@farm.js/supabase 0.1.0-beta.10 → 0.1.0-beta.100

package/dist/index.d.ts

@@ -1,9 +1,27 @@
+import { createServerClient } from "@supabase/ssr";
 import { type FarmIntegrationHandlerContext, type FarmIntegrationLogger } from "@farm.js/core";
 export interface SupabaseIntegrationPages {
     signIn?: string;
     signUp?: string;
 }
+export type SupabaseIntegrationClient = ReturnType<typeof createServerClient>;
+export type SupabaseIntegrationClientOptions = Parameters<typeof createServerClient>[2];
+export interface SupabaseIntegrationInstanceContext {
+    request: Request;
+    url?: string;
+    anonKey?: string;
+    createClient: typeof createServerClient;
+    options: SupabaseIntegrationClientOptions;
+}
+/**
+ * Creates a request-scoped Supabase client using Farm's cookie adapter.
+ *
+ * A factory is used instead of a shared client because Supabase SSR clients
+ * are bound to the cookies of the current request.
+ */
+export type SupabaseIntegrationInstance = (context: SupabaseIntegrationInstanceContext) => SupabaseIntegrationClient;
 export interface SupabaseIntegrationInput {
+    instance?: SupabaseIntegrationInstance;
     url?: string;
     anonKey?: string;
     appBaseUrl?: string;
@@ -17,11 +35,19 @@ export interface SupabaseIntegrationInput {
     providers?: string[];
     defaultProvider?: string;
     pages?: SupabaseIntegrationPages;
+    /**
+     * Additional origins allowed to submit the sign-in, sign-up, and sign-out
+     * routes, using the same pattern syntax as `serverActions.allowedOrigins`
+     * (`https://app.example.com`, `example.com`, `*.example.com`). The app's own
+     * origin is always trusted; set this only when a different trusted origin
+     * posts these forms.
+     */
+    allowedOrigins?: string[];
     log?: FarmIntegrationLogger;
 }
 interface ResolvedSupabaseEnv {
-    url: string;
-    anonKey: string;
+    url?: string;
+    anonKey?: string;
     appBaseUrl?: string;
 }
 interface ResolvedSupabasePages {
@@ -32,7 +58,7 @@ export declare function supabase(input?: SupabaseIntegrationInput): import("@far
     category: "auth";
     type: string;
     instance: {
-        url: string;
+        url: string | undefined;
         protectedRoutes: string[];
         providers: string[];
         pages: ResolvedSupabasePages;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,EAC3B,MAAM,eAAe,CAAC;AAkCvB,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,wBAAwB,CAAC;IACjC,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED,UAAU,mBAAmB;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,qBAAqB;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA6tBD,wBAAgB,QAAQ,CAAC,KAAK,GAAE,wBAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BAuE7B,OAAO,WAAW,6BAA6B;;;;0BAkbzC,OAAO,WAAW,6BAA6B;;GAkBpF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAsB,MAAM,eAAe,CAAC;AACvE,OAAO,EAGL,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,EAC3B,MAAM,eAAe,CAAC;AAsCvB,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,yBAAyB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9E,MAAM,MAAM,gCAAgC,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;AAExF,MAAM,WAAW,kCAAkC;IACjD,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,OAAO,kBAAkB,CAAC;IACxC,OAAO,EAAE,gCAAgC,CAAC;CAC3C;AAED;;;;;GAKG;AACH,MAAM,MAAM,2BAA2B,GAAG,CACxC,OAAO,EAAE,kCAAkC,KACxC,yBAAyB,CAAC;AAE/B,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,wBAAwB,CAAC;IACjC;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED,UAAU,mBAAmB;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,qBAAqB;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAuuBD,wBAAgB,QAAQ,CAAC,KAAK,GAAE,wBAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BAuG7B,OAAO,WAAW,6BAA6B;;;;0BA2czC,OAAO,WAAW,6BAA6B;;GAgDpF"}

package/dist/index.js

@@ -1,5 +1,6 @@
 import { createServerClient } from "@supabase/ssr";
-import { defineIntegration, } from "@farm.js/core";
+import { defineIntegration, forwardIntegrationSetCookies, } from "@farm.js/core";
+import { describeIntegrationOriginRejection, resolveIntegrationAllowedOrigins, validateIntegrationRequestOrigin, } from "@farm.js/core/integrations";
 import { api as clientApi } from "@farm.js/core/client";
 import { createPathInferredClientApi, createDocumentNavigationMatchers, escapeHtml, getOrigin, getReturnTo, integrationConfig, normalizeMatchers, parseCookieHeaderList, resolveAppPath, resolveCallbackSettings, toAbsoluteUrl, withSearchParams, } from "@farm.js/integration-utils";
 import { supabaseAuthFormFields, } from "./client.js";
@@ -40,8 +41,8 @@ function resolveEnv(input) {
         process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_DEFAULT_KEY ??
