@elevasis/core 0.1.0

package/src/supabase/helpers.ts

@@ -0,0 +1,20 @@
+import type { Database, Tables, TablesInsert, TablesUpdate } from './database.types'
+
+export type TableRow<T extends keyof Database['public']['Tables']> = Tables<T>
+export type TableInsert<T extends keyof Database['public']['Tables']> = TablesInsert<T>
+export type TableUpdate<T extends keyof Database['public']['Tables']> = TablesUpdate<T>
+
+export type SupabaseFunction<T extends keyof Database['public']['Functions']> = Database['public']['Functions'][T]
+
+/**
+ * Strip characters that have special meaning in PostgREST filter syntax.
+ * Use on user-supplied search strings before interpolating into `.or()` filter expressions.
+ *
+ * PostgREST uses `,` as the OR separator and `(` / `)` for logical grouping.
+ * The supabase-js `.or()` method passes strings as-is with no escaping.
+ */
+export function sanitizePostgrestValue(value: string): string {
+  return value.replace(/[,()]/g, '')
+}
+
+export type UpsertUserProfileResult = SupabaseFunction<'upsert_user_profile'>['Returns'][0]

package/src/supabase/index.ts

@@ -0,0 +1,52 @@
+import type { Database, Tables, TablesInsert, TablesUpdate } from './database.types'
+
+export type { Database, Tables, TablesInsert, TablesUpdate, Enums, CompositeTypes, Json } from './database.types'
+
+export { Constants } from './database.types'
+
+export type SupabaseClient = import('@supabase/supabase-js').SupabaseClient<Database>
+
+// Note: supabaseClient is a server-only export available via @repo/core/server
+// DO NOT export it from the main entry point to prevent browser bundling
+
+export type SupabaseUserProfile = Tables<'users'>
+export type SupabaseOrganization = Tables<'organizations'>
+export type SupabaseOrgMembership = Tables<'org_memberships'>
+export type SupabaseTaskSchedule = Tables<'task_schedules'>
+/** @deprecated Use SupabaseTaskSchedule instead. Alias for backward compatibility. */
+export type SupabaseScheduledTask = SupabaseTaskSchedule
+export type SupabaseCommandQueue = Tables<'command_queue'>
+export type SupabaseExecutionLogs = Tables<'execution_logs'>
+export type SupabaseApiKey = Tables<'api_keys'>
+/** API response type for API key list items (omits sensitive key_hash) */
+export type ApiKeyListItem = Omit<SupabaseApiKey, 'key_hash'>
+export type SupabaseOrganizationCredential = Tables<'credentials'>
+
+export type SupabaseUserProfileInsert = TablesInsert<'users'>
+export type SupabaseOrganizationInsert = TablesInsert<'organizations'>
+export type SupabaseTaskScheduleInsert = TablesInsert<'task_schedules'>
+/** @deprecated Use SupabaseTaskScheduleInsert instead. Alias for backward compatibility. */
+export type SupabaseScheduledTaskInsert = SupabaseTaskScheduleInsert
+export type SupabaseCommandQueueInsert = TablesInsert<'command_queue'>
+export type SupabaseApiKeyInsert = TablesInsert<'api_keys'>
+export type SupabaseExecutionLogsInsert = TablesInsert<'execution_logs'>
+export type SupabaseOrganizationCredentialInsert = TablesInsert<'credentials'>
+
+export type SupabaseUserProfileUpdate = TablesUpdate<'users'>
+export type SupabaseOrganizationUpdate = TablesUpdate<'organizations'>
+export type SupabaseTaskScheduleUpdate = TablesUpdate<'task_schedules'>
+/** @deprecated Use SupabaseTaskScheduleUpdate instead. Alias for backward compatibility. */
+export type SupabaseScheduledTaskUpdate = SupabaseTaskScheduleUpdate
+export type SupabaseCommandQueueUpdate = TablesUpdate<'command_queue'>
+export type SupabaseApiKeyUpdate = TablesUpdate<'api_keys'>
+export type SupabaseExecutionLogsUpdate = TablesUpdate<'execution_logs'>
+export type SupabaseOrganizationCredentialUpdate = TablesUpdate<'credentials'>
+
+// Export helper types and utilities
+export type { UpsertUserProfileResult } from './helpers'
+export { sanitizePostgrestValue } from './helpers'
+
+// Composite types for joined queries
+export type SupabaseMembershipWithOrganization = SupabaseOrgMembership & {
+  organization: SupabaseOrganization | null
+}

package/src/supabase/server/client.ts

@@ -0,0 +1,58 @@
+/**
+ * Centralized Supabase client
+ * Single source of truth for database connections across the monorepo
+ * Used by: apps/api, organizations/registry (agent/workflow definitions), packages/core (sessions)
+ */
+
+import type { SupabaseClient } from '@supabase/supabase-js'
+import type { Database } from '../database.types'
+
+let _supabaseClient: SupabaseClient<Database> | null = null
+
+/**
+ * Get Supabase service role client (lazy initialization)
+ * Bypasses RLS policies - use with caution, always enforce authorization in application logic
+ *
+ * @returns Authenticated Supabase client instance
+ * @throws Error if SUPABASE_URL or SUPABASE_SERVICE_KEY environment variables are missing
+ */
+export async function getSupabaseClient(): Promise<SupabaseClient<Database>> {
+  if (!_supabaseClient) {
+    const { createClient } = await import('@supabase/supabase-js')
+
+    const supabaseUrl = process.env.SUPABASE_URL
+    const supabaseServiceKey = process.env.SUPABASE_SERVICE_KEY
+
+    if (!supabaseUrl || !supabaseServiceKey) {
+      throw new Error('Missing Supabase environment variables: SUPABASE_URL and SUPABASE_SERVICE_KEY are required')
+    }
+
+    _supabaseClient = createClient<Database>(supabaseUrl, supabaseServiceKey, {
+      auth: {
+        autoRefreshToken: false,
+        persistSession: false
+      }
+    })
+  }
+
+  return _supabaseClient
+}
+
+/**
+ * Synchronous client getter (for backward compatibility)
+ * Returns cached client or throws if not initialized
+ *
+ * @deprecated Use getSupabaseClient() for new code
+ * @throws Error if client not initialized - call getSupabaseClient() first
+ */
+export const supabaseClient = new Proxy({} as SupabaseClient<Database>, {
+  get(_target, prop) {
+    if (!_supabaseClient) {
+      throw new Error(
+        'Supabase client not initialized. Call getSupabaseClient() first or use top-level await: ' +
+          'const client = await getSupabaseClient()'
+      )
+    }
+    return Reflect.get(_supabaseClient, prop)
+  }
+})

package/src/test-utils/README.md

@@ -0,0 +1,150 @@
+# Test Utilities
+
+Shared test utilities for Elevasis monorepo testing. Provides fixtures, mocks, and test helpers following DRY principles.
+
+## Structure
+
+```
+test-utils/
+├── fixtures/           # Test data using real Supabase types
+│   ├── users.ts       # User fixtures (SupabaseUserProfile)
+│   ├── organizations.ts
+│   ├── memberships.ts
+│   └── api-keys.ts
+├── mocks/             # Mock implementations
+│   ├── supabase.ts   # Supabase client mock
+│   └── workos.ts     # WorkOS JWT mock
+└── index.ts          # Re-exports all utilities
+```
+
+## Fixtures
+
+All fixtures use actual Supabase types from `@elevasis/core/supabase` for type safety.
+
+### User Fixtures
+
+```typescript
+import { TEST_USERS, createTestUser } from '@elevasis/core/test-utils'
+
+// Pre-defined users
+TEST_USERS.admin         // Platform admin user
+TEST_USERS.regularUser   // Regular user with membership
+TEST_USERS.inactiveUser  // Inactive user
+
+// Create custom user
+const customUser = createTestUser({
+  email: 'custom@example.com',
+  is_platform_admin: true
+})
+```
+
+### Organization Fixtures
+
+```typescript
+import { TEST_ORGS, createTestOrg } from '@elevasis/core/test-utils'
+
+TEST_ORGS.acme    // Acme Corp (active, test org)
+TEST_ORGS.beta    // Beta Inc (active, test org)
+TEST_ORGS.gamma   // Gamma LLC (active, test org)
+TEST_ORGS.inactive // Inactive Org
+```
+
+### Membership Fixtures
+
+```typescript
+import { TEST_MEMBERSHIPS, TEST_MEMBERSHIPS_WITH_ORG } from '@elevasis/core/test-utils'
+
+// Simple memberships
+TEST_MEMBERSHIPS.regularUserAcme  // regularUser admin in Acme
+TEST_MEMBERSHIPS.regularUserBeta  // regularUser member in Beta
+
+// Memberships with organization data (for joined queries)
+TEST_MEMBERSHIPS_WITH_ORG.regularUserAcme
+```
+
+### API Key Fixtures
+
+```typescript
+import { TEST_API_KEYS, TEST_API_KEY_PLAINTEXTS } from '@elevasis/core/test-utils'
+
+// API key records (with hashed keys)
+TEST_API_KEYS.acmeKey
+TEST_API_KEYS.betaKey
+
+// Plaintext keys for Authorization headers
+TEST_API_KEY_PLAINTEXTS.acmeKey  // 'sk_test_acme_12345'
+```
+
+## Mocks
+
+### Supabase Client Mock
+
+```typescript
+import { createMockSupabaseClient, TEST_USERS, TEST_ORGS } from '@elevasis/core/test-utils'
+import { vi } from 'vitest'
+
+// Create mock with test data
+const mockClient = createMockSupabaseClient({
+  users: [TEST_USERS.admin, TEST_USERS.regularUser],
+  organizations: [TEST_ORGS.acme, TEST_ORGS.beta]
+})
+
+// Use in tests
+vi.mock('../lib/supabase', () => ({ supabaseClient: mockClient }))
+
+// Query will work with mock data
+const { data } = await supabaseClient
+  .from('users')
+  .select('*')
+  .eq('email', 'admin@test.com')
+  .single()
+// data === TEST_USERS.admin
+```
+
+### WorkOS JWT Mock
+
+```typescript
+import { createMockVerifyJWT, mockExtractToken, TEST_USERS } from '@elevasis/core/test-utils'
+import { vi } from 'vitest'
+
+const mockVerifyJWT = createMockVerifyJWT({
+  'valid-token': {
+    workosId: TEST_USERS.admin.workos_user_id,
+    supabaseId: TEST_USERS.admin.id,
+    email: TEST_USERS.admin.email
+  }
+})
+
+vi.mock('../identity/auth/jwt-verifier', () => ({
+  verifyJWT: mockVerifyJWT,
+  extractToken: mockExtractToken
+}))
+
+// JWT verification will return mock user
+const user = await verifyJWT('valid-token')
+// user.email === 'admin@test.com'
+```
+
+## Usage in Apps
+
+Apps can import test utilities directly:
+
+```typescript
+// In apps/api/src/test-utils/index.ts
+export * from '@elevasis/core/test-utils'  // Re-export shared utilities
+export * from './fastify-test'         // Add app-specific utilities
+```
+
+## Type Safety
+
+All fixtures use actual Supabase types:
+- Changes to database schema automatically update test types
+- TypeScript compiler validates test data structure
+- Single source of truth for types
+
+## Design Principles
+
+- **DRY:** Shared fixtures in `@elevasis/core`, imported by apps
+- **Type Safety:** Use `SupabaseUserProfile`, `SupabaseOrganization`, etc.
+- **Realistic Data:** Fixtures match production schema and patterns
+- **Composable:** Combine fixtures, mocks, and helpers as needed

