@guard-rail/core 0.9.1 → 0.11.0

package/README.md

@@ -50,36 +50,8 @@ SUPABASE_ANON_KEY=...
 GUARDRAIL_SITE_ID=my-site   # optional; defaults to "default"
 ```
 
-### Many sites, one Supabase project
-
-Every table above is keyed by `site_id`, and every RLS policy checks a role
-*for that specific site_id* — this isn't a convenience layer on top of
-separate installs, it's how the schema is built. A migration, its Exposed
-Schemas setting, and the default storage bucket are one-time, per-*project*
-setup, not per-site.
-
-So running several sites against a single Supabase project is a supported,
-intended pattern, not a workaround — useful while a site is small, in
-testing, or just doesn't warrant its own project yet. For the second and
-later sites on an already-set-up project:
-
-1. Install the package as usual. Skip the migration and the Exposed Schemas
-   step entirely — both already apply to every site on that project.
-2. Point `SUPABASE_URL` / `SUPABASE_ANON_KEY` at the same project, and set a
-   new, unique `GUARDRAIL_SITE_ID`.
-3. Seed a bootstrap admin row for that new `site_id` — membership is also
-   per-site, so an existing admin on one site has no role on another until
-   added there specifically.
-
-**One tradeoff worth knowing:** `gr_content` and `gr_repeater_items` are
-readable by anyone (`using (true)`), not scoped by `site_id` — necessary
-since anonymous visitors must be able to read a site's content to render it,
-and there's no draft/unpublished state to protect in the first place. But it
-does mean any one site's anon key can read every other site's content rows
-directly through the REST API, not just through its own rendered pages. Low
-stakes for content that's already meant to be public on its own site, but
-worth factoring in before treating a shared project as a hard tenant
-boundary.
+Then run `pnpm exec guardrail-doctor` to confirm everything is wired up (see
+"Checking your setup" below).
 
 ## Usage
 
@@ -250,15 +222,21 @@ so there is no Site URL, redirect allowlist, or email template to configure.
 
 Worth knowing:
 
+- **Set `GUARDRAIL_SITE_URL` in production** (or `siteUrl` in `withGuardrail()`) to
+  your site's public address, e.g. `https://mysite.com`. Every emailed link is
+  built from it. Guardrail never builds a link from the incoming request's
+  `Host`/`Origin` — "Forgot password?" is open to anyone, so a forged header
+  would mail a working reset link to someone else's domain. Without it,
+  production refuses to send invites and resets and tells the admin why. (In
+  development the address you're browsing from is used.)
 - **Setting a password can't be skipped.** It's the only way back in once a
   session ends, so the drawer has no dismiss button — only "Cancel and sign out".
 - **Links work once.** A link that has expired or been used shows "That link
   didn't work" with a form to request a new one, rather than doing nothing.
-- **People who already have an account never see the set-password step.** Auth
-  users are project-wide, so on a Supabase project shared by several sites
-  someone has one password everywhere, and a second prompt would have them
-  overwrite it. They're told they've been added and sign in as usual; if they've
-  forgotten it, **Forgot password?** covers that.
+- **People who already have an account never see the set-password step.** If the
+  address you invite already has a Supabase account, a second prompt would have
+  them overwrite the password they use. They're told they've been added and sign
+  in as usual; if they've forgotten it, **Forgot password?** covers that.
 - **"Forgot password?" answers the same whether or not the address belongs to
   anyone**, takes the same time, and only sends to members — never to a stranger.
   It sends at most one email per address per minute.
@@ -361,7 +339,7 @@ the file after resizing.
 1. The init migration creates the default `gr-media` bucket and storage
    policies scoped to the `gr-` prefix. To use a different bucket, just pass
    its name: any `gr-*` bucket is created automatically on the first upload,
-   no SQL edits needed.
+   no SQL edits needed (up to 50 per project).
 2. Allow the storage host in `next.config.ts`, or `next/image` will throw:
    ```ts
    images: {
@@ -518,6 +496,54 @@ the outline ignores the pointer so your overlaid content stays fully clickable,
 and the handle is the only thing that opens the editor (it also won't trigger a
 surrounding `<Link>`).
