@exposify/supabase 0.3.9 → 0.3.10

package/README.md

@@ -190,6 +190,12 @@ things:
    `init` never sees the key, so you set that secret yourself.
    Until you do, every request gets a 401.
 
+Until the project has a sign-in method (the Supabase preset in the
+dashboard), agents use the function signed out, as `anon`, with no sign-in
+asked: there's nothing to sign in with. The log says which it is
+(`[agentready] How agents sign in: ...`), and adding the method takes effect
+within a minute.
+
 MCP clients then click Connect and sign in through the broker (or send a
 pasted `Authorization: Bearer extb_...`). Don't give the client the JWT that
 `POST /resolve` returns. It's the short-lived Supabase token the function

package/dist/index.cjs

@@ -863,13 +863,19 @@ function aiReady(options = {}) {
   const brokerGate = authRequired ? (0, import_core5.createBrokerGate)(auth) : null;
   const functionUrl = supabaseUrl && functionName ? `${supabaseUrl.replace(/\/+$/, "")}/functions/v1/${functionName}` : null;
   return async (req) => {
+    let open = false;
     if (brokerGate) {
       const own = (0, import_core5.publicRequestUrl)(req.url, req.headers);
       const isPrm = own.endsWith(PRM_SUFFIX);
       const resource = brokerGate.resourceFor(functionUrl ?? (isPrm ? own.slice(0, -PRM_SUFFIX.length) : own));
-      if (isPrm) return brokerGate.metadataResponse(req.method, resource);
-      const result = await brokerGate.check(req.headers, resource, `${resource}${PRM_SUFFIX}`);
-      if (!result.ok) return result.response;
+      open = await (0, import_core5.reportAppLogin)(auth, resource, null, { stacks: ["@supabase/supabase-js"], why: "Supabase Auth sign-in for agents is the Supabase preset in the dashboard's sign-in methods.", log: logReady }) === "open";
+      if (open) {
+        if (isPrm) return new Response("not found", { status: 404 });
+      } else {
+        if (isPrm) return brokerGate.metadataResponse(req.method, resource);
+        const result = await brokerGate.check(req.headers, resource, `${resource}${PRM_SUFFIX}`);
+        if (!result.ok) return result.response;
+      }
     }
     let resolved;
     try {
@@ -878,7 +884,7 @@ function aiReady(options = {}) {
       console.error("exposify-supabase: auth resolver failed", err);
       return Response.json({ error: "internal MCP server error" }, { status: 503 });
     }
-    if (authRequired && !resolved.get("authorization")) {
+    if (authRequired && !open && !resolved.get("authorization")) {
       return Response.json({ error: "unauthorized" }, { status: 401, headers: { "www-authenticate": "Bearer" } });
     }
     resolvedAuth.set(req, resolved);

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/index.ts
-import { createBrokerGate, createWebMcpHandler, formatFailed as formatFailed2, publicRequestUrl, formatWarning as formatWarning2, hostedResolverFromEnv, isHostedResolver, readEnv, startupLogEnabled } from "@exposify/core";
+import { createBrokerGate, createWebMcpHandler, formatFailed as formatFailed2, publicRequestUrl, formatWarning as formatWarning2, hostedResolverFromEnv, isHostedResolver, readEnv, reportAppLogin, startupLogEnabled } from "@exposify/core";
 
 // src/kb.ts
 import { KnowledgeBase } from "@exposify/core";
@@ -829,13 +829,19 @@ function aiReady(options = {}) {
   const brokerGate = authRequired ? createBrokerGate(auth) : null;
   const functionUrl = supabaseUrl && functionName ? `${supabaseUrl.replace(/\/+$/, "")}/functions/v1/${functionName}` : null;
   return async (req) => {
+    let open = false;
     if (brokerGate) {
       const own = publicRequestUrl(req.url, req.headers);
       const isPrm = own.endsWith(PRM_SUFFIX);
       const resource = brokerGate.resourceFor(functionUrl ?? (isPrm ? own.slice(0, -PRM_SUFFIX.length) : own));
-      if (isPrm) return brokerGate.metadataResponse(req.method, resource);
-      const result = await brokerGate.check(req.headers, resource, `${resource}${PRM_SUFFIX}`);
-      if (!result.ok) return result.response;
+      open = await reportAppLogin(auth, resource, null, { stacks: ["@supabase/supabase-js"], why: "Supabase Auth sign-in for agents is the Supabase preset in the dashboard's sign-in methods.", log: logReady }) === "open";
+      if (open) {
+        if (isPrm) return new Response("not found", { status: 404 });
+      } else {
+        if (isPrm) return brokerGate.metadataResponse(req.method, resource);
+        const result = await brokerGate.check(req.headers, resource, `${resource}${PRM_SUFFIX}`);
+        if (!result.ok) return result.response;
+      }
     }
     let resolved;
     try {
@@ -844,7 +850,7 @@ function aiReady(options = {}) {
       console.error("exposify-supabase: auth resolver failed", err);
       return Response.json({ error: "internal MCP server error" }, { status: 503 });
     }
-    if (authRequired && !resolved.get("authorization")) {
+    if (authRequired && !open && !resolved.get("authorization")) {
       return Response.json({ error: "unauthorized" }, { status: 401, headers: { "www-authenticate": "Bearer" } });
     }
     resolvedAuth.set(req, resolved);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/supabase",
-  "version": "0.3.9",
+  "version": "0.3.10",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -27,7 +27,7 @@
     "prepack": "yarn build"
   },
   "dependencies": {
-    "@exposify/core": "0.3.13",
+    "@exposify/core": "0.3.14",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "zod": "^3.24.0"
   },