_KIND\\`\n- \\`AUTH_SIGN_IN_IDENTIFIERS\\`\n- \\`AUTH_SIGN_UP_REQUIRED_FIELDS\\`\n- \\`AUTH_SIGN_UP_OPTIONAL_FIELDS\\`\n- \\`AUTH_SIGN_UP_POLICY\\`\n- \\`AUTH_PROFILE_FIELDS\\`\n- \\`AUTH_PROFILE_TABLE\\`\n- \\`AUTH_PROFILE_PRIMARY_KEY\\`\n- \\`AUTH_PROFILE_CREATE_STRATEGY\\`\n- \\`AUTH_PROFILE_UPDATE_STRATEGY\\`\n- \\`SUPABASE_SECRET_SYNC_ENABLED\\`\n- \\`SUPABASE_URL\\`\n- \\`SUPABASE_ANON_KEY\\`\n- \\`SUPABASE_SERVICE_ROLE_KEY\\`\n- \\`SUPABASE_JWT_SECRET\\`\n- \\`EXPO_PUBLIC_SUPABASE_URL\\`\n- \\`EXPO_PUBLIC_SUPABASE_ANON_KEY\\`\n${profileSection}\n## Secret Sync\n\nWhen \\`SUPABASE_SECRET_SYNC_ENABLED=true\\`, \\`scripts/up.sh\\` will create/update\n\\`Secret/supabase-auth-secrets\\` from the loaded environment values.\n`;\n}\n\nconst DEFAULT_SIGN_IN_IDENTIFIERS = ['email'];\nconst DEFAULT_SIGN_UP_REQUIRED_FIELDS = ['email', 'password'];\nconst DEFAULT_SIGN_UP_OPTIONAL_FIELDS = ['firstName', 'lastName'];\nconst DEFAULT_SIGN_UP_POLICY = 'autoSignIn';\nconst DEFAULT_PROFILE_FIELDS = ['email', 'firstName', 'lastName'];\nconst DEFAULT_PROFILE_PRIMARY_KEY = 'authUserId';\nconst DEFAULT_PROFILE_CREATE_STRATEGY = 'trigger';\nconst DEFAULT_PROFILE_UPDATE_STRATEGY = 'api';\n\ninterface ResolvedAuthFieldModel {\n  signInIdentifiersCsv: string;\n  signUpRequiredFieldsCsv: string;\n  signUpOptionalFieldsCsv: string;\n  signUpPolicy: string;\n  profileFieldsCsv: string;\n}\n\ninterface ProfileColumnSpec {\n  readonly field: string;\n  readonly column: string;\n  readonly sqlType: string;\n  readonly fromNewUser: string;\n}\n\ninterface ResolvedProfileModel {\n  readonly enabled: boolean;\n  readonly table: string;\n  readonly primaryKey: string;\n  readonly createStrategy: string;\n  readonly updateStrategy: string;\n  readonly columns: readonly ProfileColumnSpec[];\n}\n\nfunction resolveAuthFieldModel(manifest: InfraManifestInput): ResolvedAuthFieldModel {\n  const signInIdentifiers = normalizeFieldList(\n    manifest.auth?.signIn?.identifiers,\n    DEFAULT_SIGN_IN_IDENTIFIERS,\n  );\n  const signUpRequiredFields = normalizeFieldList(\n    manifest.auth?.signUp?.requiredFields,\n    DEFAULT_SIGN_UP_REQUIRED_FIELDS,\n  );\n  const signUpOptionalFields = normalizeFieldList(\n    manifest.auth?.signUp?.optionalFields,\n    DEFAULT_SIGN_UP_OPTIONAL_FIELDS,\n  ).filter((field) => !signUpRequiredFields.includes(field));\n  const signUpPolicy = manifest.auth?.signUp?.signUpPolicy ?? DEFAULT_SIGN_UP_POLICY;\n  const profileFields = normalizeFieldList(manifest.auth?.profile?.fields, DEFAULT_PROFILE_FIELDS);\n\n  return {\n    signInIdentifiersCsv: signInIdentifiers.join(','),\n    signUpRequiredFieldsCsv: signUpRequiredFields.join(','),\n    signUpOptionalFieldsCsv: signUpOptionalFields.join(','),\n    signUpPolicy,\n    profileFieldsCsv: profileFields.join(','),\n  };\n}\n\nfunction resolveProfileModel(manifest: InfraManifestInput): ResolvedProfileModel {\n  const table = normalizeIdentifier(manifest.auth?.profile?.table ?? '');\n  const fields = normalizeFieldList(manifest.auth?.profile?.fields, DEFAULT_PROFILE_FIELDS);\n\n  return {\n    enabled: table.length > 0,\n    table,\n    primaryKey: manifest.auth?.profile?.primaryKey ?? DEFAULT_PROFILE_PRIMARY_KEY,\n    createStrategy: manifest.auth?.profile?.createStrategy ?? DEFAULT_PROFILE_CREATE_STRATEGY,\n    