@exposify/supabase 0.3.7 → 0.3.9

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/index.ts
-import { createWebMcpHandler } from "@exposify/core";
+import { createBrokerGate, createWebMcpHandler, formatFailed as formatFailed2, publicRequestUrl, formatWarning as formatWarning2, hostedResolverFromEnv, isHostedResolver, readEnv, startupLogEnabled } from "@exposify/core";
 
 // src/kb.ts
 import { KnowledgeBase } from "@exposify/core";
@@ -74,13 +74,21 @@ function warnOnce(message) {
   } catch {
   }
 }
-function resolveSupabaseConfig(options = {}) {
+function resolveSupabaseConfig(options = {}, hostedBroker2 = false) {
+  if (options.oauth) {
+    if (options.docsAuth === "public") {
+      throw new Error('docsAuth: "public" cannot be combined with oauth (the whole MCP endpoint requires a token)');
+    }
+    if (options.auth || options.authRequired) {
+      throw new Error("oauth cannot be combined with auth/authRequired (oauth already requires a valid token on every request)");
+    }
+  }
   return {
     writes: parseWrites(options.writes),
     rpc: options.rpc ?? [],
     functions: options.functions ?? {},
     docs: options.docs ?? ["docs/**/*.md"],
-    docsAuth: options.docsAuth ?? "public",
+    docsAuth: options.docsAuth ?? (options.oauth || hostedBroker2 ? "required" : "public"),
     maxRows: options.maxRows ?? 100,
     rateLimit: options.rateLimit,
     rateWindowMs: options.rateWindowMs
@@ -605,24 +613,141 @@ async function toResult(run) {
   }
 }
 
+// src/oauth.ts
+import { createOAuthGate, resolveOAuthOptions } from "@exposify/core";
+var PRM_SUFFIX = "/.well-known/oauth-protected-resource";
+function supabaseAuth(overrides = {}) {
+  return (supabaseUrl) => {
+    const base = supabaseUrl.replace(/\/+$/, "");
+    return {
+      issuer: `${base}/auth/v1`,
+      jwksUri: `${base}/auth/v1/.well-known/jwks.json`,
+      audience: "authenticated",
+      ...overrides
+    };
+  };
+}
+function functionNameFromMainModule() {
+  const mainModule = globalThis.Deno?.mainModule;
+  if (!mainModule) return void 0;
+  try {
+    const parts = new URL(mainModule).pathname.split("/").filter(Boolean);
+    return parts.length >= 2 ? parts[parts.length - 2] : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function createSupabaseOAuthGate(oauth, supabaseUrl, fetchImpl) {
+  if (typeof oauth === "function" && !supabaseUrl) {
+    throw new Error("oauth: SUPABASE_URL is not set. In a deployed function this is automatic; for local dev pass { supabaseUrl }.");
+  }
+  const opts = typeof oauth === "function" ? oauth(supabaseUrl) : oauth;
+  let resource = opts.resource;
+  if (!resource) {
+    const name = functionNameFromMainModule();
+    if (!supabaseUrl || !name) {
+      throw new Error("oauth.resource could not be derived (needs SUPABASE_URL and Deno.mainModule); pass oauth.resource explicitly.");
+    }
+    resource = `${supabaseUrl.replace(/\/+$/, "")}/functions/v1/${name}`;
+  }
+  const { metadataUrl, ...oauthOptions } = opts;
+  const cfg = resolveOAuthOptions({ ...oauthOptions, resource });
+  if (metadataUrl !== void 0) {
+    try {
+      new URL(metadataUrl);
+    } catch {
+      throw new Error(`oauth.metadataUrl must be an absolute URL, got ${JSON.stringify(metadataUrl)}`);
+    }
+  }
+  return createOAuthGate(cfg, { metadataUrl: metadataUrl ?? `${cfg.resource}${PRM_SUFFIX}`, fetchImpl });
+}
+
+// src/startup.ts
+import { formatFailed, formatReady, formatWarning } from "@exposify/core";
+var LOG_PREFIX = "[exposify-supabase]";
+var INTROSPECTION_FIX = "check that SUPABASE_SERVICE_ROLE_KEY is available to the function and the exposify_meta migration is applied (`supabase db push`); the reason is logged above. To survive this, bundle a manifest with `exposify-supabase generate`";
+function supabaseToolsPhrase(ladder, cfg, hasDocs) {