 
+### Theming
+
+The chrome is a real stylesheet (`guardrail.css`) that the package imports itself —
+there is nothing to link by hand, and no inline styles, so it works under a strict
+Content-Security-Policy. Every color is a CSS variable, so restyling it is a plain
+`:root` rule in your own CSS:
+
+```css
+:root {
+  --gr-accent: #7c3aed;
+  --gr-field-outline: #7c3aed;
+  --gr-overlay-bg: #1e1b4b;
+  --gr-overlay-fg: #e0e7ff;
+}
+```
+
+No `!important` and no selector tricks: Guardrail's defaults are declared with zero
+specificity, so your `:root` rule wins whichever stylesheet loads first.
+
+There are two layers. Change a **base** color to retheme everything, or set an
+**overlay** color to restyle only the floating surfaces (the sign-in bar, toolbar,
+edit popups, drawers and image picker). The overlay variables default to the base
+ones, so you only set what you want to differ.
+
+| Variable | What it colors |
+|---|---|
+| `--gr-overlay-bg` | Background of the sign-in bar, popups, drawers and picker |
+| `--gr-overlay-bg-glass` | Background of the toolbar and the inline editing bar (translucent) |
+| `--gr-overlay-fg` | Text on all of the above |
+| `--gr-overlay-border` | Their borders |
+| `--gr-field-outline` | The dashed outline around an editable field |
+| `--gr-field-outline-active` | The solid outline while a field is being edited |
+| `--gr-accent`, `--gr-accent-soft`, `--gr-accent-text`, `--gr-on-accent` | Highlights, and text on an accent background |
+| `--gr-primary-bg`, `--gr-primary-fg` | Primary buttons |
+| `--gr-danger`, `--gr-label`, `--gr-badge-bg`, `--gr-badge-fg` | Errors, small labels, the "pending" badge |
+| `--gr-scrim`, `--gr-scrim-modal` | The dimmed backdrop behind drawers and the picker |
+| `--gr-bg`, `--gr-bg-glass`, `--gr-fg`, `--gr-fg2`, `--gr-muted`, `--gr-subtle`, `--gr-border`, `--gr-border-strong`, `--gr-border-soft`, `--gr-input-bg`, `--gr-soft`, `--gr-shadow` | The base palette the overlay variables fall back to, plus inputs and secondary text |
+
+Set any of them inside `@media (prefers-color-scheme: dark)` if you want a
+different value in dark mode — the chrome follows the visitor's OS setting. The
+outline around an editable text field is `[data-gr-field="text"]` (and
+`[data-gr-editing]` while it's being edited), so you can restyle or hide it with a
+rule of your own; to hide it, set `--gr-field-outline: transparent`. Every class
+Guardrail adds is prefixed `gr-`.
+
+If your setup doesn't bundle CSS imported from a package, import it yourself once,
+in your root layout: `import "@guard-rail/core/styles.css";`.
+
 ## Extending the toolbar
 
 The bundled toolbar (edit indicator, Team, Exit edit mode) has one extension point:
@@ -611,8 +637,199 @@ Anything outside the preload (a `prefetch.prefix` scope, or a site past the row
 ceiling) falls back to a batched lookup by key. Set `GUARDRAIL_DEBUG=1` to log
 what each query resolved.
 
+## Checking your setup: `guardrail-doctor`
+
+`guardrail-doctor` ships inside this package, so it always matches the version
+you have installed. Run it after installing, after every upgrade, and before you
+deploy:
+
+```bash
+pnpm exec guardrail-doctor
+```
+
+By default it only reads. It checks:
+
+- **Project:** the installed versions of `next`, `@supabase/supabase-js`,
+  `@supabase/ssr` and `@guard-rail/core` against the npm registry's published
+  security advisories (always current — nothing to keep up to date), and that
+  the Supabase libraries are installed.
+- **Environment:** the Supabase URL and keys (including keys swapped into each
+  other's slots, and secrets behind a `NEXT_PUBLIC_` name), `GUARDRAIL_SITE_URL`,
+  email settings, and that your env files are gitignored.
+- **Files:** that every migration this version ships is in
+  `supabase/migrations/`, that `next.config` sets anti-framing headers, and that
+  the root layout uses `withGuardrail()`.
+- **Database:** that the `guardrail` schema is exposed, the tables and functions
+  exist, rate limiting works, and what your project's sign-up settings are
+  (whether **Confirm email** is on).
