@avelonjs/supabase 0.1.0 → 0.3.0

package/src/identity/driver.ts

@@ -3,6 +3,8 @@ import {
   Unauthenticated,
   type IdentityDriver,
   type MagicLinkIdentitySurface,
+  type MfaChallenge,
+  type MfaIdentitySurface,
   type PasswordIdentitySurface,
   type RequestCookies,
 } from '@avelonjs/core'
@@ -12,6 +14,7 @@ import {
   readSessionCookie,
   writeSessionCookie,
 } from './cookies'
+import { describeAuthFailure, mapAuthError, readAuthResponse } from './errors'
 import type { SupabaseActor, SupabaseSession } from './types'
 
 /** Exact capability declaration for the Supabase identity driver. */
@@ -20,9 +23,12 @@ export const supabaseIdentityCapabilities = {
   magicLinks: true,
   oauth: false,
   organizations: false,
-  mfa: [] as const,
+  mfa: ['totp'] as const,
+  emailVerification: false,
 } as const
 
+type SupabaseMfaFactor = (typeof supabaseIdentityCapabilities.mfa)[number]
+
 /** Construction options for {@link createSupabaseIdentity}. */
 export interface SupabaseIdentityOptions {
   /** GoTrue Auth base URL, e.g. `http://127.0.0.1:54321/auth/v1`. */
@@ -60,7 +66,8 @@ export class SupabaseIdentity
       SupabaseSession
     >,
     PasswordIdentitySurface<SupabaseActor>,
-    MagicLinkIdentitySurface
+    MagicLinkIdentitySurface,
+    MfaIdentitySurface<SupabaseMfaFactor>
 {
   readonly name = 'supabase'
   readonly instance: string
@@ -91,7 +98,8 @@ export class SupabaseIdentity
       headers: this.#authHeaders(session.accessToken),
     })
     if (!response.ok) return null
-    const body = (await response.json()) as { id?: string; email?: string | null }
+    const body = (await readAuthResponse(response)).json
+    if (!isRecord(body)) return null
     if (typeof body.id !== 'string' || typeof body.email !== 'string') return null
     return { id: body.id, email: body.email }
   }
@@ -120,13 +128,22 @@ export class SupabaseIdentity
       headers: this.#jsonHeaders(),
       body: JSON.stringify({ email, password }),
     })
-    const body = (await response.json()) as TokenResponse
+    const body = await readAuthResponse(response)
     if (!response.ok) {
-      throw new Invalid(body.error_description ?? body.msg ?? body.error ?? 'Registration failed.', {
-        metadata: { fields: { email: ['Registration failed'] } },
+      mapAuthError(describeAuthFailure(response, body, 'Registration failed.'), {
+        operation: 'identity.register',
+        field: 'email',
+        rejection: 'unavailable',
+        cause: body.text,
       })
     }
-    return this.#commitSession(body)
+    const parsed = isTokenResponse(body.json) ? body.json : {}
+    // A project with "Confirm email" on answers a successful signup with the user and no session.
+    // The actor exists; treating a missing session as a failed registration reports the opposite of
+    // what happened, and the second attempt then collides with the account the first one created.
+    const pending = pendingConfirmationActor(body.json)
+    if (pending !== undefined && parsed.access_token === undefined) return pending
+    return this.#commitSession(parsed)
   }
 
   async signInWithPassword(email: string, password: string): Promise<SupabaseActor> {
@@ -135,33 +152,87 @@ export class SupabaseIdentity
       headers: this.#jsonHeaders(),
       body: JSON.stringify({ email, password }),
     })
-    const body = (await response.json()) as TokenResponse
+    const body = await readAuthResponse(response)
     if (!response.ok) {
-      throw new Unauthenticated(body.error_description ?? body.error ?? 'Invalid login credentials.', {
-        metadata: { guard: 'identity' },
+      mapAuthError(describeAuthFailure(response, body, 'Invalid login credentials.'), {
+        operation: 'identity.signInWithPassword',
+        field: 'email',
+        rejection: 'unauthenticated',
+        cause: body.text,
       })
     }
-    return this.#commitSession(body)
+    return this.#commitSession(isTokenResponse(body.json) ? body.json : {})
   }
 
