@exposify/supabase 0.3.4 → 0.3.5

package/README.md

@@ -227,6 +227,47 @@ Ask the agent to query or mutate data. **It should succeed for that user's
 own rows and be refused everyone else's** — that's the definition of done:
 RLS enforcement, not anything in this SDK, is what makes that true.
 
+## Long-lived tokens for clients that can't refresh (token broker)
+
+Supabase user JWTs expire (default 1h) and their refresh tokens rotate; a plain
+MCP client can hold a bearer token but can't refresh it. Pass an `auth`
+resolver (any `(incoming: Headers) => Headers | Promise<Headers>`, such as
+`broker.resolver` from [`@exposify/token-broker`](../token-broker/README.md))
+and the client sends a long-lived broker token instead:
+
+```ts
+// supabase/functions/mcp/index.ts
+import { aiReady } from "npm:@exposify/supabase";
+import { broker } from "./broker.ts"; // createTokenBroker(...) over a shared store
+
+Deno.serve(aiReady({ auth: broker.resolver, authRequired: true, writes: ["todos.*"] }));
+```
+
+- The resolver receives the request's original headers (the `extb_...` token)
+  and its result **replaces** them for PostgREST and `functions` calls, so RLS
+  applies as that user and the broker token is never forwarded. `apikey` and a
+  missing `authorization` still fall back to the anon key.
+- `docsAuth: "required"` checks the raw incoming headers, so a broker token
+  counts as authenticated.
+- A broker resolver returns empty headers for an unknown/revoked token or a
+  failed refresh. By default the request then runs as the `anon` role (RLS
+  decides). Set `authRequired: true` to answer `401` instead. Recommended.
+- A resolver that throws yields a 503.
+
+**Deployment constraints** (not verified end to end, see HANDOVER):
+
+- The broker's OAuth server (`listenTokenBroker`) is a Node HTTP server and
+  can't run in an Edge Function; run it as a separate service.
+- The edge function builds its own `createTokenBroker(...)` over the **same
+  persistent `TokenStore`** (Redis/Postgres, see the token-broker README's
+  `ioredis` example) and the same `TOKEN_BROKER_ENCRYPTION_KEY`. The in-memory
+  store is per-process and won't work.
+- The broker service does proactive refresh; short-lived edge instances rely on
+  the resolver's lazy refresh when `expiresAt` has passed.
+- `@exposify/token-broker` imports `node:crypto` (`scryptSync`, AES-256-GCM,
+  RS256). Whether that works under Supabase's Deno runtime has **not** been
+  tested; try `supabase functions serve` before depending on it.
+
 ## Knowledge base
 
 Any markdown files matching the `docs` glob (default `docs/**/*.md`,

package/dist/index.cjs

@@ -674,7 +674,8 @@ function aiReady(options = {}) {
     });
     return ladderPromise;
   };
-  return (0, import_core3.createWebMcpHandler)(
+  const resolvedAuth = /* @__PURE__ */ new WeakMap();
+  const core = (0, import_core3.createWebMcpHandler)(
     {
       getServer: async (req) => {
         if (!supabaseUrl) {
@@ -684,7 +685,7 @@ function aiReady(options = {}) {
         }
         const postgrestUrl = `${supabaseUrl.replace(/\/+$/, "")}/rest/v1`;
         const incoming = req.headers;
-        const headers = buildPostgrestHeaders(incoming, anonKey);
+        const headers = buildPostgrestHeaders(resolvedAuth.get(req) ?? incoming, anonKey);
         const ladder = await getLadder(postgrestUrl);
         const client = createPostgrestClient(postgrestUrl, headers, fetchImpl);
         const invokeFunction = async (name, body) => {
@@ -711,6 +712,22 @@ function aiReady(options = {}) {
     },
     { rateLimit: cfg.rateLimit, rateWindowMs: cfg.rateWindowMs }
   );
+  const auth = options.auth;
+  if (!auth) return core;
+  return async (req) => {
+    let resolved;
+    try {
+      resolved = await auth(req.headers);
+    } catch (err) {
+      console.error("exposify-supabase: auth resolver failed", err);
+      return Response.json({ error: "internal MCP server error" }, { status: 503 });
+    }
+    if (options.authRequired && !resolved.get("authorization")) {
+      return Response.json({ error: "unauthorized" }, { status: 401, headers: { "www-authenticate": "Bearer" } });
+    }
+    resolvedAuth.set(req, resolved);
+    return core(req);
+  };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { WebMcpHandler } from '@exposify/core';
+import { AuthResolver, WebMcpHandler } from '@exposify/core';
 