package/src/test-utils/browser-mocks.ts

@@ -0,0 +1,54 @@
+/**
+ * Browser Mocks for Testing
+ *
+ * Centralized browser API mocks for testing React components in jsdom environment.
+ * These mocks are required for Mantine components and other UI libraries.
+ *
+ * @note This file is only used in test environments with jsdom.
+ */
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+/**
+ * Mock window.matchMedia for testing
+ * Required for Mantine components that use media queries
+ */
+export function setupMatchMedia(): void {
+  const win = (globalThis as any).window
+  if (typeof win === 'undefined') return
+
+  Object.defineProperty(win, 'matchMedia', {
+    writable: true,
+    value: (query: string) => ({
+      matches: false,
+      media: query,
+      onchange: null,
+      addListener: () => {},
+      removeListener: () => {},
+      addEventListener: () => {},
+      removeEventListener: () => {},
+      dispatchEvent: () => true
+    })
+  })
+}
+
+/**
+ * Mock ResizeObserver for testing
+ * Required for Mantine components that observe element size changes
+ */
+export function setupResizeObserver(): void {
+  ;(globalThis as any).ResizeObserver = class ResizeObserver {
+    observe() {}
+    unobserve() {}
+    disconnect() {}
+  }
+}
+
+/**
+ * Setup all browser mocks at once
+ * Convenience function for test setup files
+ */
+export function setupBrowserMocks(): void {
+  setupMatchMedia()
+  setupResizeObserver()
+}

package/src/test-utils/fixtures/api-keys.ts

@@ -0,0 +1,52 @@
+import type { SupabaseApiKey } from '../../supabase'
+import { TEST_ORGS } from './organizations'
+
+/**
+ * Test API key fixtures using actual Supabase types
+ * Note: key_hash is bcrypt hash of the plaintext key shown in comments
+ */
+export const TEST_API_KEYS: Record<string, SupabaseApiKey> = {
+  acmeKey: {
+    id: '00000000-0000-0000-0000-000000000030',
+    organization_id: TEST_ORGS.acme.id,
+    name: 'Acme Production Key',
+    // Plaintext: sk_test_acme_12345
+    key_hash: '$2b$10$abcdefghijklmnopqrstuvwxyz1234567890ABCDEFGHIJKLMNOP',
+    created_at: '2025-01-01T00:00:00Z',
+    last_used_at: null
+  },
+  betaKey: {
+    id: '00000000-0000-0000-0000-000000000031',
+    organization_id: TEST_ORGS.beta.id,
+    name: 'Beta Development Key',
+    // Plaintext: sk_test_beta_67890
+    key_hash: '$2b$10$zyxwvutsrqponmlkjihgfedcba0987654321ZYXWVUTSRQPONMLKJIH',
+    created_at: '2025-01-01T00:00:00Z',
+    last_used_at: '2025-01-02T00:00:00Z'
+  }
+}
+
+/**
+ * Plaintext API keys for testing (matches hashes above conceptually)
+ * In real tests, use these for Authorization: Bearer headers
+ */
+export const TEST_API_KEY_PLAINTEXTS: Record<string, string> = {
+  acmeKey: 'sk_test_acme_12345',
+  betaKey: 'sk_test_beta_67890',
+  invalid: 'sk_test_invalid_99999'
+}
+
+/**
+ * Helper to create custom API key fixture
+ */
+export function createTestApiKey(overrides: Partial<SupabaseApiKey>): SupabaseApiKey {
+  return {
+    id: '00000000-0000-0000-0000-999999999999',
+    organization_id: TEST_ORGS.acme.id,
+    name: 'Custom Test Key',
+    key_hash: '$2b$10$customhashvalue1234567890',
+    created_at: '2025-01-01T00:00:00Z',
+    last_used_at: null,
+    ...overrides
+  }
+}

package/src/test-utils/fixtures/index.ts

@@ -0,0 +1,4 @@
+export * from './users'
+export * from './organizations'
+export * from './memberships'
+export * from './api-keys'

