@avelonjs/supabase 0.1.0 → 0.3.0

package/src/identity/local-auth.ts

@@ -19,6 +19,19 @@ interface LocalReset {
   token: string
 }
 
+interface LocalFactor {
+  id: string
+  userId: string
+  factorType: 'totp'
+  status: 'verified'
+}
+
+interface LocalChallenge {
+  id: string
+  factorId: string
+  expiresAt: number
+}
+
 function hashPassword(password: string): string {
   return createHash('sha256').update(password).digest('hex')
 }
@@ -33,6 +46,9 @@ export class LocalAuthServer {
   readonly #users = new Map<string, LocalUser>()
   readonly #sessions = new Map<string, LocalSession>()
   readonly #resets = new Map<string, LocalReset>()
+  readonly #factors = new Map<string, LocalFactor>()
+  readonly #challenges = new Map<string, LocalChallenge>()
+  readonly #magicLinks = new Map<string, string>()
   #server: ReturnType<typeof Bun.serve> | undefined
   #url = ''
 
@@ -54,11 +70,14 @@ export class LocalAuthServer {
     return this.#url
   }
 
-  /** Clears users, sessions, and reset tokens without restarting the listener. */
+  /** Clears users, sessions, reset tokens, factors, and challenges without restarting the listener. */
   reset(): void {
     this.#users.clear()
     this.#sessions.clear()
     this.#resets.clear()
+    this.#factors.clear()
+    this.#challenges.clear()
+    this.#magicLinks.clear()
   }
 
   /** Stops the server and clears fixture state. */
@@ -73,15 +92,22 @@ export class LocalAuthServer {
     return [...this.#resets.values()].find((entry) => entry.email === email)?.token
   }
 
+  /** Returns the magic-link token issued for an email, if any. */
+  magicLinkToken(email: string): string | undefined {
+    return [...this.#magicLinks.entries()].find(([, value]) => value === email)?.[0]
+  }
+
   async #handle(request: Request): Promise<Response> {
     const url = new URL(request.url)
     const path = url.pathname.replace(/^\/auth\/v1/, '')
 
     if (request.method === 'POST' && path === '/signup') {
       const body = (await request.json()) as { email?: string; password?: string }
-      if (!body.email || !body.password) return json({ error: 'invalid' }, 400)
+      if (!body.email || !body.password) {
+        return fail(400, 'validation_failed', 'Unable to validate email address: invalid format')
+      }
       if ([...this.#users.values()].some((user) => user.email === body.email)) {
-        return json({ error: 'user_exists' }, 422)
+        return fail(422, 'user_already_exists', 'User already registered')
       }
       const user: LocalUser = {
         id: randomUUID(),
@@ -89,6 +115,7 @@ export class LocalAuthServer {
         passwordHash: hashPassword(body.password),
       }
       this.#users.set(user.id, user)
+      this.#provisionVerifiedTotp(user.id)
       const session = this.#createSession(user.id)
       return json({
         user: { id: user.id, email: user.email },
@@ -99,11 +126,15 @@ export class LocalAuthServer {
       })
     }
 
-    if (request.method === 'POST' && path === '/token' && url.searchParams.get('grant_type') === 'password') {
+    if (
+      request.method === 'POST' &&
+      path === '/token' &&
+      url.searchParams.get('grant_type') === 'password'
+    ) {
       const body = (await request.json()) as { email?: string; password?: string }
       const user = [...this.#users.values()].find((entry) => entry.email === body.email)
       if (!user || user.passwordHash !== hashPassword(body.password ?? '')) {
-        return json({ error: 'invalid_grant', error_description: 'Invalid login credentials' }, 400)
+        return fail(400, 'invalid_credentials', 'Invalid login credentials')
       }
       const session = this.#createSession(user.id)
       return json({
@@ -117,26 +148,26 @@ export class LocalAuthServer {
 
     if (request.method === 'GET' && path === '/user') {
       const session = this.#sessionFromAuth(request)
-      if (!session) return json({ error: 'not_authenticated' }, 401)
+      if (!session) return fail(401, 'bad_jwt', 'invalid claim: missing sub claim')
       const user = this.#users.get(session.userId)
-      if (!user) return json({ error: 'not_authenticated' }, 401)
+      if (!user) return fail(401, 'bad_jwt', 'invalid claim: missing sub claim')
       return json({ id: user.id, email: user.email })
     }
 