+
+| Flag | What it adds |
+|---|---|
+| `--fix` | Repairs what can be repaired in local files: copies missing migrations, adds a `GUARDRAIL_SITE_URL` note to `.env.example` / `.env.local`, adds baseline security headers to `next.config`. It never changes secrets or Supabase dashboard settings, and re-running it is safe. Add `--push` to also run `supabase db push`. |
+| `--app-url=http://localhost:3000` | Also checks the response headers of a running copy of your site, including that Guardrail's stylesheet reached the page and that its Content-Security-Policy lets Guardrail's uploads and images through. |
+| `--e2e` | Runs an end-to-end suite against the database. It creates a throwaway user, a few rows and a test image, then exercises sign-in, claiming an invitation, row-level security (an editor can write their own site and nobody else's; visitors can read but not write), the last-admin guard, rate limiting and image uploads, and deletes everything it made. It asks before touching a database that isn't local (`--yes` skips the question), and needs the service-role key. |
+| `--csp` | Prints a starter `Content-Security-Policy-Report-Only` header built from your `SUPABASE_URL` and exits. |
+| `--offline` | Skips the advisory lookup (the only network call besides your own Supabase project). Package names and versions are what's sent otherwise, as with `pnpm audit`; offline, Next.js is checked against a built-in list that may be out of date. |
+| `--production` | Treats production-only requirements as failures instead of warnings. |
+| `--strict` / `--json` | Exit non-zero on warnings too; machine-readable output for CI. |
+
+It exits non-zero when anything fails, so it works in CI. It reads
+`SUPABASE_URL`, `SUPABASE_ANON_KEY` and `SUPABASE_SERVICE_ROLE_KEY` (or
+`SERVICE_KEY`) from the environment, then `.env.local` and `.env`.
+
+### Upgrading
+
+After `pnpm up @guard-rail/core`:
+
+```bash
+pnpm exec guardrail-doctor --fix --push   # copy + apply new migrations, patch local files
+pnpm exec guardrail-doctor                # see what's left for you to do
+```
+
+What `--fix` can't do for you: set the value of `GUARDRAIL_SITE_URL`, turn on
+**Confirm email** in the Supabase dashboard, and merge headers into a
+`next.config` that already defines its own `headers()`. The doctor says which of
+these apply.
+
+## Before you deploy
+
+Run `pnpm exec guardrail-doctor --production` to check everything below.
+
+- **Run a patched Next.js.** Guardrail requires `next` 15.5.28 or later, or
+  16.4.1 or later — older releases have published security advisories (including
+  remote code execution and middleware bypass). Keep it current;
+  `guardrail-doctor` flags a vulnerable version.
+- **Keep email confirmation on** in Supabase (**Authentication > Sign In /
+  Providers > Email > Confirm email**), or turn public sign-ups off. This setting
+  is what stops someone registering an invited person's address before they do
+  and claiming the invitation; with it off, Supabase marks any address confirmed
+  the moment it signs up. The `20261028000000_require_confirmed_email` migration
+  adds a database-level check that only a confirmed address can claim an
+  invitation or read its roster row — defense in depth, not a substitute. Re-run
+  `pnpm exec guardrail-init-db --push` after upgrading.
+- **Set `GUARDRAIL_SITE_URL`** (see "Passwords, invites and resets").
+- **Rate limiting.** Sign-in (per account from one address, per account overall,
+  and per address — so one person hammering an account can't lock its owner out),
+  "Forgot password?" (per address and per inbox),
+  the emailed-link exchange, and the admin actions that send invites/resets or
+  create uploads are limited out of the box. With the Supabase adapter and a
+  `serviceRoleKey`, the counters live in your project's `guardrail` schema
+  (`gr_rate_limits`, added by the `rate_limits` migration), so limits hold
+  across serverless instances with nothing extra to run. Re-run
+  `pnpm exec guardrail-init-db --push` after upgrading to add it; until the
+  migration is applied, limits fall back to in-memory counting (with a warning
+  in the log) rather than blocking sign-in. If the database can't be reached
+  for any other reason, the request is refused.
+
+  The defaults are deliberately generous for normal use: one account may fail 8
+  sign-ins per 15 minutes from one address (and 40 from anywhere), one address
+  30, and "Forgot password?" is limited to 5 per inbox per hour. If a team signs in
+  from one shared address, raise what you need:
+
+  ```ts
+  withGuardrail(RootLayout, {
+    ...supabase,
+    rateLimitRules: { "login:pair": { limit: 20 }, "login:ip": { limit: 100 } },
+  });
+  ```
+
+  The names are `login:pair`, `login:account`, `login:ip`, `forgot-password:ip`,
+  `forgot-password:account`, `auth-link:ip`, `invite:user`,
+  `password-reset:user` and `upload:user`; each takes `limit` and/or
+  `windowSeconds`. Someone who is throttled can always **Forgot password?** — the
+  emailed link signs them in directly.
+
+  Without a service-role key the built-in counters are in memory only, which
+  isn't enough on serverless. Pass your own limiter instead — for example with
+  Upstash:
+
+  ```ts
+  import { Ratelimit } from "@upstash/ratelimit";
+  import { Redis } from "@upstash/redis";
+
+  const redis = Redis.fromEnv();
+  const limiters = new Map<string, Ratelimit>();
+
+  withGuardrail(RootLayout, {
+    ...supabase,
+    rateLimit: async ({ name, key, limit, windowSeconds }) => {
+      let rl = limiters.get(name);
+      if (!rl) {
+        rl = new Ratelimit({
+          redis,
+          limiter: Ratelimit.fixedWindow(limit, `${windowSeconds} s`),
+          prefix: `guardrail:${name}`,
+        });
+        limiters.set(name, rl);
+      }
+      const { success, reset } = await rl.limit(key);
+      return { allowed: success, retryAfterSeconds: Math.ceil((reset - Date.now()) / 1000) };
+    },
+  });
+  ```
+
+  Address-keyed limits read `X-Forwarded-For`, which is only trustworthy behind a
+  proxy that overwrites it (Vercel, Cloudflare and most load balancers do). On a
+  server reached directly, or behind one that only appends to the header, a client
+  can write it themselves — pass a `clientIp` function to read the right header
+  instead (it receives the request's `Headers`):
+
+  ```ts
+  withGuardrail(RootLayout, {
+    ...supabase,
+    clientIp: (headers) => headers.get("cf-connecting-ip") ?? undefined,
+  });
+  ```
+
+  The per-account limits don't depend on it. Also set a spend cap in your
+  Resend dashboard as the backstop.
+- **Add security headers** in `next.config`: at least a `Content-Security-Policy`
+  with `frame-ancestors 'self'` (so the editing chrome can't be framed by another
+  site), `Strict-Transport-Security`, and `X-Content-Type-Options: nosniff`.
+  `guardrail-doctor --fix` adds this baseline. For a policy that also restricts
+  scripts and styles, see "Content Security Policy" below.
+
+### Content Security Policy
+
+Guardrail works under a strict policy — no `'unsafe-inline'` for styles and no
+nonce. Its chrome is a stylesheet, and it renders no inline scripts and uses no
+`eval`. A strict policy only has to allow the two places the browser talks to
+Supabase directly:
+
+| Directive | Allow | Why |
+|---|---|---|
+| `connect-src` | `'self'` and your Supabase origin | image uploads are sent straight from the browser to Supabase storage |
+| `img-src` | `'self'` and your Supabase origin | uploaded images and the media picker's thumbnails load from storage |
+| `style-src` | `'self'` | nothing more |
+| `frame-ancestors` | `'self'` | so the editing chrome can't be framed by another site |
+
+Everything else — reads, saves, sign-in — goes through your own server, i.e.
+`'self'`. If you build the header in code, `guardrailCspDirectives()` returns
+these for you to merge into your own:
+
+```ts
+import { guardrailCspDirectives, cspString } from "@guard-rail/core";
+
+const gr = guardrailCspDirectives({ supabaseUrl: process.env.SUPABASE_URL });
+// gr["connect-src"] -> ["'self'", "https://abc.supabase.co"]
+// cspString(gr)     -> "style-src 'self'; img-src 'self' https://abc.supabase.co; …"
+```
+
+To get started, `pnpm exec guardrail-doctor --csp` prints a starter
+`Content-Security-Policy-Report-Only` header built from your `SUPABASE_URL`: send it
+report-only first, tune it for what your own site loads (analytics, fonts,
+embeds), then enforce it. Once the site is running,
+`pnpm exec guardrail-doctor --app-url=https://your-site.com` checks that the live
+policy lets Guardrail's uploads and images through. A script nonce, if you use
+one, is set by your site (Next.js does it from a proxy); Guardrail doesn't need it.