         "";
     const appBaseUrl = input.appBaseUrl ?? process.env.APP_BASE_URL ?? undefined;
-    if (!url || !anonKey) {
-        throw new Error("Supabase integration requires SUPABASE_URL (or NEXT_PUBLIC_SUPABASE_URL) and SUPABASE_ANON_KEY (or a Supabase publishable key env).");
+    if (!input.instance && (!url || !anonKey)) {
+        throw new Error("Supabase integration requires an instance factory or SUPABASE_URL (or NEXT_PUBLIC_SUPABASE_URL) and SUPABASE_ANON_KEY (or a Supabase publishable key env).");
     }
     return {
         url,
@@ -576,9 +577,9 @@ function renderCheckEmailPage(context, signInViewPath, email, returnTo) {
         },
     });
 }
-function createSupabaseHandler(context, env) {
+function createSupabaseHandler(context, env, instance) {
     const setCookies = [];
-    const supabase = createServerClient(env.url, env.anonKey, {
+    const options = {
         auth: {
             flowType: "pkce",
             detectSessionInUrl: false,
@@ -591,10 +592,18 @@ function createSupabaseHandler(context, env) {
                 for (const cookie of cookiesToSet) {
                     setCookies.push(serializeCookie(cookie.name, cookie.value, cookie.options));
                 }
-                context.req.set("supabase:set-cookies", [...setCookies]);
             },
         },
-    });
+    };
+    const supabase = instance
+        ? instance({
+            request: context.request,
+            url: env.url,
+            anonKey: env.anonKey,
+            createClient: createServerClient,
+            options,
+        })
+        : createServerClient(env.url, env.anonKey, options);
     return {
         supabase,
         setCookies,
@@ -648,12 +657,33 @@ export function supabase(input = {}) {
         label: "Supabase integration",
     }, env.appBaseUrl);
     const callbackPath = callbackSettings.callbackPath;
+    const allowedOrigins = resolveIntegrationAllowedOrigins(input.allowedOrigins, "supabase.allowedOrigins");
     const api = createSupabaseApi({
         loginPath,
         signupPath,
         logoutPath,
         sessionPath,
     });
+    /**
+     * Reject a credential or sign-out request that did not come from this app.
+     * Returns the response to send, or null when the request may proceed.
+     */
+    function rejectForeignOrigin(request, clientRequest, { requireOriginMetadata }) {
+        const result = validateIntegrationRequestOrigin(request, {
+            allowedOrigins,
+            requireOriginMetadata,
+        });
+        if (result.ok) {
+            return null;
+        }
+        const message = describeIntegrationOriginRejection(result.reason);
+        return clientRequest
+            ? jsonError(message, 403)
+            : new Response(message, {
+                status: 403,
+                headers: { "content-type": "text/plain; charset=utf-8" },
+            });
+    }
     return defineIntegration({
         category: "auth",
         type: "supabase",
@@ -677,7 +707,7 @@ export function supabase(input = {}) {
                 appBaseUrl: "APP_BASE_URL",
             },
             input: env,
-            required: ["url", "anonKey"],
+            required: input.instance ? [] : ["url", "anonKey"],
         }),
         api,
         log: input.log,
@@ -697,6 +727,12 @@ export function supabase(input = {}) {
                     const provider = requestUrl.searchParams.get("provider") || input.defaultProvider;
                     const returnTo = getReturnTo(requestUrl.searchParams.get("returnTo"), "/dashboard");
                     if (request.method === "POST") {
+                        const rejected = rejectForeignOrigin(request, clientRequest, {
+                            requireOriginMetadata: true,
+                        });
+                        if (rejected) {
+                            return rejected;
+                        }
                         const parsedRequest = await parseEmailPasswordRequest(request);
                         if (!parsedRequest.ok) {
                             if (clientRequest) {
@@ -723,7 +759,7 @@ export function supabase(input = {}) {
                                 },
                             });
                         }
-                        const { supabase, setCookies } = createSupabaseHandler(context, env);
+                        const { supabase, setCookies } = createSupabaseHandler(context, env, input.instance);
                         const { error } = await supabase.auth.signInWithPassword({
                             email: parsedRequest.email,
                             password: parsedRequest.password,
@@ -789,7 +825,7 @@ export function supabase(input = {}) {
                             feedback: readPageFeedback(context),
                         });
                     }
-                    const { supabase, setCookies } = createSupabaseHandler(context, env);
+                    const { supabase, setCookies } = createSupabaseHandler(context, env, input.instance);
                     const { data, error } = await supabase.auth.signInWithOAuth({
                         provider: provider,
                         options: {
@@ -847,6 +883,12 @@ export function supabase(input = {}) {
                             feedback: readPageFeedback(context),
                         });
                     }
+                    const rejected = rejectForeignOrigin(request, clientRequest, {
+                        requireOriginMetadata: true,
+                    });
+                    if (rejected) {
+                        return rejected;
+                    }
                     const parsedRequest = await parseEmailPasswordRequest(context.request);
                     if (!parsedRequest.ok) {
                         if (clientRequest) {
@@ -872,7 +914,7 @@ export function supabase(input = {}) {
                             },
                         });
                     }
-                    const { supabase, setCookies } = createSupabaseHandler(context, env);
+                    const { supabase, setCookies } = createSupabaseHandler(context, env, input.instance);
                     const { data, error } = await supabase.auth.signUp({
                         email: parsedRequest.email,
                         password: parsedRequest.password,
@@ -954,7 +996,7 @@ export function supabase(input = {}) {
                     if (!code) {
                         return new Response("Missing Supabase authorization code.", { status: 400 });
                     }
-                    const { supabase, setCookies } = createSupabaseHandler(context, env);
+                    const { supabase, setCookies } = createSupabaseHandler(context, env, input.instance);
                     const { error } = await supabase.auth.exchangeCodeForSession(code);
                     if (error) {
                         return new Response(error.message, { status: 500 });
@@ -976,6 +1018,16 @@ export function supabase(input = {}) {
                     const requestUrl = context.url;
                     let returnTo = getReturnTo(requestUrl.searchParams.get("returnTo"), "/");
                     const clientRequest = isIntegrationClientRequest(request);
+                    // A POST carries an Origin in every supported browser, so it is held
+                    // to the strict check. A GET sign-out is also reachable as a plain
+                    // link or bookmark, where no origin metadata exists at all; those
+                    // stay allowed and only an explicitly cross-site GET is rejected.