     if (request.method === 'POST' && path === '/logout') {
       const session = this.#sessionFromAuth(request)
-      if (!session) return json({ error: 'not_authenticated' }, 401)
+      if (!session) return fail(401, 'bad_jwt', 'invalid claim: missing sub claim')
       this.#sessions.delete(session.accessToken)
       return new Response(null, { status: 204 })
     }
 
     if (request.method === 'PUT' && path === '/user') {
       const session = this.#sessionFromAuth(request)
-      if (!session) return json({ error: 'not_authenticated' }, 401)
+      if (!session) return fail(401, 'bad_jwt', 'invalid claim: missing sub claim')
       const user = this.#users.get(session.userId)
-      if (!user) return json({ error: 'not_authenticated' }, 401)
+      if (!user) return fail(401, 'bad_jwt', 'invalid claim: missing sub claim')
       const body = (await request.json()) as { password?: string }
-      if (!body.password) return json({ error: 'invalid' }, 400)
+      if (!body.password) return fail(400, 'validation_failed', 'Missing required fields')
       user.passwordHash = hashPassword(body.password)
       return json({ id: user.id, email: user.email })
     }
@@ -151,32 +182,112 @@ export class LocalAuthServer {
     }
 
     if (request.method === 'PUT' && path === '/user' && url.searchParams.has('token')) {
-      return json({ error: 'use verify' }, 400)
+      return fail(400, 'validation_failed', 'Use the verify endpoint for recovery tokens')
     }
 
+    // GoTrue's `/verify` exchanges a recovery or magic-link token for a session. It has no password
+    // parameter: a caller that sends one gets a session back and an unchanged password.
     if (request.method === 'POST' && path === '/verify') {
       const body = (await request.json()) as {
         type?: string
         token?: string
-        password?: string
+        token_hash?: string
       }
-      if (body.type === 'recovery' && body.token && body.password) {
-        const reset = this.#resets.get(body.token)
-        if (!reset) return json({ error: 'invalid_token' }, 400)
-        const user = [...this.#users.values()].find((entry) => entry.email === reset.email)
-        if (!user) return json({ error: 'invalid_token' }, 400)
-        user.passwordHash = hashPassword(body.password)
-        this.#resets.delete(body.token)
-        return json({ user: { id: user.id, email: user.email } })
+      const token = body.token_hash ?? body.token
+      if ((body.type !== 'recovery' && body.type !== 'magiclink') || !token) {
+        return fail(400, 'validation_failed', 'Missing required fields')
       }
-      return json({ error: 'invalid' }, 400)
+      const email =
+        body.type === 'recovery' ? this.#resets.get(token)?.email : this.#magicLinks.get(token)
+      if (!email) return fail(403, 'otp_expired', 'Email link is invalid or has expired')
+      const user = [...this.#users.values()].find((entry) => entry.email === email)
+      if (!user) return fail(403, 'otp_expired', 'Email link is invalid or has expired')
+      if (body.type === 'recovery') this.#resets.delete(token)
+      else this.#magicLinks.delete(token)
+      const session = this.#createSession(user.id)
+      return json({
+        user: { id: user.id, email: user.email },
+        access_token: session.accessToken,
+        refresh_token: session.refreshToken,
+        expires_in: 3600,
+        token_type: 'bearer',
+      })
     }
 
     if (request.method === 'POST' && path === '/otp') {
+      const body = (await request.json()) as { email?: string }
+      if (body.email) this.#magicLinks.set(`assay-magic-${randomUUID()}`, body.email)
       return json({})
     }
 