updateStrategy: manifest.auth?.profile?.updateStrategy ?? DEFAULT_PROFILE_UPDATE_STRATEGY,\n    columns: resolveProfileColumns(fields),\n  };\n}\n\nfunction getSupabaseProfileMigration(profileModel: ResolvedProfileModel): string {\n  const table = quoteIdentifier(profileModel.table);\n  const functionName = quoteIdentifier(`handle_new_${profileModel.table}_user`);\n  const triggerName = quoteIdentifier(`on_auth_user_created_${profileModel.table}`);\n  const columnDefinitions = profileModel.columns\n    .map((column) => `  ${quoteIdentifier(column.column)} ${column.sqlType}`)\n    .join(',\\n');\n  const insertColumns = ['id', ...profileModel.columns.map((column) => column.column)]\n    .map(quoteIdentifier)\n    .join(', ');\n  const insertValues = ['new.id', ...profileModel.columns.map((column) => column.fromNewUser)].join(\n    ', ',\n  );\n  const updateAssignments = profileModel.columns\n    .filter((column) => column.field === 'email')\n    .map(\n      (column) => `${quoteIdentifier(column.column)} = excluded.${quoteIdentifier(column.column)}`,\n    );\n  const conflictUpdate = [...updateAssignments, 'updated_at = now()'].join(',\\n    ');\n  const updateGrantColumns = profileModel.columns.map((column) => quoteIdentifier(column.column));\n  const updateGrantSql =\n    updateGrantColumns.length > 0\n      ? `grant update (${updateGrantColumns.join(', ')}) on table public.${table} to authenticated;\\n`\n      : '';\n  const triggerSql =\n    profileModel.createStrategy === 'trigger'\n      ? `\ncreate or replace function public.${functionName}()\nreturns trigger\nlanguage plpgsql\nsecurity definer\nset search_path = public\nas $$\nbegin\n  insert into public.${table} (${insertColumns})\n  values (${insertValues})\n  on conflict (id) do update set\n    ${conflictUpdate};\n\n  return new;\nend;\n$$;\n\ndrop trigger if exists ${triggerName} on auth.users;\ncreate trigger ${triggerName}\n  after insert on auth.users\n  for each row execute function public.${functionName}();\n`\n      : '';\n\n  return `-- Generated by @ankhorage/infra from manifest.infra.auth.profile.\n-- Supabase Auth owns identity in auth.users. App-facing profile data lives in public.${profileModel.table}.\n\ncreate table if not exists public.${table} (\n  id uuid primary key references auth.users(id) on delete cascade${\n    columnDefinitions ? `,\\n${columnDefinitions}` : ''\n  },\n  role text not null default 'user',\n  created_at timestamptz not null default now(),\n  updated_at timestamptz not null default now()\n);\n\nalter table public.${table} enable row level security;\n\nrevoke all on table public.${table} from anon, authenticated;\ngrant select on table public.${table} to authenticated;\n${updateGrantSql}\ncreate policy ${quoteIdentifier(`${profileModel.table}_select_own`)}\n  on public.${table}\n  for select\n  using (auth.uid() = id);\n\ncreate policy ${quoteIdentifier(`${profileModel.table}_update_own`)}\n  on public.