@donotdev/functions 0.0.11 → 0.0.13

package/src/shared/oauth/__tests__/exchangeToken.test.ts

@@ -11,11 +11,11 @@
 
 import { describe, it, expect, vi } from 'vitest';
 
-import {
-  exchangeTokenAlgorithm,
-  type OAuthProvider,
-} from '../exchangeToken';
-import type { ExchangeTokenRequest, TokenResponse } from '@donotdev/core/server';
+import { exchangeTokenAlgorithm, type OAuthProvider } from '../exchangeToken';
+import type {
+  ExchangeTokenRequest,
+  TokenResponse,
+} from '@donotdev/core/server';
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -94,9 +94,7 @@ describe('exchangeTokenAlgorithm', () => {
 
   describe('error scenarios', () => {
     it('re-throws errors from provider', async () => {
-      const oauthProvider = makeRejectingProvider(
-        new Error('invalid_grant')
-      );
+      const oauthProvider = makeRejectingProvider(new Error('invalid_grant'));
 
       await expect(
         exchangeTokenAlgorithm(BASE_REQUEST, oauthProvider)

package/src/shared/oauth/__tests__/grantAccess.test.ts

@@ -1,17 +1,15 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 
-import {
-  grantAccessAlgorithm,
-  type OAuthGrantProvider,
-} from '../grantAccess';
+import { grantAccessAlgorithm, type OAuthGrantProvider } from '../grantAccess';
 
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
 
-function makeProvider(
-  result: { success: boolean; message: string }
-): OAuthGrantProvider {
+function makeProvider(result: {
+  success: boolean;
+  message: string;
+}): OAuthGrantProvider {
   return { grantAccess: vi.fn().mockResolvedValue(result) };
 }
 
@@ -187,7 +185,10 @@ describe('grantAccessAlgorithm', () => {
         );
 
         expect(oauthProvider.grantAccess).toHaveBeenCalledWith(
-          expect.objectContaining({ provider: providerName, accessToken: token })
+          expect.objectContaining({
+            provider: providerName,
+            accessToken: token,
+          })
         );
       }
     );
@@ -199,12 +200,16 @@ describe('grantAccessAlgorithm', () => {
 
   describe('error scenarios', () => {
     it('re-throws synchronous errors from provider', async () => {
-      const oauthProvider = makeRejectingProvider(
-        new Error('network failure')
-      );
+      const oauthProvider = makeRejectingProvider(new Error('network failure'));
 
       await expect(
-        grantAccessAlgorithm(userId, provider, accessToken, refreshToken, oauthProvider)
+        grantAccessAlgorithm(
+          userId,
+          provider,
+          accessToken,
+          refreshToken,
+          oauthProvider
+        )
       ).rejects.toThrow('network failure');
     });
 
@@ -220,7 +225,13 @@ describe('grantAccessAlgorithm', () => {
       const oauthProvider = makeRejectingProvider(originalError);
 
       await expect(
-        grantAccessAlgorithm(userId, provider, accessToken, refreshToken, oauthProvider)
+        grantAccessAlgorithm(
+          userId,
+          provider,
+          accessToken,
+          refreshToken,
+          oauthProvider
+        )
       ).rejects.toThrow('token expired');
     });
 
@@ -228,7 +239,13 @@ describe('grantAccessAlgorithm', () => {
       const oauthProvider = makeRejectingProvider(new Error('boom'));
 
       await expect(
-        grantAccessAlgorithm(userId, provider, accessToken, refreshToken, oauthProvider)
+        grantAccessAlgorithm(
+          userId,
+          provider,
+          accessToken,
+          refreshToken,
+          oauthProvider
+        )
       ).rejects.toThrow('boom');
 
       expect(oauthProvider.grantAccess).toHaveBeenCalledOnce();

package/src/shared/utils/external/subscription.ts

@@ -49,7 +49,7 @@ export function getTierFromPriceId(priceId: string): string {
  * @since 0.0.1
  * @author AMBROISE PARK Consulting
  */
-export async function updateUserSubscription(
+export async function updateFirebaseUserSubscription(
   firebaseUid: string,
   subscription: any
 ): Promise<void> {
@@ -171,7 +171,7 @@ export async function cancelUserSubscription(
       .doc(firebaseUid)
       .update({
         ...subscriptionClaims,
-        updatedAt: Date.now(),
+        updatedAt: new Date().toISOString(),
       });
 