+                    const rejected = rejectForeignOrigin(request, clientRequest, {
+                        requireOriginMetadata: request.method === "POST",
+                    });
+                    if (rejected) {
+                        return rejected;
+                    }
                     if (request.method === "POST") {
                         const contentType = context.request.headers.get("content-type") || "";
                         if (contentType.includes("application/json")) {
@@ -983,7 +1035,7 @@ export function supabase(input = {}) {
                             returnTo = getReturnTo(payload.returnTo, returnTo);
                         }
                     }
-                    const { supabase, setCookies } = createSupabaseHandler(context, env);
+                    const { supabase, setCookies } = createSupabaseHandler(context, env, input.instance);
                     const { error } = await supabase.auth.signOut();
                     if (error) {
                         if (clientRequest) {
@@ -1010,7 +1062,7 @@ export function supabase(input = {}) {
                 path: sessionPath,
                 methods: ["GET"],
                 async handler(_request, context) {
-                    const { supabase, setCookies } = createSupabaseHandler(context, env);
+                    const { supabase, setCookies } = createSupabaseHandler(context, env, input.instance);
                     const { data, error } = await supabase.auth.getUser();
                     const headers = new Headers({
                         "content-type": "application/json",
@@ -1037,14 +1089,41 @@ export function supabase(input = {}) {
                 {
                     matcher: protectedMatchers,
                     async handler(_request, context) {
-                        const { supabase } = createSupabaseHandler(context, env);
-                        const { data: { session }, } = await supabase.auth.getSession();
-                        if (session) {
+                        const { supabase, setCookies } = createSupabaseHandler(context, env, input.instance);
+                        // getSession() reads the cookie without verifying the token,
+                        // so a forged cookie would pass this gate. getUser() checks
+                        // the token against Supabase Auth before the route is served.
+                        const { data, error } = await supabase.auth.getUser();
+                        if (!error && data?.user) {
+                            // getUser() verifies the token with Supabase Auth, and while
+                            // doing so can rotate the session server-side (e.g. when the
+                            // access token is near expiry), capturing the refreshed
+                            // Set-Cookie in setCookies. This branch returns void so the
+                            // protected route still renders, which means those cookies
+                            // cannot ride on this branch's response — hand them to the
+                            // runtime via forwardIntegrationSetCookies so it forwards
+                            // them on the downstream response, mirroring the failure
+                            // branch's appendSetCookies on its redirect. Without this the
+                            // rotated cookie is dropped, the browser keeps the stale
+                            // refresh token, and the next protected request logs the user
+                            // out via refresh-token reuse detection.
+                            if (setCookies.length > 0) {
+                                forwardIntegrationSetCookies(context, setCookies);
+                            }
                             return;
                         }
-                        return redirectToPage(signInViewPath, context, env.appBaseUrl, {
+                        const redirect = redirectToPage(signInViewPath, context, env.appBaseUrl, {
                             returnTo: `${context.url.pathname}${context.url.search}`,
                         });
+                        if (setCookies.length === 0) {
+                            return redirect;
+                        }
+                        // A failed validation can clear or rotate auth cookies; keep
+                        // those directives on the redirect so the browser drops the
+                        // stale session instead of replaying it on the next request.
+                        const headers = new Headers(redirect.headers);
+                        appendSetCookies(headers, setCookies);
+                        return new Response(null, { status: redirect.status, headers });
                     },
                 },
             ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farm.js/supabase",
-  "version": "0.1.0-beta.10",
+  "version": "0.1.0-beta.100",
   "description": "Supabase integration for Farm.js",
   "license": "MIT",
   "repository": {
@@ -31,8 +31,8 @@
   "dependencies": {
     "@supabase/ssr": "^0.9.0",
     "@supabase/supabase-js": "^2.99.2",
-    "@farm.js/core": "0.1.0-beta.10",
-    "@farm.js/integration-utils": "0.1.0-beta.10"
+    "@farm.js/core": "0.1.0-beta.100",
+    "@farm.js/integration-utils": "0.1.0-beta.100"
   },
   "scripts": {
     "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc",