@donotdev/functions 0.0.11 → 0.0.13

package/src/supabase/billing/changePlan.ts

@@ -25,7 +25,10 @@ import { createSupabaseAuthProvider } from '../helpers/authProvider.js';
 const changePlanSchema = v.object({
   userId: v.pipe(v.string(), v.minLength(1, 'User ID is required')),
   newPriceId: v.pipe(v.string(), v.minLength(1, 'Price ID is required')),
-  billingConfigKey: v.pipe(v.string(), v.minLength(1, 'Billing config key is required')),
+  billingConfigKey: v.pipe(
+    v.string(),
+    v.minLength(1, 'Billing config key is required')
+  ),
 });
 
 // =============================================================================
@@ -48,15 +51,27 @@ export function createChangePlan(billingConfig: StripeBackConfig) {
     async (data, ctx) => {
       initStripe(getStripeKey());
       const authProvider = createSupabaseAuthProvider(ctx.supabaseAdmin);
-      return changeUserPlan(data.userId, data.newPriceId, data.billingConfigKey, billingConfig, authProvider);
-    },
+      return changeUserPlan(
+        data.userId,
+        data.newPriceId,
+        data.billingConfigKey,
+        billingConfig,
+        authProvider
+      );
+    }
   );
 }
 
 function getStripeKey(): string {
-  const key = (typeof Deno !== 'undefined' ? Deno.env.get('STRIPE_SECRET_KEY') : process.env.STRIPE_SECRET_KEY) as string | undefined;
+  const key = (
+    typeof Deno !== 'undefined'
+      ? Deno.env.get('STRIPE_SECRET_KEY')
+      : process.env.STRIPE_SECRET_KEY
+  ) as string | undefined;
   if (!key) throw new Error('Missing STRIPE_SECRET_KEY environment variable');
   return key;
 }
 
-declare const Deno: { env: { get(key: string): string | undefined } } | undefined;
+declare const Deno:
+  | { env: { get(key: string): string | undefined } }
+  | undefined;

package/src/supabase/billing/createCheckoutSession.ts

@@ -13,7 +13,11 @@ import type { StripeBackConfig } from '@donotdev/core/server';
 import { CreateCheckoutSessionRequestSchema } from '@donotdev/core/server';
 
 import { createCheckoutAlgorithm } from '../../shared/billing/createCheckout.js';
-import { initStripe, stripe, validateStripeEnvironment } from '../../shared/utils.js';
+import {
+  initStripe,
+  stripe,
+  validateStripeEnvironment,
+} from '../../shared/utils.js';
 import { createSupabaseHandler } from '../baseFunction.js';
 import { createSupabaseAuthProvider } from '../helpers/authProvider.js';
 
@@ -68,15 +72,26 @@ export function createCheckoutSession(billingConfig: StripeBackConfig) {
         },
       };
 
-      return createCheckoutAlgorithm(data, stripeProvider, authProvider, billingConfig);
-    },
+      return createCheckoutAlgorithm(
+        data,
+        stripeProvider,
+        authProvider,
+        billingConfig
+      );
+    }
   );
 }
 
 function getStripeKey(): string {
-  const key = (typeof Deno !== 'undefined' ? Deno.env.get('STRIPE_SECRET_KEY') : process.env.STRIPE_SECRET_KEY) as string | undefined;
+  const key = (
+    typeof Deno !== 'undefined'
+      ? Deno.env.get('STRIPE_SECRET_KEY')
+      : process.env.STRIPE_SECRET_KEY
+  ) as string | undefined;
   if (!key) throw new Error('Missing STRIPE_SECRET_KEY environment variable');
   return key;
 }
 