+
 ## Known limitations
 
+- **Cache Components isn't supported.** Next's `cacheComponents: true` refuses
+  routes that read cookies outside `<Suspense>`, and Guardrail reads the session
+  cookie to decide what to render. Leave it off (some newer `create-next-app`
+  templates turn it on — remove `cacheComponents` and `partialPrefetching` from
+  `next.config`; `guardrail-doctor --fix` does it for you).
 - `withGuardrail` reads cookies in the root layout, which opts routes into
   dynamic rendering. See the repo README for the plan.
 - Saving revalidates the entire layout tree rather than the affected route.

package/dist/adapters/supabase/auth.js

@@ -7,8 +7,7 @@ function isExistingAccountError(error) {
 }
 function tokenLink(origin, tokenHash, type) {
   const link = new URL("/", origin);
-  link.searchParams.set("token_hash", tokenHash);
-  link.searchParams.set("type", type);
+  link.hash = new URLSearchParams({ token_hash: tokenHash, type }).toString();
   return link.toString();
 }
 function supabaseAuth(creds) {

package/dist/adapters/supabase/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/adapters/supabase/auth.ts"],"sourcesContent":["import type { EmailOtpType } from \"@supabase/supabase-js\";\nimport { adminClient, assertCredentials, sessionClient } from \"./client\";\nimport type { SupabaseCredentials } from \"./client\";\nimport type {\n  AuthRedirectParams,\n  GRAuthAdapter,\n  GRSession,\n} from \"../../core/adapter-types\";\n\n/**\n * Whether an emailed link should land on the Set Password step.\n *\n * Decided by the link's own type, which Guardrail's emails always carry, and\n * by nothing inferred about the account: \"invite\" and \"signup\" are someone's\n * first link into a brand-new account, and \"recovery\" is a password reset. All\n * three exist to let a person choose a password. Anything else — an old magic\n * link, a PKCE code that carries no type — just signs in, as Supabase intends.\n * Passwords are the only credential Guardrail asks people to use; these links\n * exist only to set one.\n */\nexport function needsPasswordFor(type: string | null | undefined): boolean {\n  return type === \"invite\" || type === \"signup\" || type === \"recovery\";\n}\n\n/** Supabase's \"this address already has an account\" outcomes, across its error shapes. */\nfunction isExistingAccountError(error: { code?: string; message: string }): boolean {\n  return (\n    error.code === \"email_exists\" ||\n    error.code === \"user_already_exists\" ||\n    /already (been )?registered|already exists/i.test(error.message)\n  );\n}\n\n/**\n * The link an email carries: the site's own root with the token in the query\n * string, where the always-mounted AuthRedirectSync completes it. Needs no\n * route and no entry in the provider's redirect allowlist (a project-wide\n * setting), and survives an email scanner that pre-fetches links, since nothing\n * is verified until the page's JavaScript runs.\n */\nfunction tokenLink(origin: string, tokenHash: string, type: string): string {\n  const link = new URL(\"/\", origin);\n  link.searchParams.set(\"token_hash\", tokenHash);\n  link.searchParams.set(\"type\", type);\n  return link.toString();\n}\n\nexport function supabaseAuth(creds: SupabaseCredentials): GRAuthAdapter {\n  assertCredentials(creds);\n\n  const adapter: GRAuthAdapter = {\n    async authenticate(email, password) {\n      const client = await sessionClient(creds);\n      const { data, error } = await client.auth.signInWithPassword({\n        email,\n        password,\n      });\n\n      if (error) return { success: false, error: error.message };\n      if (!data.user) return { success: false, error: \"User not found.