${table}\n  for update\n  using (auth.uid() = id)\n  with check (auth.uid() = id);\n${triggerSql}`;\n}\n\nfunction resolveProfileColumns(fields: readonly string[]): ProfileColumnSpec[] {\n  const columns = new Map<string, ProfileColumnSpec>();\n\n  for (const field of fields) {\n    const column = mapProfileFieldToColumn(field);\n    if (!column || columns.has(column.column)) {\n      continue;\n    }\n    columns.set(column.column, column);\n  }\n\n  return [...columns.values()];\n}\n\nfunction mapProfileFieldToColumn(field: string): ProfileColumnSpec | null {\n  switch (field) {\n    case 'email':\n      return { field, column: 'email', sqlType: 'text', fromNewUser: 'new.email' };\n    case 'displayName':\n      return {\n        field,\n        column: 'display_name',\n        sqlType: 'text',\n        fromNewUser:\n          \"coalesce(new.raw_user_meta_data->>'displayName', new.raw_user_meta_data->>'display_name', split_part(new.email, '@', 1))\",\n      };\n    case 'firstName':\n      return {\n        field,\n        column: 'first_name',\n        sqlType: 'text',\n        fromNewUser:\n          \"coalesce(new.raw_user_meta_data->>'firstName', new.raw_user_meta_data->>'first_name')\",\n      };\n    case 'lastName':\n      return {\n        field,\n        column: 'last_name',\n        sqlType: 'text',\n        fromNewUser:\n          \"coalesce(new.raw_user_meta_data->>'lastName', new.raw_user_meta_data->>'last_name')\",\n      };\n    case 'avatarUrl':\n      return {\n        field,\n        column: 'avatar_url',\n        sqlType: 'text',\n        fromNewUser:\n          \"coalesce(new.raw_user_meta_data->>'avatarUrl', new.raw_user_meta_data->>'avatar_url')\",\n      };\n    case 'username':\n      return {\n        field,\n        column: 'username',\n        sqlType: 'text',\n        fromNewUser: \"new.raw_user_meta_data->>'username'\",\n      };\n    case 'phone':\n      return { field, column: 'phone', sqlType: 'text', fromNewUser: 'new.phone' };\n    default:\n      return null;\n  }\n}\n\nfunction normalizeFieldList(\n  values: readonly string[] | undefined,\n  fallback: readonly string[],\n): string[] {\n  const source = values ?? fallback;\n  const next: string[] = [];\n\n  for (const value of source) {\n    const normalized = value.trim();\n    if (!normalized || next.includes(normalized)) {\n      continue;\n    }\n    next.push(normalized);\n  }\n\n  if (next.length > 0) {\n    return next;\n  }\n\n  return [...fallback];\n}\n\nfunction normalizeIdentifier(value: string): string {\n  const trimmed = value.trim();\n  if (!trimmed) return '';\n\n  if (!/^[a-z_][a-z0-9_]*$/.test(trimmed)) {\n    throw new Error(\n      `Invalid Supabase profile table identifier \"${trimmed}\". Use snake_case letters, numbers, and underscores.`,\n    );\n  }\n\n  return trimmed;\n}\n\nfunction quoteIdentifier(value: string): string {\n  return `\"${value.replaceAll('\"', '\"\"')}\"`;\n}\n\nfunction escapeYamlDoubleQuoted(value: string): string {\n  return value.replaceAll('\\\\', '\\\\\\\\').replaceAll('\"', '\\\\\"');\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ankhorage/infra",
   "type": "module",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Provider-neutral infrastructure generation: turns app manifests, datasets, auth, state, storage, and deployment config into generated infra artifacts, migrations, seeds, APIs, and runtime dependencies.",
   "homepage": "https://github.com/ankhorage/infra#readme",
   "bugs": {
@@ -33,7 +33,7 @@
     "openapi"
   ],
   "dependencies": {
-    "@ankhorage/contracts": "^1.16.0"
+    "@ankhorage/contracts": "^1.17.0"
   },
   "files": [
     "dist",