     console.log(`Subscription canceled for user ${firebaseUid}:`, {

package/src/shared/utils/internal/auth.ts

@@ -74,7 +74,10 @@ export async function assertAdmin(uid: string): Promise<string> {
   } catch (error) {
     // C4: Re-throw permission-denied as-is so callers can distinguish it from
     // infrastructure failures. Only wrap genuine unexpected errors.
-    if (error instanceof Error && error.message === 'Admin privileges required') {
+    if (
+      error instanceof Error &&
+      error.message === 'Admin privileges required'
+    ) {
       throw error;
     }
     throw new Error('Failed to verify admin status');
@@ -161,7 +164,8 @@ async function verifySupabaseToken(token: string): Promise<{ uid: string }> {
   const { createClient } = await import('@supabase/supabase-js');
 
   const supabaseUrl = process.env.SUPABASE_URL;
-  const secretKey = process.env.SUPABASE_SECRET_KEY || process.env.SUPABASE_SERVICE_ROLE_KEY;
+  const secretKey =
+    process.env.SUPABASE_SECRET_KEY || process.env.SUPABASE_SERVICE_ROLE_KEY;
 
   if (!supabaseUrl || !secretKey) {
     throw new Error(
@@ -173,7 +177,10 @@ async function verifySupabaseToken(token: string): Promise<{ uid: string }> {
     auth: { autoRefreshToken: false, persistSession: false },
   });
 
-  const { data: { user }, error } = await supabaseAdmin.auth.getUser(token);
+  const {
+    data: { user },
+    error,
+  } = await supabaseAdmin.auth.getUser(token);
 
   if (error || !user) {
     throw new Error('Invalid or expired token');

package/src/shared/utils/internal/rateLimiter.ts

@@ -12,7 +12,10 @@
 import { logger } from 'firebase-functions/v2';
 
 import { getFirebaseAdminFirestore } from '@donotdev/firebase/server';
-import type { ServerRateLimitConfig as RateLimitConfig, ServerRateLimitResult as RateLimitResult } from '@donotdev/core';
+import type {
+  ServerRateLimitConfig as RateLimitConfig,
+  ServerRateLimitResult as RateLimitResult,
+} from '@donotdev/core';
 
 export type { RateLimitConfig, RateLimitResult };
 
@@ -204,7 +207,10 @@ export async function checkRateLimitWithFirestore(
       }
 
       // Increment attempts
-      tx.update(rateLimitRef, { attempts: data.attempts + 1, lastUpdated: now });
+      tx.update(rateLimitRef, {
+        attempts: data.attempts + 1,
+        lastUpdated: now,
+      });
       result = {
         allowed: true,
         remaining: config.maxAttempts - (data.attempts + 1),

package/src/shared/utils.ts

@@ -20,6 +20,11 @@ import {
   initFirebaseAdmin,
 } from '@donotdev/firebase/server';
 
+import {
+  assertAuthenticated as internalAssertAuthenticated,
+  assertAdmin as internalAssertAdmin,
+} from './utils/internal/auth.js';
+
 // Re-export DoNotDevError for external use
 export { DoNotDevError };
 
@@ -103,20 +108,24 @@ export const stripe = new Proxy({} as Stripe, {
 
 /**
  * Assert that a user is authenticated from a Firebase callable auth context.
- * For Vercel/Next.js routes, use `verifyAuthToken` from `shared/utils/internal/auth.js` instead.
+ *
+ * @deprecated Use `assertAuthenticated` from `shared/utils/internal/auth.js` instead.
+ * This wrapper extracts uid from a Firebase callable auth context and delegates
+ * to the canonical version.
  *
  * @param auth - Firebase callable request auth context (object with `.uid`)
  * @returns The authenticated user's uid
  *
- * @version 0.0.2
+ * @version 0.0.3
  * @since 0.0.1
  * @author AMBROISE PARK Consulting
  */
 export function assertAuthenticated(auth: any): string {
-  if (!auth || !auth.uid) {
+  const uid = auth?.uid;
+  if (!uid) {
     throw new Error('User must be authenticated');
   }
-  return auth.uid;
+  return internalAssertAuthenticated(uid);
 }
 