package/src/test-utils/fixtures/memberships.ts

@@ -0,0 +1,80 @@
+import type { SupabaseOrgMembership, SupabaseMembershipWithOrganization } from '../../supabase'
+import { TEST_USERS } from './users'
+import { TEST_ORGS } from './organizations'
+
+/**
+ * Test membership fixtures using actual Supabase types
+ */
+export const TEST_MEMBERSHIPS: Record<string, SupabaseOrgMembership> = {
+  regularUserAcme: {
+    id: '00000000-0000-0000-0000-000000000020',
+    user_id: TEST_USERS.regularUser.id,
+    organization_id: TEST_ORGS.acme.id,
+    workos_membership_id: 'mem_regular_acme',
+    role_slug: 'admin',
+    membership_status: 'active',
+    config: {},
+    created_at: '2025-01-01T00:00:00Z',
+    updated_at: '2025-01-01T00:00:00Z'
+  },
+  regularUserBeta: {
+    id: '00000000-0000-0000-0000-000000000021',
+    user_id: TEST_USERS.regularUser.id,
+    organization_id: TEST_ORGS.beta.id,
+    workos_membership_id: 'mem_regular_beta',
+    role_slug: 'member',
+    membership_status: 'active',
+    config: {},
+    created_at: '2025-01-01T00:00:00Z',
+    updated_at: '2025-01-01T00:00:00Z'
+  },
+  inactiveUserAcme: {
+    id: '00000000-0000-0000-0000-000000000022',
+    user_id: TEST_USERS.inactiveUser.id,
+    organization_id: TEST_ORGS.acme.id,
+    workos_membership_id: 'mem_inactive_acme',
+    role_slug: 'member',
+    membership_status: 'inactive',
+    config: {},
+    created_at: '2025-01-01T00:00:00Z',
+    updated_at: '2025-01-01T00:00:00Z'
+  }
+}
+
+/**
+ * Composite memberships with organization data (for joined queries)
+ */
+export const TEST_MEMBERSHIPS_WITH_ORG: Record<string, SupabaseMembershipWithOrganization> = {
+  regularUserAcme: {
+    ...TEST_MEMBERSHIPS.regularUserAcme,
+    organization: TEST_ORGS.acme
+  },
+  regularUserBeta: {
+    ...TEST_MEMBERSHIPS.regularUserBeta,
+    organization: TEST_ORGS.beta
+  },
+  inactiveUserAcme: {
+    ...TEST_MEMBERSHIPS.inactiveUserAcme,
+    organization: TEST_ORGS.acme
+  }
+}
+
+/**
+ * Helper to create custom membership fixture
+ */
+export function createTestMembership(
+  overrides: Partial<SupabaseOrgMembership>
+): SupabaseOrgMembership {
+  return {
+    id: '00000000-0000-0000-0000-999999999999',
+    user_id: TEST_USERS.regularUser.id,
+    organization_id: TEST_ORGS.acme.id,
+    workos_membership_id: 'mem_custom_test',
+    role_slug: 'member',
+    membership_status: 'active',
+    config: {},
+    created_at: '2025-01-01T00:00:00Z',
+    updated_at: '2025-01-01T00:00:00Z',
+    ...overrides
+  }
+}

package/src/test-utils/fixtures/organizations.ts

@@ -0,0 +1,69 @@
+import type { SupabaseOrganization } from '../../supabase'
+
+/**
+ * Test organization fixtures using actual Supabase types
+ */
+export const TEST_ORGS: Record<string, SupabaseOrganization> = {
+  acme: {
+    id: '00000000-0000-0000-0000-000000000010',
+    workos_org_id: 'org_acme_test',
+    name: 'Acme Corp',
+    status: 'active',
+    is_test: true,
+    metadata: {},
+    config: {},
+    created_at: '2025-01-01T00:00:00Z',
+    updated_at: '2025-01-01T00:00:00Z'
+  },
+  beta: {
+    id: '00000000-0000-0000-0000-000000000011',
+    workos_org_id: 'org_beta_test',
+    name: 'Beta Inc',
+    status: 'active',
+    is_test: true,
+    metadata: {},
+    config: {},
+    created_at: '2025-01-01T00:00:00Z',
+    updated_at: '2025-01-01T00:00:00Z'
+  },
+  gamma: {
+    id: '00000000-0000-0000-0000-000000000012',
+    workos_org_id: 'org_gamma_test',
+    name: 'Gamma LLC',
+    status: 'active',
+    is_test: true,
+    metadata: {},
+    config: {},
+    created_at: '2025-01-01T00:00:00Z',
+    updated_at: '2025-01-01T00:00:00Z'
+  },
+  inactive: {
+    id: '00000000-0000-0000-0000-000000000013',
+    workos_org_id: 'org_inactive_test',
+    name: 'Inactive Org',
+    status: 'inactive',
+    is_test: true,
+    metadata: {},
+    config: {},
+    created_at: '2025-01-01T00:00:00Z',
+    updated_at: '2025-01-01T00:00:00Z'
+  }
+}
+
+/**
+ * Helper to create custom organization fixture
+ */
+export function createTestOrg(overrides: Partial<SupabaseOrganization>): SupabaseOrganization {
+  return {
+    id: '00000000-0000-0000-0000-999999999999',
+    workos_org_id: 'org_custom_test',
+    name: 'Custom Org',
+    status: 'active',
+    is_test: true,
+    metadata: {},
+    config: {},
+    created_at: '2025-01-01T00:00:00Z',
+    updated_at: '2025-01-01T00:00:00Z',
+    ...overrides
+  }
+}