package/src/adapters/minikube/auth/supabase/index.test.ts

@@ -0,0 +1,93 @@
+import type { InfraManifest } from '@ankhorage/contracts';
+import { describe, expect, test } from 'bun:test';
+
+import { generateSupabaseAuthArtifacts } from './index';
+
+describe('generateSupabaseAuthArtifacts profile tables', () => {
+  test('generates profile metadata env vars and SQL migration when profile table is declared', () => {
+    const artifacts = generateSupabaseAuthArtifacts({
+      namespace: 'scan-app',
+      manifest: createManifest({
+        profile: {
+          fields: ['email', 'displayName', 'avatarUrl'],
+          table: 'profiles',
+          primaryKey: 'authUserId',
+          createStrategy: 'trigger',
+          updateStrategy: 'api',
+        },
+      }),
+    });
+
+    const runtimeConfig = artifacts.files.find(
+      (file) =>
+        file.path === 'infra/minikube/k8s/auth/supabase/app-runtime-auth.env.configmap.yaml',
+    );
+    expect(runtimeConfig?.content).toContain('AUTH_PROFILE_TABLE: "profiles"');
+    expect(runtimeConfig?.content).toContain('AUTH_PROFILE_PRIMARY_KEY: "authUserId"');
+    expect(runtimeConfig?.content).toContain('AUTH_PROFILE_CREATE_STRATEGY: "trigger"');
+    expect(runtimeConfig?.content).toContain('AUTH_PROFILE_UPDATE_STRATEGY: "api"');
+
+    const migration = artifacts.files.find(
+      (file) => file.path === 'infra/minikube/supabase/migrations/0001_auth_profiles.sql',
+    );
+    expect(migration?.content).toContain('create table if not exists public."profiles"');
+    expect(migration?.content).toContain(
+      'id uuid primary key references auth.users(id) on delete cascade',
+    );
+    expect(migration?.content).toContain('"display_name" text');
+    expect(migration?.content).toContain('"avatar_url" text');
+    expect(migration?.content).toContain('alter table public."profiles" enable row level security');
+    expect(migration?.content).toContain(
+      'revoke all on table public."profiles" from anon, authenticated',
+    );
+    expect(migration?.content).toContain(
+      'grant select on table public."profiles" to authenticated',
+    );
+    expect(migration?.content).toContain(
+      'grant update ("email", "display_name", "avatar_url") on table public."profiles" to authenticated',
+    );
+    expect(migration?.content).not.toContain('grant update ("role")');
+    expect(migration?.content).toContain('create policy "profiles_select_own"');
+    expect(migration?.content).toContain('create policy "profiles_update_own"');
+    expect(migration?.content).toContain('using (auth.uid() = id)');
+    expect(migration?.content).toContain('create trigger "on_auth_user_created_profiles"');
+    expect(migration?.content).toContain('after insert on auth.users');
+    expect(migration?.content).toContain('execute function public."handle_new_profiles_user"()');
+  });
+
+  test('does not generate a migration when profile table is omitted', () => {
+    const artifacts = generateSupabaseAuthArtifacts({
+      namespace: 'scan-app',
+      manifest: createManifest({
+        profile: {
+          fields: ['email', 'displayName'],
+        },
+      }),
+    });
+
+    expect(artifacts.files.some((file) => file.path.includes('supabase/migrations'))).toBe(false);
+  });
+});
+
+function createManifest(auth: Pick<NonNullable<InfraManifest['auth']>, 'profile'>): InfraManifest {
+  return {
+    deployment: {
+      target: 'minikube',
+      monitoring: false,
+    },
+    auth: {
+      scope: 'global',
+      provider: 'supabase',
+      authorization: {
+        kind: 'RBAC',
+        engine: 'native',
+      },
+      ...auth,
+    },
+    database: {
+      provider: 'supabase',
+      tier: 'dev',
+    },
+    plugins: [],
+  };
+}

package/src/adapters/minikube/auth/supabase/index.ts

@@ -10,10 +10,12 @@ export function generateSupabaseAuthArtifacts(args: {
   const root = 'infra/minikube/k8s/auth/supabase';
   const resourceRoot = 'auth/supabase';
   const docsRoot = 'infra/minikube/auth';
+  const migrationRoot = 'infra/minikube/supabase/migrations';
   const scope = manifest.auth?.scope ?? 'global';
   const authzEngine = manifest.auth?.authorization.engine ?? 'native';
   const authzKind = manifest.auth?.authorization.kind ?? 'RBAC';
   const authFieldModel = resolveAuthFieldModel(manifest);
+  const profileModel = resolveProfileModel(manifest);
 
   const warnings: string[] = [];
   if (scope !== 'global') {
@@ -32,6 +34,7 @@ export function generateSupabaseAuthArtifacts(args: {
           authzEngine,
           authzKind,
           authFieldModel,
+          profileModel,
         }),
       },
       {
@@ -46,11 +49,20 @@ export function generateSupabaseAuthArtifacts(args: {
           authzEngine,
           authzKind,
           authFieldModel,
+          profileModel,
         }),
       },
+      ...(profileModel.enabled
+        ? [
+            {
+              path: `${migrationRoot}/0001_auth_profiles.sql`,
+              content: getSupabaseProfileMigration(profileModel),
+            },
+          ]
+        : []),
       {
         path: `${docsRoot}/supabase-runtime-wiring.md`,
-        content: getSupabaseRuntimeWiringGuide(),
+        content: getSupabaseRuntimeWiringGuide(profileModel),
       },
     ],
     resources: [
@@ -77,8 +89,9 @@ function getSupabaseConfigMap(args: {
   authzEngine: string;
   authzKind: string;
   authFieldModel: ResolvedAuthFieldModel;
+  profileModel: ResolvedProfileModel;
 }) {
-  const { namespace, scope, authzEngine, authzKind, authFieldModel } = args;
+  const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;
 