 type ColumnType = "string" | "number" | "integer" | "boolean" | "object" | "array";
 interface ColumnSchema {
@@ -72,6 +72,22 @@ interface AgentifySupabaseOptions {
      * deployed edge function; this option exists for local dev/testing only.
      */
     serviceRoleKey?: string;
+    /**
+     * Resolves the caller's incoming headers into the headers used for
+     * PostgREST and edge-function calls, e.g. `broker.resolver` from
+     * `@exposify/token-broker` to swap a long-lived `extb_...` token for a live
+     * Supabase JWT. Only `authorization`/`apikey` from the result are used; a
+     * missing `authorization` falls back to the anon key (unless
+     * `authRequired`). Absent: the caller's own `authorization`/`apikey` are
+     * forwarded as-is.
+     */
+    auth?: AuthResolver;
+    /**
+     * With `auth` set: respond 401 when the resolver returns no `authorization`
+     * (unknown/revoked broker token, failed refresh) instead of silently
+     * running the request as the `anon` role. Default false.
+     */
+    authRequired?: boolean;
     /** Injectable for tests; defaults to global `fetch`. */
     fetchImpl?: typeof fetch;
     /** Bundled fallback manifest (from `exposify-supabase generate`), used when runtime introspection fails. */

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { WebMcpHandler } from '@exposify/core';
+import { AuthResolver, WebMcpHandler } from '@exposify/core';
 
 type ColumnType = "string" | "number" | "integer" | "boolean" | "object" | "array";
 interface ColumnSchema {
@@ -72,6 +72,22 @@ interface AgentifySupabaseOptions {
      * deployed edge function; this option exists for local dev/testing only.
      */
     serviceRoleKey?: string;
+    /**
+     * Resolves the caller's incoming headers into the headers used for
+     * PostgREST and edge-function calls, e.g. `broker.resolver` from
+     * `@exposify/token-broker` to swap a long-lived `extb_...` token for a live
+     * Supabase JWT. Only `authorization`/`apikey` from the result are used; a
+     * missing `authorization` falls back to the anon key (unless
+     * `authRequired`). Absent: the caller's own `authorization`/`apikey` are
+     * forwarded as-is.
+     */
+    auth?: AuthResolver;
+    /**
+     * With `auth` set: respond 401 when the resolver returns no `authorization`
+     * (unknown/revoked broker token, failed refresh) instead of silently
+     * running the request as the `anon` role. Default false.
+     */
+    authRequired?: boolean;
     /** Injectable for tests; defaults to global `fetch`. */
     fetchImpl?: typeof fetch;
     /** Bundled fallback manifest (from `exposify-supabase generate`), used when runtime introspection fails. */

package/dist/index.js

@@ -644,7 +644,8 @@ function aiReady(options = {}) {
     });
     return ladderPromise;
   };
-  return createWebMcpHandler(
+  const resolvedAuth = /* @__PURE__ */ new WeakMap();
+  const core = createWebMcpHandler(
     {
       getServer: async (req) => {
         if (!supabaseUrl) {
@@ -654,7 +655,7 @@ function aiReady(options = {}) {
         }
         const postgrestUrl = `${supabaseUrl.replace(/\/+$/, "")}/rest/v1`;
         const incoming = req.headers;
-        const headers = buildPostgrestHeaders(incoming, anonKey);
+        const headers = buildPostgrestHeaders(resolvedAuth.get(req) ?? incoming, anonKey);
         const ladder = await getLadder(postgrestUrl);
         const client = createPostgrestClient(postgrestUrl, headers, fetchImpl);
         const invokeFunction = async (name, body) => {
@@ -681,6 +682,22 @@ function aiReady(options = {}) {
     },
     { rateLimit: cfg.rateLimit, rateWindowMs: cfg.rateWindowMs }
   );
+  const auth = options.auth;
+  if (!auth) return core;
+  return async (req) => {
+    let resolved;
+    try {
+      resolved = await auth(req.headers);
+    } catch (err) {
+      console.error("exposify-supabase: auth resolver failed", err);
+      return Response.json({ error: "internal MCP server error" }, { status: 503 });
+    }
+    if (options.authRequired && !resolved.get("authorization")) {
+      return Response.json({ error: "unauthorized" }, { status: 401, headers: { "www-authenticate": "Bearer" } });
+    }
+    resolvedAuth.set(req, resolved);
+    return core(req);
+  };
 }
 export {
   MANIFEST_VERSION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/supabase",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -27,7 +27,7 @@
     "prepack": "yarn build"
   },
   "dependencies": {
-    "@exposify/core": "0.3.8",
+    "@exposify/core": "0.3.9",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "zod": "^3.24.0"
   },