\" };\n\n      return {\n        success: true,\n        session: { userId: data.user.id, email: data.user.email },\n      };\n    },\n\n    /**\n     * Uses getUser(), which revalidates the JWT against the Supabase auth\n     * server. getSession() only decodes the cookie, so it would trust a forged\n     * token.\n     */\n    async getSession(): Promise<GRSession | null> {\n      const client = await sessionClient(creds);\n      const { data, error } = await client.auth.getUser();\n      if (error || !data.user) return null;\n      return { userId: data.user.id, email: data.user.email };\n    },\n\n    async logout() {\n      const client = await sessionClient(creds);\n      await client.auth.signOut();\n    },\n\n    /**\n     * Whichever of hash/code/tokenHash is present decides the exchange —\n     * these correspond to Supabase's three redirect styles (legacy implicit\n     * grant, PKCE, and the token_hash style Guardrail's own confirm route\n     * already used), so this handles a link regardless of which one a\n     * project's email templates happen to produce, including the\n     * unconfigured default (implicit grant, hash-based — what an unedited\n     * Supabase project actually sends).\n     *\n     * Goes through sessionClient(), the same cookie-writing client\n     * everything else in this adapter uses — setSession/exchangeCodeForSession/\n     * verifyOtp all persist the resulting session through its existing\n     * getAll/setAll bridge, so this needs no browser-side Supabase client of\n     * its own.\n     */\n    async completeAuthRedirect({ hash, code, tokenHash, type }: AuthRedirectParams) {\n      const client = await sessionClient(creds);\n\n      if (hash) {\n        const hashParams = new URLSearchParams(hash);\n        const access_token = hashParams.get(\"access_token\");\n        const refresh_token = hashParams.get(\"refresh_token\");\n        const hashType = hashParams.get(\"type\") ?? type;\n        if (!access_token || !refresh_token) {\n          return { success: false, error: \"Redirect link is missing its tokens.\" };\n        }\n        const { error } = await client.auth.setSession({ access_token, refresh_token });\n        if (error) return { success: false, error: error.message };\n        return { success: true, needsPassword: needsPasswordFor(hashType) };\n      }\n\n      if (code) {\n        const { error } = await client.auth.exchangeCodeForSession(code);\n        if (error) return { success: false, error: error.message };\n        return { success: true, needsPassword: needsPasswordFor(type) };\n      }\n\n      if (tokenHash && type) {\n        const { error } = await client.auth.verifyOtp({\n          type: type as EmailOtpType,\n          token_hash: tokenHash,\n        });\n        if (error) return { success: false, error: error.message };\n        return { success: true, needsPassword: needsPasswordFor(type) };\n      }\n\n      return { success: false, error: \"No redirect data to complete.\" };\n    },\n\n    async setPassword(password: string) {\n      const client = await sessionClient(creds);\n      const { error } = await client.auth.updateUser({ password });\n      return error ? { success: false, error: error.message } : { success: true };\n    },\n  };\n\n  // Only offered when a service-role key was configured: minting a sign-in link\n  // server-side is an admin operation, and an adapter without the key simply\n  // can't do it, and the admin is told what to add.\n  if (creds.serviceRoleKey) {\n    /**\n     * Creates the account and returns a one-time link, sending nothing — the\n     * site's own onInvite handler delivers it (see resendInvite).