-declare const Deno: { env: { get(key: string): string | undefined } } | undefined;
+declare const Deno:
+  | { env: { get(key: string): string | undefined } }
+  | undefined;

package/src/supabase/billing/createCustomerPortal.ts

@@ -44,15 +44,25 @@ export function createCustomerPortal() {
     async (data, ctx) => {
       initStripe(getStripeKey());
       const authProvider = createSupabaseAuthProvider(ctx.supabaseAdmin);
-      return createCustomerPortalSession(data.userId, authProvider, data.returnUrl);
-    },
+      return createCustomerPortalSession(
+        data.userId,
+        authProvider,
+        data.returnUrl
+      );
+    }
   );
 }
 
 function getStripeKey(): string {
-  const key = (typeof Deno !== 'undefined' ? Deno.env.get('STRIPE_SECRET_KEY') : process.env.STRIPE_SECRET_KEY) as string | undefined;
+  const key = (
+    typeof Deno !== 'undefined'
+      ? Deno.env.get('STRIPE_SECRET_KEY')
+      : process.env.STRIPE_SECRET_KEY
+  ) as string | undefined;
   if (!key) throw new Error('Missing STRIPE_SECRET_KEY environment variable');
   return key;
 }
 
-declare const Deno: { env: { get(key: string): string | undefined } } | undefined;
+declare const Deno:
+  | { env: { get(key: string): string | undefined } }
+  | undefined;

package/src/supabase/billing/refreshSubscriptionStatus.ts

@@ -12,7 +12,11 @@
 import Stripe from 'stripe';
 import * as v from 'valibot';
 
-import { initStripe, stripe, validateStripeEnvironment } from '../../shared/utils.js';
+import {
+  initStripe,
+  stripe,
+  validateStripeEnvironment,
+} from '../../shared/utils.js';
 import { createSupabaseHandler } from '../baseFunction.js';
 import { createSupabaseAuthProvider } from '../helpers/authProvider.js';
 
@@ -48,12 +52,16 @@ export function createRefreshSubscriptionStatus() {
       const user = await authProvider.getUser(data.userId);
       const currentClaims = user.customClaims || {};
 
-      const subscriptionId = (currentClaims.subscription as { subscriptionId?: string } | undefined)?.subscriptionId;
+      const subscriptionId = (
+        currentClaims.subscription as { subscriptionId?: string } | undefined
+      )?.subscriptionId;
       if (!subscriptionId) {
         throw new Error('No active subscription found');
       }
 
-      const subscription = await stripe.subscriptions.retrieve(subscriptionId) as Stripe.Subscription;
+      const subscription = (await stripe.subscriptions.retrieve(
+        subscriptionId
+      )) as Stripe.Subscription;
 
       // Update claims via auth provider
       const updatedClaims = {
@@ -61,8 +69,12 @@ export function createRefreshSubscriptionStatus() {
         subscription: {
           ...(currentClaims.subscription as Record<string, unknown>),
           status: subscription.status,
-          currentPeriodStart: new Date((subscription as any).current_period_start * 1000).toISOString(),
-          currentPeriodEnd: new Date((subscription as any).current_period_end * 1000).toISOString(),
+          currentPeriodStart: new Date(
+            (subscription as any).current_period_start * 1000
+          ).toISOString(),
+          currentPeriodEnd: new Date(
+            (subscription as any).current_period_end * 1000
+          ).toISOString(),
           cancelAtPeriodEnd: (subscription as any).cancel_at_period_end,
         },
       };
@@ -73,17 +85,25 @@ export function createRefreshSubscriptionStatus() {
         success: true,
         userId: data.userId,
         status: subscription.status,
-        currentPeriodEnd: new Date((subscription as any).current_period_end * 1000).toISOString(),
+        currentPeriodEnd: new Date(
+          (subscription as any).current_period_end * 1000
+        ).toISOString(),
         cancelAtPeriodEnd: (subscription as any).cancel_at_period_end,
       };
-    },
+    }
   );
 }
 
 function getStripeKey(): string {
-  const key = (typeof Deno !== 'undefined' ? Deno.env.get('STRIPE_SECRET_KEY') : process.env.STRIPE_SECRET_KEY) as string | undefined;
+  const key = (
+    typeof Deno !== 'undefined'
+      ? Deno.env.get('STRIPE_SECRET_KEY')
+      : process.env.STRIPE_SECRET_KEY
+  ) as string | undefined;
   if (!key) throw new Error('Missing STRIPE_SECRET_KEY environment variable');
   return key;
 }
 
-declare const Deno: { env: { get(key: string): string | undefined } } | undefined;
+declare const Deno:
+  | { env: { get(key: string): string | undefined } }
+  | undefined;

package/src/supabase/crud/aggregate.ts

@@ -92,11 +92,18 @@ export function createSupabaseAggregateEntities(
       let query = supabaseAdmin.from(collection);
 
       for (const [field, operator, value] of where) {
-        query = applyOperator(query, mapper.toBackendField(field), operator, value);
+        query = applyOperator(
+          query,
+          mapper.toBackendField(field),
+          operator,
+          value
+        );
       }
 
       if (groupBy && groupBy.length > 0) {
-        const groupByColumns = groupBy.map((f) => mapper.toBackendField(f)).join(', ');
+        const groupByColumns = groupBy
+          .map((f) => mapper.toBackendField(f))
+          .join(', ');
         const selectFields = `${groupByColumns}, ${aggregate.operation}(${aggregateColumn})`;
         query = query.select(selectFields);
         for (const field of groupBy) {
@@ -114,7 +121,10 @@ export function createSupabaseAggregateEntities(
       const { data: rows, error, count } = await query;
 
       if (error) {
-        throw new DoNotDevError(`Failed to aggregate entities: ${error.message}`, 'internal');
+        throw new DoNotDevError(
+          `Failed to aggregate entities: ${error.message}`,
+          'internal'
+        );
       }
 
       // Process results
@@ -133,7 +143,7 @@ export function createSupabaseAggregateEntities(
           return { value: count ?? 0 };
         } else {
           // Calculate aggregate from rows
-          const values = (rows || [] as any[])
+          const values = (rows || ([] as any[]))
             .map((row) => row[aggregateColumn])
             .filter((v) => v != null && !isNaN(Number(v)))
             .map((v) => Number(v));

package/src/supabase/crud/create.ts

@@ -19,10 +19,7 @@ import { defaultFieldMapper } from '@donotdev/supabase';
 import { createMetadata } from '../../shared/index.js';
 import { DoNotDevError, validateDocument } from '../../shared/utils.js';
 import { createSupabaseHandler } from '../baseFunction.js';
-import {
-  checkIdempotency,
-  storeIdempotency,
-} from '../utils/idempotency.js';
+import { checkIdempotency, storeIdempotency } from '../utils/idempotency.js';
 
 const mapper = defaultFieldMapper;
 
@@ -68,7 +65,10 @@ async function checkUniqueKeys(
   uniqueKeys: UniqueKeyDefinition[],
   isDraft: boolean,
   supabaseAdmin: any
-): Promise<{ found: false } | { found: true; existingDoc: Record<string, any>; findOrCreate: boolean }> {
+): Promise<
+  | { found: false }
+  | { found: true; existingDoc: Record<string, any>; findOrCreate: boolean }
+> {
   for (const uniqueKey of uniqueKeys) {
     // Skip validation for drafts only if explicitly opted in
     if (isDraft && uniqueKey.skipForDrafts === true) continue;
@@ -81,13 +81,19 @@ async function checkUniqueKeys(
 
     let query = supabaseAdmin.from(collection).select('*');
     for (const field of uniqueKey.fields) {
-      query = query.eq(mapper.toBackendField(field), normalizeValue(payload[field]));
+      query = query.eq(
+        mapper.toBackendField(field),
+        normalizeValue(payload[field])
+      );
     }
 
     const { data: existing, error } = await query.limit(1);
 
     if (!error && existing && existing.length > 0) {
-      const existingDoc = mapper.fromBackendRow(existing[0]) as Record<string, any>;
+      const existingDoc = mapper.fromBackendRow(existing[0]) as Record<
+        string,
+        any
+      >;
 
       if (uniqueKey.findOrCreate) {
         return { found: true, existingDoc, findOrCreate: true };
@@ -185,9 +191,17 @@ export function createSupabaseCreateEntity(
       }
 
       const metadata = createMetadata(uid);
-      const snakeMetadata = mapper.toBackendKeys(metadata as Record<string, unknown>);
+      const snakeMetadata = mapper.toBackendKeys(
+        metadata as Record<string, unknown>
+      );
 
-      const { createdAt, updatedAt, created_at, updated_at, ...payloadWithoutTimestamps } = normalizedPayload;
+      const {
+        createdAt,
+        updatedAt,
+        created_at,
+        updated_at,
+        ...payloadWithoutTimestamps
+      } = normalizedPayload;
       const snakePayload = mapper.toBackendKeys(payloadWithoutTimestamps);
 
       // Insert document (DB sets created_at/updated_at via triggers)
@@ -202,10 +216,15 @@ export function createSupabaseCreateEntity(
         .single();
 
       if (error) {
-        throw new DoNotDevError(`Failed to create entity: ${error.message}`, 'internal');
+        throw new DoNotDevError(
+          `Failed to create entity: ${error.message}`,
+          'internal'
+        );
       }
 
-      const result = mapper.fromBackendRow(inserted as Record<string, unknown>) as Record<string, any>;
+      const result = mapper.fromBackendRow(
+        inserted as Record<string, unknown>
+      ) as Record<string, any>;
 
       // Store result for idempotency if key provided
       if (idempotencyKey) {

package/src/supabase/crud/delete.ts

@@ -51,7 +51,11 @@ async function findReferences(
   docId: string,
   referenceMetadata?: ReferenceMetadata
 ): Promise<Array<{ collection: string; field: string; count: number }>> {
-  const references: Array<{ collection: string; field: string; count: number }> = [];
+  const references: Array<{
+    collection: string;
+    field: string;
+    count: number;
+  }> = [];
 
   if (!referenceMetadata) {
     return references;
@@ -120,7 +124,8 @@ export function createSupabaseDeleteEntity(
       // Prevent deletion if required references exist
       const requiredReferences = references.filter((ref) => {
         const metadata = referenceMetadata?.incoming?.find(
-          (r) => r.sourceCollection === ref.collection && r.sourceField === ref.field
+          (r) =>
+            r.sourceCollection === ref.collection && r.sourceField === ref.field
         );
         return metadata?.required === true;
       });
@@ -144,7 +149,10 @@ export function createSupabaseDeleteEntity(
         .eq('id', id);
 
       if (error) {
-        throw new DoNotDevError(`Failed to delete entity: ${error.message}`, 'internal');
+        throw new DoNotDevError(
+          `Failed to delete entity: ${error.message}`,
+          'internal'
+        );
       }
 
       return { success: true };

package/src/supabase/crud/get.ts

@@ -18,6 +18,12 @@ import {
 } from '@donotdev/core/server';
 import type { EntityOwnershipConfig, UserRole } from '@donotdev/core/server';
 
+import {
+  createEntityAwareMapper,
+  defaultFieldMapper,
+  getEntityFieldNames,
+} from '@donotdev/supabase';
+
 import { DoNotDevError } from '../../shared/utils.js';
 import { createSupabaseHandler } from '../baseFunction.js';
 
@@ -63,16 +69,32 @@ export function createSupabaseGetEntity(
       const isAdmin = hasRoleAccess(userRole, 'admin');
 
       // Hide drafts/deleted from non-admin users (security: hidden statuses never reach public)
-      if (!isAdmin && (HIDDEN_STATUSES as readonly string[]).includes(row.status)) {
+      if (
+        !isAdmin &&
+        (HIDDEN_STATUSES as readonly string[]).includes(row.status)
+      ) {
         throw new DoNotDevError('Entity not found', 'not-found');
       }
 
+      // Normalize DB row to entity field names before filtering.
+      const entityFieldNames = getEntityFieldNames(documentSchema);
+      const entityMapper =
+        entityFieldNames.length > 0
+          ? createEntityAwareMapper(entityFieldNames)
+          : defaultFieldMapper;
+      const normalized = entityMapper.fromBackendRow(row) as Record<
+        string,
+        any
+      >;
+
       const visibilityOptions =
-        ownership && uid ? { documentData: row, uid, ownership } : undefined;
+        ownership && uid
+          ? { documentData: normalized, uid, ownership }
+          : undefined;
 
       // Filter fields based on visibility and user role (and ownership for visibility: 'owner')
       const filteredData = filterVisibleFields(
-        row,
+        normalized,
         documentSchema,
         userRole,
         visibilityOptions

package/src/supabase/crud/list.ts

@@ -22,7 +22,11 @@ import type {
   UserRole,
 } from '@donotdev/core/server';
 
-import { defaultFieldMapper } from '@donotdev/supabase';
+import {
+  createEntityAwareMapper,
+  defaultFieldMapper,
+  getEntityFieldNames,
+} from '@donotdev/supabase';
 
 import { DoNotDevError } from '../../shared/utils.js';
 import { createSupabaseHandler } from '../baseFunction.js';
@@ -32,7 +36,9 @@ const mapper = defaultFieldMapper;
 
 /** Ensure we only pass strings to the mapper (entity listFields/ownership can be mis-typed at runtime). */
 function toBackendColumn(field: unknown): string {
-  return mapper.toBackendField(typeof field === 'string' ? field : String(field));
+  return mapper.toBackendField(
+    typeof field === 'string' ? field : String(field)
+  );
 }
 
 export interface ListEntityRequest {
@@ -58,7 +64,10 @@ function encodeCursor(id: string, orderBy: Record<string, any>): string {
 /**
  * Decode cursor for keyset pagination
  */
-function decodeCursor(cursor: string): { id: string; orderBy: Record<string, any> } {
+function decodeCursor(cursor: string): {
+  id: string;
+  orderBy: Record<string, any>;
+} {
   try {
     return JSON.parse(Buffer.from(cursor, 'base64').toString());
   } catch (error) {
@@ -132,7 +141,12 @@ export function createSupabaseListEntities(
   const requestSchema = v.object({
     where: v.optional(v.array(v.tuple([v.string(), v.any(), v.any()]))),
     orderBy: v.optional(
-      v.array(v.tuple([v.pipe(v.string(), v.minLength(1)), v.picklist(['asc', 'desc'])]))
+      v.array(
+        v.tuple([
+          v.pipe(v.string(), v.minLength(1)),
+          v.picklist(['asc', 'desc']),
+        ])
+      )
     ),
     limit: v.optional(v.pipe(v.number(), v.minValue(1))),
     startAfterId: v.optional(v.string()), // Offset-based (legacy)
@@ -149,18 +163,31 @@ export function createSupabaseListEntities(
     isListCard ? `listCard_${collection}` : `list_${collection}`,
     requestSchema,
     async (data: ListEntityRequest, ctx) => {
-      const { where = [], orderBy = [], limit = 50, startAfterId, startAfterCursor, search } = data;
+      const {
+        where = [],
+        orderBy = [],
+        limit = 50,
+        startAfterId,
+        startAfterCursor,
+        search,
+      } = data;
       const { userRole, uid, supabaseAdmin } = ctx;
 
       const isAdmin = hasRoleAccess(userRole, 'admin');
 
       // Build query - select fields (listFields + id + status, or *). Only use string entries (entity may be mis-typed).
-      const safeListFields = listFields?.filter((f): f is string => typeof f === 'string');
-      const selectFields = safeListFields && safeListFields.length > 0
-        ? safeListFields.map((f) => toBackendColumn(f)).join(', ') + ', id, status'
-        : '*';
-      
-      let query = supabaseAdmin.from(collection).select(selectFields, { count: 'exact' });
+      const safeListFields = listFields?.filter(
+        (f): f is string => typeof f === 'string'
+      );
+      const selectFields =
+        safeListFields && safeListFields.length > 0
+          ? safeListFields.map((f) => toBackendColumn(f)).join(', ') +
+            ', id, status'
+          : '*';
+
+      let query = supabaseAdmin
+        .from(collection)
+        .select(selectFields, { count: 'exact' });
 
       // Filter out hidden statuses for non-admin users
       if (!isAdmin) {
@@ -182,16 +209,57 @@ export function createSupabaseListEntities(
       }
 
       if (search) {
-        query = query.ilike(toBackendColumn(search.field), `%${search.query}%`);
+        // Validate search.field against entity schema (listFields as allowlist)
+        if (safeListFields && safeListFields.length > 0) {
+          if (!safeListFields.includes(search.field)) {
+            throw new DoNotDevError(
+              `Search field '${search.field}' is not allowed`,
+              'invalid-argument'
+            );
+          }
+        } else if (search.field.startsWith('_') || search.field.includes('.')) {
+          // No schema available — reject obviously unsafe field names
+          throw new DoNotDevError(
+            `Search field '${search.field}' is not allowed`,
+            'invalid-argument'
+          );
+        }
+        // Escape SQL ILIKE wildcards to prevent wildcard injection
+        const escapedQuery = search.query
+          .replace(/%/g, '\\%')
+          .replace(/_/g, '\\_');
+        query = query.ilike(toBackendColumn(search.field), `%${escapedQuery}%`);
       }
 