 /**
@@ -317,35 +326,15 @@ export async function handleSubscriptionCancellation(
  * Asserts that a user has admin privileges
  * Uses role hierarchy: super > admin > user > guest
  *
- * @version 0.0.2
+ * @deprecated Use `assertAdmin` from `shared/utils/internal/auth.js` instead.
+ * This is a thin wrapper that delegates to the canonical provider-agnostic version.
+ *
+ * @version 0.0.3
  * @since 0.0.1
  * @author AMBROISE PARK Consulting
  */
 export async function assertAdmin(uid: string): Promise<string> {
-  if (!uid) {
-    throw new DoNotDevError('Authentication required', 'unauthenticated');
-  }
-
-  try {
-    const user = await getFirebaseAdminAuth().getUser(uid);
-    const claims = user.customClaims || {};
-
-    // Check role claim first (standard pattern)
-    const role = claims.role;
-    if (role === 'admin' || role === 'super') {
-      return uid;
-    }
-
-    // Fallback: check legacy boolean flags
-    if (claims.isAdmin === true || claims.isSuper === true) {
-      return uid;
-    }
-
-    throw new DoNotDevError('Admin privileges required', 'permission-denied');
-  } catch (error) {
-    if (error instanceof DoNotDevError) throw error;
-    throw new DoNotDevError('Failed to verify admin status', 'internal');
-  }
+  return internalAssertAdmin(uid);
 }
 
 /**
@@ -450,7 +439,11 @@ export async function findReferences(
     }>;
   }
 ): Promise<Array<{ collection: string; field: string; count: number }>> {
-  const references: Array<{ collection: string; field: string; count: number }> = [];
+  const references: Array<{
+    collection: string;
+    field: string;
+    count: number;
+  }> = [];
 
   if (!referenceMetadata?.incoming?.length) {
     return references;

package/src/supabase/auth/deleteAccount.ts

@@ -17,9 +17,7 @@ import { createSupabaseHandler } from '../baseFunction.js';
 // Schema
 // =============================================================================
 
-const deleteAccountSchema = v.object({
-  userId: v.pipe(v.string(), v.minLength(1, 'User ID is required')),
-});
+const deleteAccountSchema = v.object({});
 
 // =============================================================================
 // Handler
@@ -44,16 +42,11 @@ export function createDeleteAccount() {
   return createSupabaseHandler(
     'delete-account',
     deleteAccountSchema,
-    async (data, ctx) => {
-      // Guard: users can only delete their own account
-      if (data.userId !== ctx.uid) {
-        throw new Error('Forbidden: cannot delete another user');
-      }
-
-      const { error } = await ctx.supabaseAdmin.auth.admin.deleteUser(data.userId);
+    async (_data, ctx) => {
+      const { error } = await ctx.supabaseAdmin.auth.admin.deleteUser(ctx.uid);
       if (error) throw error;
 
       return { success: true };
-    },
+    }
   );
 }

package/src/supabase/auth/getCustomClaims.ts

@@ -43,14 +43,16 @@ export function createGetCustomClaims() {
     'get-custom-claims',
     getCustomClaimsSchema,
     async (_data, ctx) => {
-      const { data: { user }, error } =
-        await ctx.supabaseAdmin.auth.admin.getUserById(ctx.uid);
+      const {
+        data: { user },
+        error,
+      } = await ctx.supabaseAdmin.auth.admin.getUserById(ctx.uid);
       if (error || !user) {
         throw new Error('User not found');
       }
 
       return { customClaims: user.app_metadata ?? {} };
     },
-    'user',
+    'user'
   );
 }