-    return json({ error: 'not_found' }, 404)
+    if (request.method === 'GET' && path === '/factors') {
+      const session = this.#sessionFromAuth(request)
+      if (!session) return fail(401, 'bad_jwt', 'invalid claim: missing sub claim')
+      return json({
+        factors: [...this.#factors.values()]
+          .filter((factor) => factor.userId === session.userId)
+          .map((factor) => ({
+            id: factor.id,
+            factor_type: factor.factorType,
+            status: factor.status,
+          })),
+      })
+    }
+
+    const challengeMatch = /^\/factors\/([^/]+)\/challenge$/.exec(path)
+    if (request.method === 'POST' && challengeMatch) {
+      const session = this.#sessionFromAuth(request)
+      if (!session) return fail(401, 'bad_jwt', 'invalid claim: missing sub claim')
+      const factorId = challengeMatch[1]
+      const factor = factorId === undefined ? undefined : this.#factors.get(factorId)
+      if (!factor || factor.userId !== session.userId)
+        return fail(404, 'mfa_factor_not_found', 'MFA factor not found')
+      const challenge: LocalChallenge = {
+        id: randomUUID(),
+        factorId: factor.id,
+        expiresAt: Date.now() + 5 * 60 * 1000,
+      }
+      this.#challenges.set(challenge.id, challenge)
+      return json({
+        id: challenge.id,
+        expires_at: Math.floor(challenge.expiresAt / 1000),
+      })
+    }
+
+    const verifyMatch = /^\/factors\/([^/]+)\/verify$/.exec(path)
+    if (request.method === 'POST' && verifyMatch) {
+      const session = this.#sessionFromAuth(request)
+      if (!session) return fail(401, 'bad_jwt', 'invalid claim: missing sub claim')
+      const factorId = verifyMatch[1]
+      const factor = factorId === undefined ? undefined : this.#factors.get(factorId)
+      if (!factor || factor.userId !== session.userId)
+        return fail(404, 'mfa_factor_not_found', 'MFA factor not found')
+      const body = (await request.json()) as { challenge_id?: string; code?: string }
+      const challenge =
+        typeof body.challenge_id === 'string' ? this.#challenges.get(body.challenge_id) : undefined
+      if (
+        !challenge ||
+        challenge.factorId !== factor.id ||
+        challenge.expiresAt <= Date.now() ||
+        body.code !== '123456'
+      ) {
+        return fail(400, 'mfa_verification_failed', 'Invalid TOTP code entered')
+      }
+      this.#challenges.delete(challenge.id)
+      return json({})
+    }
+
+    return fail(404, 'validation_failed', 'Requested path is invalid')
+  }
+
+  #provisionVerifiedTotp(userId: string): void {
+    const factor: LocalFactor = {
+      id: randomUUID(),
+      userId,
+      factorType: 'totp',
+      status: 'verified',
+    }
+    this.#factors.set(factor.id, factor)
   }
 
   #createSession(userId: string): LocalSession {
@@ -201,6 +312,17 @@ export class LocalAuthServer {
   }
 }
 
+/**
+ * A GoTrue error envelope.
+ *
+ * Supabase Auth answers a failure with a numeric `code`, a stable `error_code`, and a `msg`
+ * sentence. The driver classifies on that envelope, so this server emits it rather than a shape
+ * invented to match the driver.
+ */
+function fail(status: number, errorCode: string, msg: string): Response {
+  return json({ code: status, error_code: errorCode, msg }, status)
+}
+
 function json(body: unknown, status = 200): Response {
   return new Response(JSON.stringify(body), {
     status,

package/src/queue/driver.ts

@@ -102,7 +102,7 @@ CREATE TABLE IF NOT EXISTS avelon_failed_jobs (
 /**
  * Postgres queue driver using `FOR UPDATE SKIP LOCKED`.
  *
- * The Wave A package names pgmq. This environment does not ship that extension, so the durable
+ * This package names pgmq. This environment does not ship that extension, so the durable
  * semantics are implemented with skip-locked tables rather than silently declaring the capability
  * false. Swap the SQL dialect for pgmq when the extension is present in CI.
  */
@@ -179,17 +179,21 @@ export class SupabaseQueue
         await this.#sql.unsafe(`DELETE FROM avelon_jobs WHERE id = $1`, [row.id])
       } catch (error: unknown) {
         if (this.capabilities.retries && row.attempt < this.#maxTries) {
-          await this.#sql.unsafe(
-            `UPDATE avelon_jobs SET locked_at = NULL WHERE id = $1`,
-            [row.id],
-          )
+          await this.#sql.unsafe(`UPDATE avelon_jobs SET locked_at = NULL WHERE id = $1`, [row.id])
           continue
         }
         if (this.capabilities.deadLetter) {
           await this.#sql.unsafe(
             `INSERT INTO avelon_failed_jobs (id, queue, name, payload, attempt, error, failed_at)
              VALUES ($1, $2, $3, $4::jsonb, $5, $6, now())`,
-            [row.id, row.queue, row.name, encodePayload(row.payload), row.attempt, failureMessage(error)],
+            [
+              row.id,
+              row.queue,
+              row.name,
+              encodePayload(row.payload),
+              row.attempt,
+              failureMessage(error),
+            ],
           )
         }
         await this.#sql.unsafe(`DELETE FROM avelon_jobs WHERE id = $1`, [row.id])