+  const query = ladder.tables.length;
+  let write = 0;
+  for (const table of ladder.tables) write += cfg.writes.get(table.name)?.size ?? 0;
+  const rpc = cfg.rpc.length;
+  const fn = Object.keys(cfg.functions).length;
+  const parts = [`${query} query`];
+  if (write) parts.push(`${write} write`);
+  if (rpc) parts.push(`${rpc} rpc`);
+  if (fn) parts.push(`${fn} function${fn === 1 ? "" : "s"}`);
+  if (hasDocs) parts.push("search_docs");
+  const total = query + write + rpc + fn + (hasDocs ? 1 : 0);
+  return `${total} tool${total === 1 ? "" : "s"} (${parts.join(", ")})`;
+}
+function logColdStart(opts) {
+  const { ladder, cfg, docs, endpoint, auth, logReady } = opts;
+  if (ladder.mode === "functions-only") {
+    console.error(
+      formatFailed(
+        LOG_PREFIX,
+        "couldn't read the database schema and no bundled manifest exists, so only registered functions and docs are exposed",
+        INTROSPECTION_FIX
+      )
+    );
+    return;
+  }
+  if (logReady) {
+    const details = ladder.mode === "manifest" ? ["from the bundled manifest"] : [];
+    console.log(formatReady(LOG_PREFIX, { endpoint, tools: supabaseToolsPhrase(ladder, cfg, docs > 0), details, docs, auth }));
+  }
+  if (ladder.mode === "manifest") {
+    console.warn(
+      formatWarning(LOG_PREFIX, "live schema introspection failed; tools come from the bundled manifest and may be out of date", INTROSPECTION_FIX)
+    );
+  }
+}
+
 // src/index.ts
+import { completeMcpLogin, createHostedAuthResolver, hostedBroker } from "@exposify/core";
 function denoEnv() {
   return globalThis.Deno?.env;
 }
 function aiReady(options = {}) {
-  const cfg = resolveSupabaseConfig(options);
+  const brokerOn = isHostedResolver(options.auth) || !options.auth && !options.oauth && Boolean(readEnv("EXPOSIFY_KEY"));
+  const cfg = resolveSupabaseConfig(options, brokerOn);
   const fetchImpl = options.fetchImpl ?? fetch;
   const env = denoEnv();
   const supabaseUrl = options.supabaseUrl ?? env?.get("SUPABASE_URL");
   const anonKey = options.anonKey ?? env?.get("SUPABASE_ANON_KEY") ?? "";
   const serviceRoleKey = options.serviceRoleKey ?? env?.get("SUPABASE_SERVICE_ROLE_KEY") ?? "";
+  const gate = options.oauth ? createSupabaseOAuthGate(options.oauth, supabaseUrl, fetchImpl) : null;
+  const logReady = startupLogEnabled(options.startupLog);
+  const functionName = functionNameFromMainModule();
+  const endpoint = gate?.metadata.resource ?? (supabaseUrl && functionName ? `${supabaseUrl.replace(/\/+$/, "")}/functions/v1/${functionName}` : "this function");
+  const authLabel = gate ? `oauth (${String(gate.metadata.authorization_servers[0])})` : brokerOn ? "hosted broker (EXPOSIFY_KEY)" : options.auth ? "custom resolver" : "passthrough (caller's JWT)";
+  if (!supabaseUrl) {
+    console.error(
+      formatFailed2(LOG_PREFIX, "SUPABASE_URL is not set", "deployed functions get it automatically; for local dev pass { supabaseUrl }")
+    );
+  } else if (gate && logReady) {
+    void gate.probe().then((problem) => {
+      if (!problem) return;
+      console.warn(
+        formatWarning2(
+          LOG_PREFIX,
+          `can't verify access tokens from oauth.issuer ${String(gate.metadata.authorization_servers[0])}: ${problem}`,
+          "check the issuer (supabaseAuth() needs the project's OAuth server enabled and asymmetric JWT signing keys); until then MCP clients get 503"
+        )
+      );
+    });
+  }
+  let coldStartLogged = false;
   let kbPromise = null;
+  let docCount = 0;
   const getKb = () => {
     kbPromise ??= (async () => {
       const mainModule = globalThis.Deno?.mainModule;
       if (!mainModule) return KnowledgeBase.build([]);
       try {
-        return KnowledgeBase.build(await loadDocsFromDeno(cfg.docs, new URL(mainModule)));
+        const docs = await loadDocsFromDeno(cfg.docs, new URL(mainModule));