package/src/supabase/auth/getUserAuthStatus.ts

@@ -45,8 +45,10 @@ export function createGetUserAuthStatus() {
     'get-user-auth-status',
     getUserAuthStatusSchema,
     async (_data, ctx) => {
-      const { data: { user }, error } =
-        await ctx.supabaseAdmin.auth.admin.getUserById(ctx.uid);
+      const {
+        data: { user },
+        error,
+      } = await ctx.supabaseAdmin.auth.admin.getUserById(ctx.uid);
       if (error || !user) {
         throw new Error('User not found');
       }
@@ -59,6 +61,6 @@ export function createGetUserAuthStatus() {
         disabled: user.banned_until != null,
       };
     },
-    'user',
+    'user'
   );
 }

package/src/supabase/auth/removeCustomClaims.ts

@@ -20,7 +20,7 @@ import { createSupabaseHandler } from '../baseFunction.js';
 const removeCustomClaimsSchema = v.object({
   claimsToRemove: v.pipe(
     v.array(v.string()),
-    v.minLength(1, 'At least one claim key is required'),
+    v.minLength(1, 'At least one claim key is required')
   ),
 });
 
@@ -49,14 +49,19 @@ export function createRemoveCustomClaims() {
     removeCustomClaimsSchema,
     async (data, ctx) => {
       // Get current app_metadata
-      const { data: { user }, error: getUserError } =
-        await ctx.supabaseAdmin.auth.admin.getUserById(ctx.uid);
+      const {
+        data: { user },
+        error: getUserError,
+      } = await ctx.supabaseAdmin.auth.admin.getUserById(ctx.uid);
       if (getUserError || !user) {
         throw new Error('User not found');
       }
 
       // Remove specified keys
-      const existingClaims = { ...(user.app_metadata ?? {}) } as Record<string, unknown>;
+      const existingClaims = { ...(user.app_metadata ?? {}) } as Record<
+        string,
+        unknown
+      >;
       for (const key of data.claimsToRemove) {
         delete existingClaims[key];
       }
@@ -70,6 +75,6 @@ export function createRemoveCustomClaims() {
 
       return { success: true, customClaims: existingClaims };
     },
-    'user',
+    'user'
   );
 }

package/src/supabase/auth/setCustomClaims.ts

@@ -49,14 +49,19 @@ export function createSetCustomClaims() {
     setCustomClaimsSchema,
     async (data, ctx) => {
       // Get current app_metadata
-      const { data: { user }, error: getUserError } =
-        await ctx.supabaseAdmin.auth.admin.getUserById(ctx.uid);
+      const {
+        data: { user },
+        error: getUserError,
+      } = await ctx.supabaseAdmin.auth.admin.getUserById(ctx.uid);
       if (getUserError || !user) {
         throw new Error('User not found');
       }
 
       // Merge new claims with existing app_metadata
-      const existingClaims = (user.app_metadata ?? {}) as Record<string, unknown>;
+      const existingClaims = (user.app_metadata ?? {}) as Record<
+        string,
+        unknown
+      >;
       const updatedClaims = { ...existingClaims, ...data.customClaims };
 
       // Update app_metadata
@@ -68,6 +73,6 @@ export function createSetCustomClaims() {
 
       return { success: true, customClaims: updatedClaims };
     },
-    'user',
+    'user'
   );
 }

package/src/supabase/baseFunction.ts

@@ -103,7 +103,8 @@ export function createSupabaseHandler<TReq, TRes>(
           headers: {
             'Access-Control-Allow-Origin': allowedOrigin,
             'Access-Control-Allow-Methods': 'POST, OPTIONS',
-            'Access-Control-Allow-Headers': 'authorization, content-type, x-client-info, apikey',
+            'Access-Control-Allow-Headers':
+              'authorization, content-type, x-client-info, apikey',
           },
         });
       }
@@ -116,19 +117,32 @@ export function createSupabaseHandler<TReq, TRes>(
       // Extract and verify auth token
       const authHeader = req.headers.get('authorization');
       if (!authHeader?.startsWith('Bearer ')) {
-        return respond({ error: 'Missing or invalid authorization header' }, 401);
+        return respond(
+          { error: 'Missing or invalid authorization header' },
+          401
+        );
       }
       const token = authHeader.slice(7);
 