   return `apiVersion: v1
 kind: ConfigMap
@@ -95,6 +108,10 @@ data:
   AUTH_SIGN_UP_OPTIONAL_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}"
   AUTH_SIGN_UP_POLICY: "${authFieldModel.signUpPolicy}"
   AUTH_PROFILE_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}"
+  AUTH_PROFILE_TABLE: "${escapeYamlDoubleQuoted(profileModel.table)}"
+  AUTH_PROFILE_PRIMARY_KEY: "${profileModel.primaryKey}"
+  AUTH_PROFILE_CREATE_STRATEGY: "${profileModel.createStrategy}"
+  AUTH_PROFILE_UPDATE_STRATEGY: "${profileModel.updateStrategy}"
 `;
 }
 
@@ -121,8 +138,9 @@ function getRuntimeAuthEnvConfigMap(args: {
   authzEngine: string;
   authzKind: string;
   authFieldModel: ResolvedAuthFieldModel;
+  profileModel: ResolvedProfileModel;
 }) {
-  const { namespace, scope, authzEngine, authzKind, authFieldModel } = args;
+  const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;
 
   return `apiVersion: v1
 kind: ConfigMap
@@ -140,12 +158,33 @@ data:
   AUTH_SIGN_UP_OPTIONAL_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}"
   AUTH_SIGN_UP_POLICY: "${authFieldModel.signUpPolicy}"
   AUTH_PROFILE_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}"
+  AUTH_PROFILE_TABLE: "${escapeYamlDoubleQuoted(profileModel.table)}"
+  AUTH_PROFILE_PRIMARY_KEY: "${profileModel.primaryKey}"
+  AUTH_PROFILE_CREATE_STRATEGY: "${profileModel.createStrategy}"
+  AUTH_PROFILE_UPDATE_STRATEGY: "${profileModel.updateStrategy}"
   AUTH_TOKEN_HEADER: "Authorization"
   AUTH_TOKEN_PREFIX: "Bearer"
 `;
 }
 
-function getSupabaseRuntimeWiringGuide() {
+function getSupabaseRuntimeWiringGuide(profileModel: ResolvedProfileModel) {
+  const profileSection = profileModel.enabled
+    ? `
+## App Profile Table
+
+Identity remains provider-owned in \`auth.users\`. App-facing profile data is generated in
+\`public.${profileModel.table}\` and linked through \`${profileModel.table}.id -> auth.users.id\`.
+
+The generated migration:
+
+- creates the profile table
+- enables row-level security
+- allows signed-in users to read and update their own profile row
+- protects the generated \`role\` column from self-service profile updates
+- creates a trigger for new auth users when \`AUTH_PROFILE_CREATE_STRATEGY=trigger\`
+`
+    : '';
+
   return `# Supabase Runtime Wiring
 
 This file documents the runtime conventions generated by the minikube Supabase adapter.
@@ -188,6 +227,10 @@ with \`optional: true\` for auth sources.
 - \`AUTH_SIGN_UP_OPTIONAL_FIELDS\`
 - \`AUTH_SIGN_UP_POLICY\`
 - \`AUTH_PROFILE_FIELDS\`
+- \`AUTH_PROFILE_TABLE\`
+- \`AUTH_PROFILE_PRIMARY_KEY\`
+- \`AUTH_PROFILE_CREATE_STRATEGY\`
+- \`AUTH_PROFILE_UPDATE_STRATEGY\`
 - \`SUPABASE_SECRET_SYNC_ENABLED\`
 - \`SUPABASE_URL\`
 - \`SUPABASE_ANON_KEY\`
@@ -195,7 +238,7 @@ with \`optional: true\` for auth sources.
 - \`SUPABASE_JWT_SECRET\`
 - \`EXPO_PUBLIC_SUPABASE_URL\`
 - \`EXPO_PUBLIC_SUPABASE_ANON_KEY\`
-
+${profileSection}
 ## Secret Sync
 