package/src/social/driver.ts

@@ -1,9 +1,4 @@
-import {
-  Invalid,
-  Unauthenticated,
-  type SocialDriver,
-  type SocialIdentity,
-} from '@avelonjs/core'
+import { Invalid, Unauthenticated, type SocialDriver, type SocialIdentity } from '@avelonjs/core'
 import type { SupabaseSocialProfile } from './types'
 
 /** Exact capability declaration for the Supabase social driver. */
@@ -41,9 +36,11 @@ function unauthenticated(message: string): never {
  * `redirect()` builds a GoTrue authorize URL and records CSRF state on the driver instance.
  * `callback()` verifies that state, then exchanges the authorization code over HTTP.
  */
-export class SupabaseSocial
-  implements SocialDriver<typeof supabaseSocialCapabilities, { authUrl: string }, SupabaseSocialProfile>
-{
+export class SupabaseSocial implements SocialDriver<
+  typeof supabaseSocialCapabilities,
+  { authUrl: string },
+  SupabaseSocialProfile
+> {
   readonly name = 'supabase'
   readonly instance: string
   readonly capabilities = supabaseSocialCapabilities

package/src/storage/driver.ts

@@ -80,9 +80,7 @@ CREATE TABLE IF NOT EXISTS avelon_storage_objects (
  * environment has no Supabase Storage service.
  */
 export class SupabaseStorage
-  implements
-    StorageDriver<typeof supabaseStorageCapabilities, SQL>,
-    SignedUrlStorageSurface
+  implements StorageDriver<typeof supabaseStorageCapabilities, SQL>, SignedUrlStorageSurface
 {
   readonly name = 'supabase'
   readonly instance: string
@@ -223,6 +221,7 @@ export function createSupabaseStorage(options: SupabaseStorageOptions = {}): Sup
   return new SupabaseStorage({
     url: options.url ?? defaultUrl(),
     instance: options.instance ?? 'default',
-    signingSecret: options.signingSecret ?? process.env.AVELON_STORAGE_SIGNING_SECRET ?? 'avelon-storage-secret',
+    signingSecret:
+      options.signingSecret ?? process.env.AVELON_STORAGE_SIGNING_SECRET ?? 'avelon-storage-secret',
   })
 }

package/src/tokens/driver.ts

@@ -97,10 +97,12 @@ export class SupabaseTokens implements TokenDriver<typeof supabaseTokenCapabilit
   readonly #sql: SQL
   readonly #subject: string
 
-  constructor(options: Required<Omit<SupabaseTokenOptions, 'url' | 'subject'>> & {
-    url: string
-    subject: string
-  }) {
+  constructor(
+    options: Required<Omit<SupabaseTokenOptions, 'url' | 'subject'>> & {
+      url: string
+      subject: string
+    },
+  ) {
     this.instance = options.instance
     this.#subject = options.subject
     this.#sql = new SQL(options.url)
@@ -129,7 +131,8 @@ export class SupabaseTokens implements TokenDriver<typeof supabaseTokenCapabilit
       [candidateHash],
     )) as StoredRow[]
     const row = rows[0]
-    const expiresAt = row?.expires_at === null || row?.expires_at === undefined ? null : asDate(row.expires_at)
+    const expiresAt =
+      row?.expires_at === null || row?.expires_at === undefined ? null : asDate(row.expires_at)
     if (
       row === undefined ||
       row.revoked ||
@@ -192,7 +195,8 @@ export class SupabaseTokens implements TokenDriver<typeof supabaseTokenCapabilit
 }
 
 function normalizeAbilities(value: unknown): string[] {
-  if (Array.isArray(value)) return value.filter((entry): entry is string => typeof entry === 'string')
+  if (Array.isArray(value))
+    return value.filter((entry): entry is string => typeof entry === 'string')
   if (typeof value === 'string') {
     try {
       const parsed: unknown = JSON.parse(value)