+        docCount = docs.length;
+        return KnowledgeBase.build(docs);
       } catch {
         return KnowledgeBase.build([]);
       }
@@ -657,6 +782,14 @@ function aiReady(options = {}) {
         const incoming = req.headers;
         const headers = buildPostgrestHeaders(resolvedAuth.get(req) ?? incoming, anonKey);
         const ladder = await getLadder(postgrestUrl);
+        const kb = await getKb();
+        if (!coldStartLogged) {
+          coldStartLogged = true;
+          try {
+            logColdStart({ ladder, cfg, docs: docCount, endpoint, auth: authLabel, logReady });
+          } catch {
+          }
+        }
         const client = createPostgrestClient(postgrestUrl, headers, fetchImpl);
         const invokeFunction = async (name, body) => {
           const res = await fetchImpl(`${supabaseUrl.replace(/\/+$/, "")}/functions/v1/${name}`, {
@@ -673,7 +806,7 @@ function aiReady(options = {}) {
           cfg,
           client,
           openapi: ladder.openapi,
-          kb: await getKb(),
+          kb,
           incoming,
           invokeFunction,
           warnings: ladder.warnings
@@ -682,17 +815,36 @@ function aiReady(options = {}) {
     },
     { rateLimit: cfg.rateLimit, rateWindowMs: cfg.rateWindowMs }
   );
-  const auth = options.auth;
+  if (gate) {
+    return async (req) => {
+      if (new URL(req.url).pathname.endsWith(PRM_SUFFIX)) return gate.metadataResponse(req.method);
+      const result = await gate.check(req.headers);
+      return result.ok ? core(req) : result.response;
+    };
+  }
+  const envAuth = options.auth || options.oauth ? void 0 : hostedResolverFromEnv();
+  const auth = options.auth ?? envAuth;
+  const authRequired = options.authRequired ?? (envAuth !== void 0 || isHostedResolver(auth));
   if (!auth) return core;
+  const brokerGate = authRequired ? createBrokerGate(auth) : null;
+  const functionUrl = supabaseUrl && functionName ? `${supabaseUrl.replace(/\/+$/, "")}/functions/v1/${functionName}` : null;
   return async (req) => {
+    if (brokerGate) {
+      const own = publicRequestUrl(req.url, req.headers);
+      const isPrm = own.endsWith(PRM_SUFFIX);
+      const resource = brokerGate.resourceFor(functionUrl ?? (isPrm ? own.slice(0, -PRM_SUFFIX.length) : own));
+      if (isPrm) return brokerGate.metadataResponse(req.method, resource);
+      const result = await brokerGate.check(req.headers, resource, `${resource}${PRM_SUFFIX}`);
+      if (!result.ok) return result.response;
+    }
     let resolved;
     try {
-      resolved = await auth(req.headers);
+      resolved = await auth(req.headers, {});
     } catch (err) {
       console.error("exposify-supabase: auth resolver failed", err);
       return Response.json({ error: "internal MCP server error" }, { status: 503 });
     }
-    if (options.authRequired && !resolved.get("authorization")) {
+    if (authRequired && !resolved.get("authorization")) {
       return Response.json({ error: "unauthorized" }, { status: 401, headers: { "www-authenticate": "Bearer" } });
     }
     resolvedAuth.set(req, resolved);
@@ -705,9 +857,13 @@ export {
   aiReady,
   buildManifest,
   columnsFromOpenApi,
+  completeMcpLogin,
+  createHostedAuthResolver,
   fetchExposifyMeta,
   fetchOpenApi,
+  hostedBroker,
   introspectTables,
   loadManifest,
-  rpcArgSchema
+  rpcArgSchema,
+  supabaseAuth
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/supabase",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -27,12 +27,13 @@
     "prepack": "yarn build"
   },
   "dependencies": {
-    "@exposify/core": "0.3.11",
+    "@exposify/core": "0.3.13",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "zod": "^3.24.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
+    "jose": "^6.1.3",
     "tsup": "^8.3.0",
     "typescript": "^5.6.0",
     "vitest": "^3.0.0"