       // Create admin client
       const supabaseUrl = getEnvOrThrow('SUPABASE_URL');
-      const secretKey = getEnvOrThrow('SUPABASE_SECRET_KEY') || getEnvOrThrow('SUPABASE_SERVICE_ROLE_KEY'); // New: sb_secret_..., Legacy: service_role
+      // Try new env var first, fall back to legacy name
+      const secretKey =
+        getEnv('SUPABASE_SECRET_KEY') || getEnv('SUPABASE_SERVICE_ROLE_KEY');
+      if (!secretKey) {
+        throw new Error(
+          'Missing environment variable: SUPABASE_SECRET_KEY or SUPABASE_SERVICE_ROLE_KEY'
+        );
+      }
       const supabaseAdmin = createClient(supabaseUrl, secretKey, {
         auth: { autoRefreshToken: false, persistSession: false },
       });
 
       // Verify JWT and extract user
-      const { data: { user }, error: authError } = await supabaseAdmin.auth.getUser(token);
+      const {
+        data: { user },
+        error: authError,
+      } = await supabaseAdmin.auth.getUser(token);
       if (authError || !user) {
         return respond({ error: 'Invalid or expired token' }, 401);
       }
@@ -144,7 +158,9 @@ export function createSupabaseHandler<TReq, TRes>(
         // Non-guest access: verify user has required role level
         if (!hasRoleAccess(userRole, requiredRole)) {
           return respond(
-            { error: `Access denied. Required role: ${requiredRole}, your role: ${userRole}` },
+            {
+              error: `Access denied. Required role: ${requiredRole}, your role: ${userRole}`,
+            },
             403
           );
         }
@@ -160,8 +176,9 @@ export function createSupabaseHandler<TReq, TRes>(
             : `uid_${user.id}`;
         const rateLimitKey = `${operationName}_${rateLimitIdentifier}`;
         const rateLimitConfig: RateLimitConfig =
-          (DEFAULT_RATE_LIMITS as Record<string, RateLimitConfig>)[operationName] ||
-          DEFAULT_RATE_LIMITS.api;
+          (DEFAULT_RATE_LIMITS as Record<string, RateLimitConfig>)[
+            operationName
+          ] || DEFAULT_RATE_LIMITS.api;
 
         const rateLimitResult = await checkRateLimitWithPostgres(
           supabaseAdmin,
@@ -206,7 +223,10 @@ export function createSupabaseHandler<TReq, TRes>(
           supabaseAdmin,
         });
       } catch (handlerError) {
-        error = handlerError instanceof Error ? handlerError : new Error(String(handlerError));
+        error =
+          handlerError instanceof Error
+            ? handlerError
+            : new Error(String(handlerError));
         throw handlerError;
       } finally {
         // Record metrics if enabled
@@ -229,7 +249,8 @@ export function createSupabaseHandler<TReq, TRes>(
       return respond(result, 200);
     } catch (error) {
       console.error(`[${operationName}] Error:`, error);
-      const message = error instanceof Error ? error.message : 'Internal server error';
+      const message =
+        error instanceof Error ? error.message : 'Internal server error';
       const status = getErrorStatus(message);
       // allowedOrigin may not be set if error occurred before that line; fall back to '*'
       const origin = getEnv('ALLOWED_ORIGIN', '*');
@@ -242,7 +263,11 @@ export function createSupabaseHandler<TReq, TRes>(
 // Helpers
 // =============================================================================
 
-function jsonResponse(data: unknown, status: number, allowedOrigin = '*'): Response {
+function jsonResponse(
+  data: unknown,
+  status: number,
+  allowedOrigin = '*'
+): Response {
   return new Response(JSON.stringify(data), {
     status,
     headers: {
@@ -253,13 +278,19 @@ function jsonResponse(data: unknown, status: number, allowedOrigin = '*'): Respo
 }
 
 function getEnvOrThrow(key: string): string {
-  const value = (typeof Deno !== 'undefined' ? Deno.env.get(key) : process.env[key]) as string | undefined;
+  const value = (
+    typeof Deno !== 'undefined' ? Deno.env.get(key) : process.env[key]
+  ) as string | undefined;
   if (!value) throw new Error(`Missing environment variable: ${key}`);
   return value;
 }
 