+  /**
+   * Asks GoTrue to email a recovery link.
+   *
+   * GoTrue answers 200 for an address it does not know, so reporting the failure statuses does not
+   * reveal whether an account exists. Discarding them does hide a throttled project or a disabled
+   * email provider behind a screen that claims the message was sent.
+   */
   async sendPasswordReset(email: string): Promise<void> {
-    await this.#request('/recover', {
+    const response = await this.#request('/recover', {
       method: 'POST',
       headers: this.#jsonHeaders(),
       body: JSON.stringify({ email }),
     })
+    if (!response.ok) {
+      const body = await readAuthResponse(response)
+      mapAuthError(describeAuthFailure(response, body, 'Password reset could not be sent.'), {
+        operation: 'identity.sendPasswordReset',
+        field: 'email',
+        rejection: 'unavailable',
+        cause: body.text,
+      })
+    }
   }
 
+  /**
+   * Consumes a recovery token and writes the new password.
+   *
+   * GoTrue's `/verify` has no password parameter: it exchanges the token for a session and nothing
+   * else. Sending a password there returns 200 with the old password still in place, so recovery
+   * has to be two calls, and `token` is the `{{ .TokenHash }}` from the recovery email template.
+   * The session is deliberately not written to the cookie jar; the actor signs in with the password
+   * they just chose.
+   */
   async resetPassword(token: string, password: string): Promise<void> {
-    const response = await this.#request('/verify', {
+    const verified = await this.#request('/verify', {
       method: 'POST',
       headers: this.#jsonHeaders(),
-      body: JSON.stringify({ type: 'recovery', token, password }),
+      body: JSON.stringify({ type: 'recovery', token_hash: token }),
     })
-    if (!response.ok) {
-      const body = (await response.json()) as TokenResponse
-      throw new Invalid(body.error_description ?? body.error ?? 'Password reset failed.', {
+    const verifiedBody = await readAuthResponse(verified)
+    if (!verified.ok) {
+      mapAuthError(describeAuthFailure(verified, verifiedBody, 'Invalid recovery token.'), {
+        operation: 'identity.resetPassword',
+        field: 'token',
+        rejection: 'unauthenticated',
+        cause: verifiedBody.text,
+      })
+    }
+    const accessToken = isTokenResponse(verifiedBody.json)
+      ? verifiedBody.json.access_token
+      : undefined
+    if (typeof accessToken !== 'string') {
+      throw new Invalid('Recovery did not return a session.', {
         metadata: { fields: { token: ['Invalid recovery token'] } },
+        cause: verifiedBody.text,
+      })
+    }
+    const updated = await this.#request('/user', {
+      method: 'PUT',
+      headers: { ...this.#jsonHeaders(), ...this.#authHeaders(accessToken) },
+      body: JSON.stringify({ password }),
+    })
+    if (!updated.ok) {
+      const body = await readAuthResponse(updated)
+      mapAuthError(describeAuthFailure(updated, body, 'The new password was rejected.'), {
+        operation: 'identity.resetPassword',
+        field: 'password',
+        rejection: 'unauthenticated',
+        cause: body.text,
       })
     }
   }
@@ -186,11 +257,111 @@ export class SupabaseIdentity
   }
 