 When \`SUPABASE_SECRET_SYNC_ENABLED=true\`, \`scripts/up.sh\` will create/update
@@ -208,6 +251,9 @@ const DEFAULT_SIGN_UP_REQUIRED_FIELDS = ['email', 'password'];
 const DEFAULT_SIGN_UP_OPTIONAL_FIELDS = ['firstName', 'lastName'];
 const DEFAULT_SIGN_UP_POLICY = 'autoSignIn';
 const DEFAULT_PROFILE_FIELDS = ['email', 'firstName', 'lastName'];
+const DEFAULT_PROFILE_PRIMARY_KEY = 'authUserId';
+const DEFAULT_PROFILE_CREATE_STRATEGY = 'trigger';
+const DEFAULT_PROFILE_UPDATE_STRATEGY = 'api';
 
 interface ResolvedAuthFieldModel {
   signInIdentifiersCsv: string;
@@ -217,6 +263,22 @@ interface ResolvedAuthFieldModel {
   profileFieldsCsv: string;
 }
 
+interface ProfileColumnSpec {
+  readonly field: string;
+  readonly column: string;
+  readonly sqlType: string;
+  readonly fromNewUser: string;
+}
+
+interface ResolvedProfileModel {
+  readonly enabled: boolean;
+  readonly table: string;
+  readonly primaryKey: string;
+  readonly createStrategy: string;
+  readonly updateStrategy: string;
+  readonly columns: readonly ProfileColumnSpec[];
+}
+
 function resolveAuthFieldModel(manifest: InfraManifestInput): ResolvedAuthFieldModel {
   const signInIdentifiers = normalizeFieldList(
     manifest.auth?.signIn?.identifiers,
@@ -242,6 +304,164 @@ function resolveAuthFieldModel(manifest: InfraManifestInput): ResolvedAuthFieldM
   };
 }
 