 function getEnv(key: string, defaultValue: string = ''): string {
-  return (typeof Deno !== 'undefined' ? Deno.env.get(key) : process.env[key]) as string | undefined || defaultValue;
+  return (
+    ((typeof Deno !== 'undefined' ? Deno.env.get(key) : process.env[key]) as
+      | string
+      | undefined) || defaultValue
+  );
 }
 
 function getClientIp(req: Request): string {
@@ -269,7 +300,10 @@ function getClientIp(req: Request): string {
     // W19: Take the rightmost (last) IP — the leftmost entry is client-supplied
     // and trivially spoofable. The last entry is appended by the nearest trusted
     // reverse proxy and is the most reliable.
-    const ips = forwardedFor.split(',').map((ip) => ip.trim()).filter(Boolean);
+    const ips = forwardedFor
+      .split(',')
+      .map((ip) => ip.trim())
+      .filter(Boolean);
     const lastIp = ips[ips.length - 1];
     if (lastIp) return lastIp;
   }
@@ -283,20 +317,45 @@ function getClientIp(req: Request): string {
 
 function getErrorCode(message: string): string {
   if (message.includes('Rate limit')) return 'rate-limit-exceeded';
-  if (message.includes('not found') || message.includes('No active')) return 'not-found';
-  if (message.includes('permission') || message.includes('denied') || message.includes('Forbidden')) return 'permission-denied';
-  if (message.includes('mismatch') || message.includes('Invalid') || message.includes('Missing')) return 'invalid-argument';
-  if (message.includes('already-exists') || message.includes('Duplicate')) return 'already-exists';
+  if (message.includes('not found') || message.includes('No active'))
+    return 'not-found';
+  if (
+    message.includes('permission') ||
+    message.includes('denied') ||
+    message.includes('Forbidden')
+  )
+    return 'permission-denied';
+  if (
+    message.includes('mismatch') ||
+    message.includes('Invalid') ||
+    message.includes('Missing')
+  )
+    return 'invalid-argument';
+  if (message.includes('already-exists') || message.includes('Duplicate'))
+    return 'already-exists';
   return 'internal';
 }
 
 function getErrorStatus(message: string): number {
   if (message.includes('Rate limit')) return 429;
-  if (message.includes('not found') || message.includes('No active')) return 404;
-  if (message.includes('permission') || message.includes('denied') || message.includes('Forbidden')) return 403;
-  if (message.includes('mismatch') || message.includes('Invalid') || message.includes('Missing')) return 400;
+  if (message.includes('not found') || message.includes('No active'))
+    return 404;
+  if (
+    message.includes('permission') ||
+    message.includes('denied') ||
+    message.includes('Forbidden')
+  )
+    return 403;
+  if (
+    message.includes('mismatch') ||
+    message.includes('Invalid') ||
+    message.includes('Missing')
+  )
+    return 400;
   return 500;
 }
 
 // Deno global type declaration for env access
-declare const Deno: { env: { get(key: string): string | undefined } } | undefined;
+declare const Deno:
+  | { env: { get(key: string): string | undefined } }
+  | undefined;

package/src/supabase/billing/cancelSubscription.ts

@@ -44,14 +44,20 @@ export function createCancelSubscription() {
       initStripe(getStripeKey());
       const authProvider = createSupabaseAuthProvider(ctx.supabaseAdmin);
       return cancelUserSubscription(data.userId, authProvider);
-    },
+    }
   );
 }
 
 function getStripeKey(): string {
-  const key = (typeof Deno !== 'undefined' ? Deno.env.get('STRIPE_SECRET_KEY') : process.env.STRIPE_SECRET_KEY) as string | undefined;
+  const key = (
+    typeof Deno !== 'undefined'
+      ? Deno.env.get('STRIPE_SECRET_KEY')
+      : process.env.STRIPE_SECRET_KEY
+  ) as string | undefined;
   if (!key) throw new Error('Missing STRIPE_SECRET_KEY environment variable');
   return key;
 }
 
-declare const Deno: { env: { get(key: string): string | undefined } } | undefined;
+declare const Deno:
+  | { env: { get(key: string): string | undefined } }
+  | undefined;