@everystack/auth 0.4.0 → 0.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/auth",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "JWT authentication handlers, password hashing, and React auth context",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -91,7 +91,7 @@
   },
   "dependencies": {
     "bcryptjs": "3.0.3",
-    "@everystack/model": "0.4.0"
+    "@everystack/model": "0.4.11"
   },
   "peerDependencies": {
     "@everystack/api": ">=0.1.0",
@@ -120,7 +120,7 @@
     "postgres": "3.4.9",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
-    "@everystack/api": "0.2.10"
+    "@everystack/api": "0.4.0"
   },
   "scripts": {
     "test": "jest",

package/src/sql.ts

@@ -37,7 +37,8 @@ AS $$
 BEGIN
   RETURN crypt(p_password, gen_salt('bf', 10));
 END;
-$$;`;
+$$;
+REVOKE EXECUTE ON FUNCTION auth.hash_password FROM PUBLIC;`;
 
 const VERIFY_PASSWORD = `\
 CREATE OR REPLACE FUNCTION auth.verify_password(p_password TEXT, p_hash TEXT)
@@ -54,7 +55,8 @@ BEGIN
   v_normalized := regexp_replace(p_hash, '^\\$2[by]\\$', '$2a$');
   RETURN crypt(p_password, v_normalized) = v_normalized;
 END;
-$$;`;
+$$;
+REVOKE EXECUTE ON FUNCTION auth.verify_password FROM PUBLIC;`;
 
 const SIGN_JWT = `\
 CREATE OR REPLACE FUNCTION auth.sign_jwt(p_payload JSONB)
@@ -98,7 +100,8 @@ BEGIN
 
   RETURN v_signing_input || '.' || v_signature;
 END;
-$$;`;
+$$;
+REVOKE EXECUTE ON FUNCTION auth.sign_jwt FROM PUBLIC;`;
 
 const VERIFY_JWT = `\
 CREATE OR REPLACE FUNCTION auth.verify_jwt(p_token TEXT)
@@ -156,7 +159,8 @@ BEGIN
 
   RETURN v_payload_json;
 END;
-$$;`;
+$$;
+REVOKE EXECUTE ON FUNCTION auth.verify_jwt FROM PUBLIC;`;
 
 // =============================================================================
 // REFRESH TOKEN FUNCTIONS (RFC 6819)
@@ -391,6 +395,11 @@ REVOKE EXECUTE ON FUNCTION auth.cleanup_refresh_tokens FROM PUBLIC;`;
 // SUPABASE-COMPATIBLE ACCESSOR FUNCTIONS
 // =============================================================================
 
+// The three accessors are SECURITY INVOKER and are called FROM RLS POLICY EXPRESSIONS, which
+// evaluate as the querying role. So PUBLIC comes off — no blanket grant — and the everystack
+// role chain is granted back explicitly. A bare `REVOKE ... FROM PUBLIC` with no grant-back
+// would break every policy that calls them, which is exactly why they must not be lumped in
+// with the internal SECDEF helpers below.
 const AUTH_UID = `\
 CREATE OR REPLACE FUNCTION auth.uid()
 RETURNS uuid
@@ -400,7 +409,9 @@ AS $$
     (nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'sub')::uuid,
     NULL
   );
-$$;`;
+$$;
+REVOKE EXECUTE ON FUNCTION auth.uid FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION auth.uid() TO anon, authenticated, admin;`;
 
 const AUTH_ROLE = `\
 CREATE OR REPLACE FUNCTION auth.role()
@@ -411,7 +422,9 @@ AS $$
     nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'role',
     'anon'
   );
-$$;`;
+$$;
+REVOKE EXECUTE ON FUNCTION auth.role FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION auth.role() TO anon, authenticated, admin;`;
 
 const AUTH_JWT = `\
 CREATE OR REPLACE FUNCTION auth.jwt()
@@ -422,7 +435,9 @@ AS $$
     nullif(current_setting('request.jwt.claims', true), '')::jsonb,
     '{}'::jsonb
   );
-$$;`;
+$$;
+REVOKE EXECUTE ON FUNCTION auth.jwt FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION auth.jwt() TO anon, authenticated, admin;`;
 
 // =============================================================================
 // ONE-TIME TOKEN FUNCTIONS