   async sendMagicLink(email: string, redirectTo?: string): Promise<void> {
-    await this.#request('/otp', {
+    const response = await this.#request('/otp', {
       method: 'POST',
       headers: this.#jsonHeaders(),
-      body: JSON.stringify({ email, create_user: true, gotrue_meta_security: {}, ...(redirectTo ? { email_redirect_to: redirectTo } : {}) }),
+      body: JSON.stringify({
+        email,
+        create_user: true,
+        gotrue_meta_security: {},
+        ...(redirectTo ? { email_redirect_to: redirectTo } : {}),
+      }),
     })
+    if (!response.ok) {
+      const body = await readAuthResponse(response)
+      mapAuthError(describeAuthFailure(response, body, 'Magic link could not be sent.'), {
+        operation: 'identity.sendMagicLink',
+        field: 'email',
+        rejection: 'unavailable',
+        cause: body.text,
+      })
+    }
+  }
+
+  /**
+   * Completes a sign-in from the token the emailed link carried.
+   *
+   * `token` is the `{{ .TokenHash }}` from the Magic Link email template. GoTrue's stock template
+   * links to its own `/verify`, which redeems the token itself and returns the session in the URL
+   * fragment, where a server never sees it.
+   */
+  async signInWithMagicLink(token: string): Promise<SupabaseActor> {
+    const response = await this.#request('/verify', {
+      method: 'POST',
+      headers: this.#jsonHeaders(),
+      body: JSON.stringify({ type: 'magiclink', token_hash: token }),
+    })
+    const body = await readAuthResponse(response)
+    if (!response.ok) {
+      mapAuthError(describeAuthFailure(response, body, 'Invalid sign-in link.'), {
+        operation: 'identity.signInWithMagicLink',
+        field: 'token',
+        rejection: 'unauthenticated',
+        cause: body.text,
+      })
+    }
+    return this.#commitSession(isTokenResponse(body.json) ? body.json : {})
+  }
+
+  async challengeMfa(factor?: SupabaseMfaFactor): Promise<MfaChallenge<SupabaseMfaFactor>> {
+    const selected: string = factor ?? 'totp'
+    if (selected !== 'totp') {
+      throw invalidField('factor', 'Unsupported multi-factor method.')
+    }
+    const session = readSessionCookie(this.#cookies, this.#cookieName)
+    if (!session) {
+      throw unauthenticated('No authenticated session is present.')
+    }
+    const listed = await this.#request('/factors', {
+      method: 'GET',
+      headers: this.#authHeaders(session.accessToken),
+    })
+    if (!listed.ok) {
+      throw unauthenticated('No authenticated session is present.')
+    }
+    const totp = pickTotpFactor(parseFactors(await readVendorJson(listed)))
+    if (!totp) {
+      throw invalidField('factor', 'No TOTP factor is enrolled.')
+    }
+    const challenged = await this.#request(`/factors/${encodeURIComponent(totp.id)}/challenge`, {
+      method: 'POST',
+      headers: { ...this.#jsonHeaders(), ...this.#authHeaders(session.accessToken) },
+    })
+    if (!challenged.ok) {
+      if (challenged.status === 401) {
+        throw unauthenticated('No authenticated session is present.')
+      }
+      throw invalidField('factor', 'No TOTP factor is enrolled.')
+    }
+    const challenge = parseChallenge(await readVendorJson(challenged))
+    return {
+      id: `${totp.id}:${challenge.id}`,
+      factor: 'totp',
+      expiresAt: challenge.expiresAt,
+    }
+  }
+
+  async verifyMfa(challengeId: string, code: string): Promise<void> {
+    const session = readSessionCookie(this.#cookies, this.#cookieName)
+    if (!session) {
+      throw unauthenticated('No authenticated session is present.')
+    }
+    const encoded = splitEncodedChallengeId(challengeId)
+    const verified = await this.#request(
+      `/factors/${encodeURIComponent(encoded.factorId)}/verify`,
+      {
+        method: 'POST',
+        headers: { ...this.#jsonHeaders(), ...this.#authHeaders(session.accessToken) },
+        body: JSON.stringify({ challenge_id: encoded.gotrueChallengeId, code }),
+      },
+    )
+    if (!verified.ok) {
+      throw unauthenticated('Invalid multi-factor challenge.')
+    }
+    const body = await readVendorJson(verified)
+    if (isTokenResponse(body)) {
+      this.#commitSession(body)
+    }
   }
 