package/src/test-utils/fixtures/users.ts

@@ -0,0 +1,79 @@
+import type { SupabaseUserProfile } from '../../supabase'
+
+/**
+ * Test user fixtures using actual Supabase types
+ * All timestamps use ISO 8601 format matching Supabase defaults
+ */
+export const TEST_USERS: Record<string, SupabaseUserProfile> = {
+  admin: {
+    id: '00000000-0000-0000-0000-000000000001',
+    workos_user_id: 'user_admin_test',
+    email: 'admin@test.com',
+    first_name: 'Admin',
+    last_name: 'User',
+    display_name: 'Admin User',
+    is_platform_admin: true,
+    is_active: true,
+    profile_picture_url: null,
+    last_login_at: null,
+    last_visited_org: null,
+    config: {},
+    created_at: '2025-01-01T00:00:00Z',
+    updated_at: '2025-01-01T00:00:00Z'
+  },
+  regularUser: {
+    id: '00000000-0000-0000-0000-000000000002',
+    workos_user_id: 'user_regular_test',
+    email: 'user@test.com',
+    first_name: 'Regular',
+    last_name: 'User',
+    display_name: 'Regular User',
+    is_platform_admin: false,
+    is_active: true,
+    profile_picture_url: null,
+    last_login_at: null,
+    last_visited_org: null,
+    config: {},
+    created_at: '2025-01-01T00:00:00Z',
+    updated_at: '2025-01-01T00:00:00Z'
+  },
+  inactiveUser: {
+    id: '00000000-0000-0000-0000-000000000003',
+    workos_user_id: 'user_inactive_test',
+    email: 'inactive@test.com',
+    first_name: 'Inactive',
+    last_name: 'User',
+    display_name: 'Inactive User',
+    is_platform_admin: false,
+    is_active: false,
+    profile_picture_url: null,
+    last_login_at: null,
+    last_visited_org: null,
+    config: {},
+    created_at: '2025-01-01T00:00:00Z',
+    updated_at: '2025-01-01T00:00:00Z'
+  }
+}
+
+/**
+ * Helper to create custom user fixture
+ */
+export function createTestUser(overrides: Partial<SupabaseUserProfile>): SupabaseUserProfile {
+  return {
+    id: '00000000-0000-0000-0000-999999999999',
+    workos_user_id: 'user_custom_test',
+    email: 'custom@test.com',
+    first_name: 'Custom',
+    last_name: 'User',
+    display_name: 'Custom User',
+    is_platform_admin: false,
+    is_active: true,
+    profile_picture_url: null,
+    last_login_at: null,
+    last_visited_org: null,
+    config: {},
+    created_at: '2025-01-01T00:00:00Z',
+    updated_at: '2025-01-01T00:00:00Z',
+    ...overrides
+  }
+}

package/src/test-utils/index.ts

@@ -0,0 +1,11 @@
+// Fixtures
+export * from './fixtures'
+
+// Mocks
+export * from './mocks'
+
+// RLS Testing
+export * from './rls'
+
+// Browser Mocks (for React/UI testing)
+export * from './browser-mocks'

package/src/test-utils/mocks/index.ts

@@ -0,0 +1,2 @@
+export * from './supabase'
+export * from './workos'