+function resolveProfileModel(manifest: InfraManifestInput): ResolvedProfileModel {
+  const table = normalizeIdentifier(manifest.auth?.profile?.table ?? '');
+  const fields = normalizeFieldList(manifest.auth?.profile?.fields, DEFAULT_PROFILE_FIELDS);
+
+  return {
+    enabled: table.length > 0,
+    table,
+    primaryKey: manifest.auth?.profile?.primaryKey ?? DEFAULT_PROFILE_PRIMARY_KEY,
+    createStrategy: manifest.auth?.profile?.createStrategy ?? DEFAULT_PROFILE_CREATE_STRATEGY,
+    updateStrategy: manifest.auth?.profile?.updateStrategy ?? DEFAULT_PROFILE_UPDATE_STRATEGY,
+    columns: resolveProfileColumns(fields),
+  };
+}
+
+function getSupabaseProfileMigration(profileModel: ResolvedProfileModel): string {
+  const table = quoteIdentifier(profileModel.table);
+  const functionName = quoteIdentifier(`handle_new_${profileModel.table}_user`);
+  const triggerName = quoteIdentifier(`on_auth_user_created_${profileModel.table}`);
+  const columnDefinitions = profileModel.columns
+    .map((column) => `  ${quoteIdentifier(column.column)} ${column.sqlType}`)
+    .join(',\n');
+  const insertColumns = ['id', ...profileModel.columns.map((column) => column.column)]
+    .map(quoteIdentifier)
+    .join(', ');
+  const insertValues = ['new.id', ...profileModel.columns.map((column) => column.fromNewUser)].join(
+    ', ',
+  );
+  const updateAssignments = profileModel.columns
+    .filter((column) => column.field === 'email')
+    .map(
+      (column) => `${quoteIdentifier(column.column)} = excluded.${quoteIdentifier(column.column)}`,
+    );
+  const conflictUpdate = [...updateAssignments, 'updated_at = now()'].join(',\n    ');
+  const updateGrantColumns = profileModel.columns.map((column) => quoteIdentifier(column.column));
+  const updateGrantSql =
+    updateGrantColumns.length > 0
+      ? `grant update (${updateGrantColumns.join(', ')}) on table public.${table} to authenticated;\n`
+      : '';
+  const triggerSql =
+    profileModel.createStrategy === 'trigger'
+      ? `
+create or replace function public.${functionName}()
+returns trigger
+language plpgsql
+security definer
+set search_path = public
+as $$
+begin
+  insert into public.${table} (${insertColumns})
+  values (${insertValues})
+  on conflict (id) do update set
+    ${conflictUpdate};
+
+  return new;
+end;
+$$;
+
+drop trigger if exists ${triggerName} on auth.users;
+create trigger ${triggerName}
+  after insert on auth.users
+  for each row execute function public.${functionName}();
+`
+      : '';
+
+  return `-- Generated by @ankhorage/infra from manifest.infra.auth.profile.
+-- Supabase Auth owns identity in auth.users. App-facing profile data lives in public.${profileModel.table}.
+
+create table if not exists public.${table} (
+  id uuid primary key references auth.users(id) on delete cascade${
+    columnDefinitions ? `,\n${columnDefinitions}` : ''
+  },
+  role text not null default 'user',
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+alter table public.${table} enable row level security;
+
+revoke all on table public.${table} from anon, authenticated;
+grant select on table public.${table} to authenticated;
+${updateGrantSql}
+create policy ${quoteIdentifier(`${profileModel.table}_select_own`)}
+  on public.${table}
+  for select
+  using (auth.uid() = id);
+
+create policy ${quoteIdentifier(`${profileModel.table}_update_own`)}
+  on public.${table}
+  for update
+  using (auth.uid() = id)
+  with check (auth.uid() = id);
+${triggerSql}`;
+}
+
+function resolveProfileColumns(fields: readonly string[]): ProfileColumnSpec[] {
+  const columns = new Map<string, ProfileColumnSpec>();
+
+  for (const field of fields) {
+    const column = mapProfileFieldToColumn(field);
+    if (!column || columns.has(column.column)) {
+      continue;
+    }
+    columns.set(column.column, column);
+  }
+
+  return [...columns.values()];
+}
+
+function mapProfileFieldToColumn(field: string): ProfileColumnSpec | null {
+  switch (field) {
+    case 'email':
+      return { field, column: 'email', sqlType: 'text', fromNewUser: 'new.email' };
+    case 'displayName':
+      return {
+        field,
+        column: 'display_name',
+        sqlType: 'text',
+        fromNewUser:
+          "coalesce(new.raw_user_meta_data->>'displayName', new.raw_user_meta_data->>'display_name', split_part(new.email, '@', 1))",
+      };
+    case 'firstName':
+      return {
+        field,
+        column: 'first_name',
+        sqlType: 'text',
+        fromNewUser:
+          "coalesce(new.raw_user_meta_data->>'firstName', new.raw_user_meta_data->>'first_name')",
+      };
+    case 'lastName':
+      return {
+        field,
+        column: 'last_name',
+        sqlType: 'text',
+        fromNewUser:
+          "coalesce(new.raw_user_meta_data->>'lastName', new.raw_user_meta_data->>'last_name')",
+      };
+    case 'avatarUrl':
+      return {
+        field,
+        column: 'avatar_url',
+        sqlType: 'text',
+        fromNewUser:
+          "coalesce(new.raw_user_meta_data->>'avatarUrl', new.raw_user_meta_data->>'avatar_url')",
+      };
+    case 'username':
+      return {
+        field,
+        column: 'username',
+        sqlType: 'text',
+        fromNewUser: "new.raw_user_meta_data->>'username'",
+      };
+    case 'phone':
+      return { field, column: 'phone', sqlType: 'text', fromNewUser: 'new.phone' };
+    default:
+      return null;
+  }
+}
+
 function normalizeFieldList(
   values: readonly string[] | undefined,
   fallback: readonly string[],
@@ -264,6 +484,23 @@ function normalizeFieldList(
   return [...fallback];
 }
 
+function normalizeIdentifier(value: string): string {
+  const trimmed = value.trim();
+  if (!trimmed) return '';
+
+  if (!/^[a-z_][a-z0-9_]*$/.test(trimmed)) {
+    throw new Error(
+      `Invalid Supabase profile table identifier "${trimmed}". Use snake_case letters, numbers, and underscores.`,
+    );
+  }
+
+  return trimmed;
+}
+
+function quoteIdentifier(value: string): string {
+  return `"${value.replaceAll('"', '""')}"`;
+}
+
 function escapeYamlDoubleQuoted(value: string): string {
   return value.replaceAll('\\', '\\\\').replaceAll('"', '\\"');
 }