   #commitSession(body: TokenResponse): SupabaseActor {
@@ -249,3 +420,111 @@ export function createSupabaseIdentity(
   }
   return (cookies) => new SupabaseIdentity(cookies, resolved)
 }
+
+function unauthenticated(message: string): Unauthenticated {
+  return new Unauthenticated(message, { metadata: { guard: 'identity' } })
+}
+
+function invalidField(field: string, message: string): Invalid {
+  return new Invalid(message, { metadata: { fields: { [field]: [message] } } })
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+/** Reads a GoTrue JSON body at the vendor HTTP boundary. */
+async function readVendorJson(response: Response): Promise<unknown> {
+  return (await readAuthResponse(response)).json
+}
+
+/**
+ * The actor from a signup that succeeded but issued no session.
+ *
+ * GoTrue returns the user at the top level for a confirmation-required signup, and nests it under
+ * `user` when it also issues a session.
+ */
+function pendingConfirmationActor(json: unknown): SupabaseActor | undefined {
+  if (!isRecord(json)) return undefined
+  const source = isRecord(json.user) ? json.user : json
+  const id = source.id
+  const email = source.email
+  if (typeof id !== 'string' || typeof email !== 'string') return undefined
+  return { id, email }
+}
+
+interface GoTrueFactor {
+  id: string
+  kind: string
+  status: string | undefined
+}
+
+function parseFactors(body: unknown): readonly GoTrueFactor[] {
+  if (!isRecord(body) || !Array.isArray(body.factors)) return []
+  const factors: GoTrueFactor[] = []
+  for (const entry of body.factors) {
+    if (!isRecord(entry) || typeof entry.id !== 'string') continue
+    const kind = entry.factor_type ?? entry.type
+    if (typeof kind !== 'string') continue
+    factors.push({
+      id: entry.id,
+      kind,
+      status: typeof entry.status === 'string' ? entry.status : undefined,
+    })
+  }
+  return factors
+}
+
+function pickTotpFactor(factors: readonly GoTrueFactor[]): GoTrueFactor | undefined {
+  const totp = factors.filter((factor) => factor.kind === 'totp')
+  return (
+    totp.find((factor) => factor.status === 'verified' || factor.status === 'active') ?? totp[0]
+  )
+}
+
+function parseChallenge(body: unknown): { id: string; expiresAt: Date } {
+  if (!isRecord(body) || typeof body.id !== 'string' || body.id.length === 0) {
+    throw invalidField('factor', 'Auth response was missing an MFA challenge.')
+  }
+  return { id: body.id, expiresAt: parseExpiresAt(body.expires_at) }
+}
+
+function parseExpiresAt(value: unknown): Date {
+  if (typeof value === 'number' && Number.isFinite(value)) {
+    return new Date(value * 1000)
+  }
+  if (typeof value === 'string' && value.length > 0) {
+    if (/^\d+(\.\d+)?$/.test(value)) {
+      return new Date(Number(value) * 1000)
+    }
+    const parsed = new Date(value)
+    if (!Number.isNaN(parsed.getTime())) return parsed
+  }
+  return new Date(Date.now() + 5 * 60 * 1000)
+}
+
+function splitEncodedChallengeId(challengeId: string): {
+  factorId: string
+  gotrueChallengeId: string
+} {
+  const separator = challengeId.indexOf(':')
+  if (separator <= 0 || separator === challengeId.length - 1) {
+    throw invalidField('challengeId', 'MFA challenge id is malformed.')
+  }
+  return {
+    factorId: challengeId.slice(0, separator),
+    gotrueChallengeId: challengeId.slice(separator + 1),
+  }
+}
+
+function isTokenResponse(value: unknown): value is TokenResponse {
+  if (!isRecord(value)) return false
+  const user = value.user
+  return (
+    isRecord(user) &&
+    typeof user.id === 'string' &&
+    typeof user.email === 'string' &&
+    typeof value.access_token === 'string' &&
+    typeof value.refresh_token === 'string'
+  )
+}