+      // Validate where clause fields against entity schema
       for (const [field, operator, value] of where) {
+        if (safeListFields && safeListFields.length > 0) {
+          if (
+            !safeListFields.includes(field) &&
+            field !== 'status' &&
+            field !== 'id'
+          ) {
+            throw new DoNotDevError(
+              `Where field '${field}' is not allowed`,
+              'invalid-argument'
+            );
+          }
+        } else if (field.startsWith('_') || field.includes('.')) {
+          throw new DoNotDevError(
+            `Where field '${field}' is not allowed`,
+            'invalid-argument'
+          );
+        }
         query = applyOperator(query, toBackendColumn(field), operator, value);
       }
 
-      const hasIdInOrderBy = orderBy.some(([field]) => toBackendColumn(field) === 'id');
+      const hasIdInOrderBy = orderBy.some(
+        ([field]) => toBackendColumn(field) === 'id'
+      );
       for (const [field, direction] of orderBy) {
-        query = query.order(toBackendColumn(field), { ascending: direction === 'asc' });
+        query = query.order(toBackendColumn(field), {
+          ascending: direction === 'asc',
+        });
       }
       // Add id as tiebreaker if not already in orderBy
       if (!hasIdInOrderBy && orderBy.length > 0) {
@@ -205,7 +273,7 @@ export function createSupabaseListEntities(
         useKeysetPagination = true;
         try {
           const cursor = decodeCursor(startAfterCursor);
-          
+
           if (orderBy.length === 0) {
             query = query.gt('id', cursor.id);
           } else {
@@ -240,12 +308,17 @@ export function createSupabaseListEntities(
       const { data: rows, error, count } = await query;
 
       if (error) {
-        throw new DoNotDevError(`Failed to list entities: ${error.message}`, 'internal');
+        throw new DoNotDevError(
+          `Failed to list entities: ${error.message}`,
+          'internal'
+        );
       }
 
       let items = (rows || []) as Record<string, any>[];
-      
-      // Filter out cursor item for keyset pagination
+
+      // Filter out cursor item for keyset pagination.
+      // Note: items are still raw DB rows here (pre-normalization), so mapper.toBackendField
+      // is correct for accessing backend column values. entityMapper is used later for normalization.
       if (useKeysetPagination && startAfterCursor && items.length > 0) {
         try {
           const cursor = decodeCursor(startAfterCursor);
@@ -289,11 +362,23 @@ export function createSupabaseListEntities(
         return value;
       };
 
-      const visibilityOptions = ownership && uid ? { uid, ownership } : undefined;
+      const visibilityOptions =
+        ownership && uid ? { uid, ownership } : undefined;
+
+      // Build entity-aware mapper from schema entries so fromBackendRow returns
+      // entity field names (not blind camelCase), matching filterVisibleFields expectations.
+      const entityFieldNames = getEntityFieldNames(documentSchema);
+      const entityMapper =
+        entityFieldNames.length > 0
+          ? createEntityAwareMapper(entityFieldNames)
+          : mapper;
 
       // Filter document fields based on visibility and user role
       const filteredItems = items.map((row) => {
-        const camelRow = mapper.fromBackendRow(row) as Record<string, any>;
+        const camelRow = entityMapper.fromBackendRow(row) as Record<
+          string,
+          any
+        >;
         const visibleData = filterVisibleFields(
           camelRow,
           documentSchema,
@@ -324,7 +409,7 @@ export function createSupabaseListEntities(
       });
 
       const hasMore = items.length === limit;
-      
+
       // Generate cursor for keyset pagination or offset for legacy
       let lastVisible: string | null = null;
       if (hasMore && filteredItems.length > 0) {