@deverjak/tenantkit-adapter-supabase 0.1.2 → 0.1.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +28 -5
- package/package.json +4 -4
package/README.md
CHANGED
|
@@ -17,13 +17,36 @@ pnpm add @deverjak/tenantkit-kernel @deverjak/tenantkit-adapter-supabase @deverj
|
|
|
17
17
|
```
|
|
18
18
|
|
|
19
19
|
```bash
|
|
20
|
-
# .env
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
RESEND_API_KEY=re_...
|
|
20
|
+
# .env — modern Supabase key names (legacy SUPABASE_ANON_KEY / SUPABASE_SERVICE_ROLE_KEY are also accepted)
|
|
21
|
+
NEXT_PUBLIC_SUPABASE_URL=https://YOUR-PROJECT.supabase.co
|
|
22
|
+
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=sb_publishable_... # browser-safe; RLS-enforced
|
|
23
|
+
SUPABASE_SECRET_KEY=sb_secret_... # server-only — bypasses RLS, never ship to the browser
|
|
24
|
+
RESEND_API_KEY=re_... # only if you use @deverjak/tenantkit-email-resend
|
|
25
25
|
```
|
|
26
26
|
|
|
27
|
+
## Which keys do you need?
|
|
28
|
+
|
|
29
|
+
The adapter uses **two** Supabase API keys and `SUPABASE_URL`. It accepts both the **new** key names
|
|
30
|
+
(`*_PUBLISHABLE_KEY` / `SUPABASE_SECRET_KEY`) and the **legacy** ones (`SUPABASE_ANON_KEY` /
|
|
31
|
+
`SUPABASE_SERVICE_ROLE_KEY`); the `NEXT_PUBLIC_*` variants are read too (required by the Edge proxy/middleware).
|
|
32
|
+
|
|
33
|
+
| You want to… | Key needed | Env var |
|
|
34
|
+
|---|---|---|
|
|
35
|
+
| **Auth** — sign in / sign up / magic link / OAuth / session refresh | **publishable** (anon) | `NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY` |
|
|
36
|
+
| **Tables as the signed-in user** — RLS-scoped reads/writes (`ctx.db.user()`) | **publishable** (anon) | *(same — the user's JWT rides the cookie)* |
|
|
37
|
+
| **Public / anon table reads** (`ctx.db.anon()`) | **publishable** (anon) | *(same)* |
|
|
38
|
+
| **The tenant layer** — `resolveClaims` (memberships, profiles), `provisionTenant`, plugin activation, tenant tier | **secret** (service-role) | `SUPABASE_SECRET_KEY` |
|
|
39
|
+
| **Storage** — logos / exports (`StorageProvider`) | **secret** (service-role) | `SUPABASE_SECRET_KEY` |
|
|
40
|
+
| **Admin** — invite staff (`createUser`), mint magic links (`createMagicLink`) | **secret** (service-role) | `SUPABASE_SECRET_KEY` |
|
|
41
|
+
| **Rate limits / webhooks / cron** (`Database.service()`) | **secret** (service-role) | `SUPABASE_SECRET_KEY` |
|
|
42
|
+
|
|
43
|
+
**Rule of thumb:** the **publishable key alone** runs all user-facing **auth + RLS-scoped data**. Add the
|
|
44
|
+
**secret key** the moment you touch the **tenant/authz layer, storage, admin user creation, or any service-role
|
|
45
|
+
work** — it bypasses RLS, so keep it **server-only** (never in a `NEXT_PUBLIC_*` var or the browser bundle).
|
|
46
|
+
|
|
47
|
+
> The project's **JWT secret** is *not* used by this adapter — it authenticates with the API keys above, it does
|
|
48
|
+
> not verify JWTs itself. You only need the JWT secret if you verify Supabase tokens manually elsewhere.
|
|
49
|
+
|
|
27
50
|
## Wire it (≈12 lines)
|
|
28
51
|
|
|
29
52
|
```ts
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@deverjak/tenantkit-adapter-supabase",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.4",
|
|
4
4
|
"description": "Supabase reference adapter for @deverjak/tenantkit-kernel — Database, Identity, Session, Authz, Storage. Drop-in: createSupabaseRuntime() -> CoreRuntime.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -29,8 +29,8 @@
|
|
|
29
29
|
"access": "public"
|
|
30
30
|
},
|
|
31
31
|
"peerDependencies": {
|
|
32
|
-
"
|
|
33
|
-
"
|
|
32
|
+
"@deverjak/tenantkit-kernel": "^0.3.0",
|
|
33
|
+
"next": ">=15"
|
|
34
34
|
},
|
|
35
35
|
"dependencies": {
|
|
36
36
|
"@supabase/ssr": "^0.8.0",
|
|
@@ -41,7 +41,7 @@
|
|
|
41
41
|
"@types/node": "^22.10.0",
|
|
42
42
|
"typescript": "^5.9.3",
|
|
43
43
|
"vitest": "^4.0.0",
|
|
44
|
-
"@deverjak/tenantkit-kernel": "0.
|
|
44
|
+
"@deverjak/tenantkit-kernel": "0.3.0",
|
|
45
45
|
"@deverjak/tenantkit-testing": "0.1.0"
|
|
46
46
|
},
|
|
47
47
|
"scripts": {
|