package/src/identity/errors.ts

@@ -0,0 +1,230 @@
+import { Conflict, Invalid, RateLimited, Unauthenticated, Unavailable } from '@avelonjs/core'
+
+/**
+ * A GoTrue response body read once, before anything decides whether it succeeded.
+ *
+ * Supabase serves Auth behind an API gateway that answers a rejected key with HTML or an empty
+ * body, so `response.json()` on the failure path throws a `SyntaxError` that never reaches the
+ * error taxonomy. Reading the text first keeps the raw payload for `.cause`.
+ */
+export interface AuthResponseBody {
+  /** Parsed JSON, or `undefined` when the body was empty or not JSON. */
+  readonly json: unknown
+  /** Raw response text. */
+  readonly text: string
+}
+
+/** Reads a GoTrue body at the vendor HTTP boundary without throwing on a non-JSON payload. */
+export async function readAuthResponse(response: Response): Promise<AuthResponseBody> {
+  const text = await response.text()
+  if (text.length === 0) return { json: undefined, text }
+  try {
+    return { json: JSON.parse(text) as unknown, text }
+  } catch {
+    return { json: undefined, text }
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function stringOrUndefined(value: unknown): string | undefined {
+  return typeof value === 'string' && value.length > 0 ? value : undefined
+}
+
+/**
+ * Whether a string is a machine code rather than prose.
+ *
+ * GoTrue's OAuth-shaped bodies put the code in `error` (`invalid_grant`) and the sentence in
+ * `error_description`, while its gateway puts a sentence in `error`. One field, two meanings,
+ * separated by whether it contains a space.
+ */
+function isCodeLike(value: string): boolean {
+  return !/\s/.test(value)
+}
+
+/**
+ * The human-readable reason, across every shape Supabase Auth has shipped.
+ *
+ * GoTrue uses `msg`, its newer error envelope uses `message`, the OAuth-shaped endpoints use
+ * `error_description`, and the API gateway in front of the project uses `message` alone. Reading
+ * only the first of those is what turns "Invalid API key" into a blank failure.
+ */
+export function authErrorMessage(json: unknown): string | undefined {
+  if (!isRecord(json)) return undefined
+  const nested = isRecord(json.error) ? json.error : undefined
+  const bare = stringOrUndefined(json.error)
+  return (
+    stringOrUndefined(json.error_description) ??
+    stringOrUndefined(json.msg) ??
+    stringOrUndefined(json.message) ??
+    stringOrUndefined(nested?.message) ??
+    stringOrUndefined(nested?.msg) ??
+    (bare !== undefined && !isCodeLike(bare) ? bare : undefined)
+  )
+}
+
+/** The stable GoTrue error code, ignoring the numeric `code` that older bodies set to the status. */
+export function authErrorCode(json: unknown): string | undefined {
+  if (!isRecord(json)) return undefined
+  const nested = isRecord(json.error) ? json.error : undefined
+  const bare = stringOrUndefined(json.error)
+  return (
+    stringOrUndefined(json.error_code) ??
+    stringOrUndefined(nested?.error_code) ??
+    stringOrUndefined(json.code) ??
+    stringOrUndefined(nested?.code) ??
+    (bare !== undefined && isCodeLike(bare) ? bare : undefined)
+  )
+}
+
+const DUPLICATE_CODES = new Set([
+  'user_already_exists',
+  'user_exists',
+  'email_exists',
+  'phone_exists',
+])
+
+const RATE_LIMIT_CODES = new Set([
+  'over_request_rate_limit',
+  'over_email_send_rate_limit',
+  'over_sms_send_rate_limit',
+])
+
+const DISABLED_CODES = new Set([
+  'signup_disabled',
+  'email_provider_disabled',
+  'phone_provider_disabled',
+  'provider_disabled',
+  'anonymous_provider_disabled',
+])
+
+const CREDENTIAL_CODES = new Set([
+  'invalid_credentials',
+  'invalid_grant',
+  'not_authenticated',
+  'email_not_confirmed',
+  'user_banned',
+  'no_authorization',
+  'bad_jwt',
+  'session_expired',
+  'session_not_found',
+])
+
+/** How a GoTrue failure is described once the vendor shape has been read. */
+export interface AuthFailure {
+  /** HTTP status the Auth surface returned. */
+  readonly status: number
+  /** Stable GoTrue error code when the body carried one. */
+  readonly code: string | undefined
+  /** Vendor message, already falling back to the caller's wording. */
+  readonly message: string
+}
+
+/**
+ * Describes a failed Auth response without deciding which taxonomy member it belongs to.
+ *
+ * A body with no readable message leaves only the status to report, so the status is stated. A
+ * bare "Registration failed." in front of an operator reading a 404 tells them nothing.
+ */
+export function describeAuthFailure(
+  response: Response,
+  body: AuthResponseBody,
+  fallback: string,
+): AuthFailure {
+  const message = authErrorMessage(body.json)
+  return {
+    status: response.status,
+    code: authErrorCode(body.json),
+    message: message ?? `${fallback} Supabase Auth returned HTTP ${response.status}.`,
+  }
+}
+
+function isGatewayKeyFailure(failure: AuthFailure): boolean {
+  if (failure.status !== 401 && failure.status !== 403) return false
+  if (failure.code !== undefined) return false
+  return /api key|apikey/i.test(failure.message)
+}
+
+/** Where a failure belongs in the form: the field that carries its message. */
+export type AuthField = 'email' | 'password' | 'token' | 'code'
+
+/** How a caller wants a 401 or 403 that is not a rejected API key classified. */
+export type AuthRejection = 'unauthenticated' | 'unavailable'
+
+/**
+ * Maps a failed GoTrue response onto the framework taxonomy, keeping the vendor body as `.cause`.
+ *
+ * `field` names the input the caller was acting on. A weak password reports on `password` whatever
+ * the caller passed, because that is the input the actor has to change.
+ *
+ * `rejection` exists because a 401 means different things per operation. Sign-in answers one with
+ * `Unauthenticated`, which the kernel turns into a redirect to the login page. Registration answers
+ * the same status with `Unavailable`: nobody was authenticating, so bouncing to a login page hides
+ * a project that is refusing the call.
+ */
+export function mapAuthError(
+  failure: AuthFailure,
+  options: {
+    readonly operation: string
+    readonly field: AuthField
+    readonly rejection: AuthRejection
+    readonly cause: unknown
+  },
+): never {
+  const { message, code, status } = failure
+  const cause = { status, code, body: options.cause, operation: options.operation }
+
+  if (
+    DUPLICATE_CODES.has(code ?? '') ||
+    /already (registered|been registered|exists)/i.test(message)
+  ) {
+    throw new Conflict(message, { metadata: { resource: 'actor', key: 'email' }, cause })
+  }
+
+  if (RATE_LIMIT_CODES.has(code ?? '') || status === 429) {
+    throw new RateLimited(message, { metadata: { key: options.operation }, cause })
+  }
+
+  if (isGatewayKeyFailure(failure)) {
+    throw new Unavailable(message, { metadata: { service: 'identity' }, cause })
+  }
+
+  // GoTrue serves every documented path; a 404 or 405 means the configured auth URL is not one.
+  if (status === 404 || status === 405) {
+    throw new Unavailable(message, { metadata: { service: 'identity' }, cause })
+  }
+
+  if (DISABLED_CODES.has(code ?? '')) {
+    throw new Unavailable(message, { metadata: { service: 'identity' }, cause })
+  }
+
+  if (CREDENTIAL_CODES.has(code ?? '') || status === 401 || status === 403) {
+    if (options.rejection === 'unavailable') {
+      throw new Unavailable(message, { metadata: { service: 'identity' }, cause })
+    }
+    throw new Unauthenticated(message, { metadata: { guard: 'identity' }, cause })
+  }
+
+  if (status >= 500) {
+    throw new Unavailable(message, { metadata: { service: 'identity' }, cause })
+  }
+
+  const field = code === 'weak_password' ? 'password' : options.field
+  throw new Invalid(message, { metadata: { fields: { [field]: [message] } }, cause })
+}
+
+/** GoTrue error codes this driver maps, and the taxonomy member each becomes. */
+export const SUPABASE_IDENTITY_ERROR_MAP = [
+  { code: 'user_already_exists', framework: 'Conflict', meaning: 'email is already registered' },
+  { code: 'email_exists', framework: 'Conflict', meaning: 'email is already registered' },
+  { code: 'over_email_send_rate_limit', framework: 'RateLimited', meaning: 'email send throttled' },
+  { code: 'over_request_rate_limit', framework: 'RateLimited', meaning: 'request throttled' },
+  { code: 'signup_disabled', framework: 'Unavailable', meaning: 'project refuses new signups' },
+  { code: 'email_provider_disabled', framework: 'Unavailable', meaning: 'email provider is off' },
+  { code: 'invalid_credentials', framework: 'Unauthenticated', meaning: 'password did not match' },
+  { code: 'email_not_confirmed', framework: 'Unauthenticated', meaning: 'email is unconfirmed' },
+  { code: 'weak_password', framework: 'Invalid', meaning: 'password fails the project policy' },
+  { code: 'validation_failed', framework: 'Invalid', meaning: 'input rejected by the Auth server' },
+] as const

package/src/identity/index.ts

@@ -4,6 +4,7 @@ export {
   readSessionCookie,
   writeSessionCookie,
 } from './cookies'
+export { SUPABASE_IDENTITY_ERROR_MAP } from './errors'
 export {
   createSupabaseIdentity,
   SupabaseIdentity,