\n     *\n     * The link points at the site's own root with the token in the query\n     * string, where the always-mounted AuthRedirectSync completes it. That\n     * needs no route, no Supabase Site URL / redirect allowlist entry (settings\n     * that are project-wide on a shared project), and — unlike a GET handler\n     * that verifies the token — survives an email scanner that pre-fetches\n     * links, since nothing is verified until the page's JavaScript runs.\n     */\n    adapter.createInviteLink = async (email, { origin }) => {\n      const admin = adminClient(creds);\n\n      const res = await admin.auth.admin.generateLink({ type: \"invite\", email });\n      if (res.error) {\n        // Already has an account — here or on another site on the same project.\n        // They have a password, so there's nothing to hand them but the site's\n        // address: a token here would be a way to sign in without it, and a\n        // set-password prompt would have them overwrite a password they use\n        // everywhere. The address opens the sign-in form (?edit=true).\n        if (isExistingAccountError(res.error)) {\n          return { success: true, link: new URL(\"/?edit=true\", origin).toString(), isNewUser: false };\n        }\n        return { success: false, error: res.error.message };\n      }\n      const hashed = res.data?.properties?.hashed_token;\n      if (!hashed) return { success: false, error: \"No invite link was returned.\" };\n\n      return { success: true, link: tokenLink(origin, hashed, \"invite\"), isNewUser: true };\n    };\n\n    adapter.createPasswordResetLink = async (email, { origin }) => {\n      const res = await adminClient(creds).auth.admin.generateLink({ type: \"recovery\", email });\n      const hashed = res.data?.properties?.hashed_token;\n      if (res.error || !hashed) {\n        return { success: false, error: res.error?.message ?? \"No reset link was returned.\" };\n      }\n      return { success: true, link: tokenLink(origin, hashed, \"recovery\") };\n    };\n  }\n\n  return adapter;\n}\n"],"mappings":"AACA,SAAS,aAAa,mBAAmB,qBAAqB;AAmBvD,SAAS,iBAAiB,MAA0C;AACzE,SAAO,SAAS,YAAY,SAAS,YAAY,SAAS;AAC5D;AAGA,SAAS,uBAAuB,OAAoD;AAClF,SACE,MAAM,SAAS,kBACf,MAAM,SAAS,yBACf,6CAA6C,KAAK,MAAM,OAAO;AAEnE;AASA,SAAS,UAAU,QAAgB,WAAmB,MAAsB;AAC1E,QAAM,OAAO,IAAI,IAAI,KAAK,MAAM;AAChC,OAAK,aAAa,IAAI,cAAc,SAAS;AAC7C,OAAK,aAAa,IAAI,QAAQ,IAAI;AAClC,SAAO,KAAK,SAAS;AACvB;AAEO,SAAS,aAAa,OAA2C;AACtE,oBAAkB,KAAK;AAEvB,QAAM,UAAyB;AAAA,IAC7B,MAAM,aAAa,OAAO,UAAU;AAClC,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK,mBAAmB;AAAA,QAC3D;AAAA,QACA;AAAA,MACF,CAAC;AAED,UAAI,MAAO,QAAO,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ;AACzD,UAAI,CAAC,KAAK,KAAM,QAAO,EAAE,SAAS,OAAO,OAAO,kBAAkB;AAElE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS,EAAE,QAAQ,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,MAAM;AAAA,MAC1D;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,aAAwC;AAC5C,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK,QAAQ;AAClD,UAAI,SAAS,CAAC,KAAK,KAAM,QAAO;AAChC,aAAO,EAAE,QAAQ,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,MAAM;AAAA,IACxD;AAAA,IAEA,MAAM,SAAS;AACb,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,OAAO,KAAK,QAAQ;AAAA,IAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAiBA,MAAM,qBAAqB,EAAE,MAAM,MAAM,WAAW,KAAK,GAAuB;AAC9E,YAAM,SAAS,MAAM,cAAc,KAAK;AAExC,UAAI,MAAM;AACR,cAAM,aAAa,IAAI,gBAAgB,IAAI;AAC3C,cAAM,eAAe,WAAW,IAAI,cAAc;AAClD,cAAM,gBAAgB,WAAW,IAAI,eAAe;AACpD,cAAM,WAAW,WAAW,IAAI,MAAM,KAAK;AAC3C,YAAI,CAAC,gBAAgB,CAAC,eAAe;AACnC,iBAAO,EAAE,SAAS,OAAO,OAAO,uCAAuC;AAAA,QACzE;AACA,cAAM,EAAE,MAAM,IAAI,MAAM,OAAO,KAAK,WAAW,EAAE,cAAc,cAAc,CAAC;AAC9E,YAAI,MAAO,QAAO,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ;AACzD,eAAO,EAAE,SAAS,MAAM,eAAe,iBAAiB,QAAQ,EAAE;AAAA,MACpE;AAEA,UAAI,MAAM;AACR,cAAM,EAAE,MAAM,IAAI,MAAM,OAAO,KAAK,uBAAuB,IAAI;AAC/D,YAAI,MAAO,QAAO,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ;AACzD,eAAO,EAAE,SAAS,MAAM,eAAe,iBAAiB,IAAI,EAAE;AAAA,MAChE;AAEA,UAAI,aAAa,MAAM;AACrB,cAAM,EAAE,MAAM,IAAI,MAAM,OAAO,KAAK,UAAU;AAAA,UAC5C;AAAA,UACA,YAAY;AAAA,QACd,CAAC;AACD,YAAI,MAAO,QAAO,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ;AACzD,eAAO,EAAE,SAAS,MAAM,eAAe,iBAAiB,IAAI,EAAE;AAAA,MAChE;AAEA,aAAO,EAAE,SAAS,OAAO,OAAO,gCAAgC;AAAA,IAClE;AAAA,IAEA,MAAM,YAAY,UAAkB;AAClC,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,IAAI,MAAM,OAAO,KAAK,WAAW,EAAE,SAAS,CAAC;AAC3D,aAAO,QAAQ,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ,IAAI,EAAE,SAAS,KAAK;AAAA,IAC5E;AAAA,EACF;AAKA,MAAI,MAAM,gBAAgB;AAYxB,YAAQ,mBAAmB,OAAO,OAAO,EAAE,OAAO,MAAM;AACtD,YAAM,QAAQ,YAAY,KAAK;AAE/B,YAAM,MAAM,MAAM,MAAM,KAAK,MAAM,aAAa,EAAE,MAAM,UAAU,MAAM,CAAC;AACzE,UAAI,IAAI,OAAO;AAMb,YAAI,uBAAuB,IAAI,KAAK,GAAG;AACrC,iBAAO,EAAE,SAAS,MAAM,MAAM,IAAI,IAAI,eAAe,MAAM,EAAE,SAAS,GAAG,WAAW,MAAM;AAAA,QAC5F;AACA,eAAO,EAAE,SAAS,OAAO,OAAO,IAAI,MAAM,QAAQ;AAAA,MACpD;AACA,YAAM,SAAS,IAAI,MAAM,YAAY;AACrC,UAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,+BAA+B;AAE5E,aAAO,EAAE,SAAS,MAAM,MAAM,UAAU,QAAQ,QAAQ,QAAQ,GAAG,WAAW,KAAK;AAAA,IACrF;AAEA,YAAQ,0BAA0B,OAAO,OAAO,EAAE,OAAO,MAAM;AAC7D,YAAM,MAAM,MAAM,YAAY,KAAK,EAAE,KAAK,MAAM,aAAa,EAAE,MAAM,YAAY,MAAM,CAAC;AACxF,YAAM,SAAS,IAAI,MAAM,YAAY;AACrC,UAAI,IAAI,SAAS,CAAC,QAAQ;AACxB,eAAO,EAAE,SAAS,OAAO,OAAO,IAAI,OAAO,WAAW,8BAA8B;AAAA,MACtF;AACA,aAAO,EAAE,SAAS,MAAM,MAAM,UAAU,QAAQ,QAAQ,UAAU,EAAE;AAAA,IACtE;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../../src/adapters/supabase/auth.ts"],"sourcesContent":["import type { EmailOtpType } from \"@supabase/supabase-js\";\nimport { adminClient, assertCredentials, sessionClient } from \"./client\";\nimport type { SupabaseCredentials } from \"./client\";\nimport type {\n  AuthRedirectParams,\n  GRAuthAdapter,\n  GRSession,\n} from \"../../core/adapter-types\";\n\n/**\n * Whether an emailed link should land on the Set Password step.\n *\n * Decided by the link's own type, which Guardrail's emails always carry, and\n * by nothing inferred about the account: \"invite\" and \"signup\" are someone's\n * first link into a brand-new account, and \"recovery\" is a password reset. All\n * three exist to let a person choose a password. Anything else — an old magic\n * link, a PKCE code that carries no type — just signs in, as Supabase intends.\n * Passwords are the only credential Guardrail asks people to use; these links\n * exist only to set one.\n */\nexport function needsPasswordFor(type: string | null | undefined): boolean {\n  return type === \"invite\" || type === \"signup\" || type === \"recovery\";\n}\n\n/** Supabase's \"this address already has an account\" outcomes, across its error shapes. */\nfunction isExistingAccountError(error: { code?: string; message: string }): boolean {\n  return (\n    error.code === \"email_exists\" ||\n    error.code === \"user_already_exists\" ||\n    /already (been )?registered|already exists/i.test(error.message)\n  );\n}\n\n/**\n * The link an email carries: the site's own root with the token in the URL\n * fragment, where the always-mounted AuthRedirectSync completes it. A fragment\n * is never sent to the server, so the token stays out of access logs, CDN logs\n * and `Referer` headers. Needs no route and no entry in the provider's redirect\n * allowlist (a project-wide setting), and survives an email scanner that\n * pre-fetches links, since nothing is verified until the page's JavaScript runs.\n */\nfunction tokenLink(origin: string, tokenHash: string, type: string): string {\n  const link = new URL(\"/\", origin);\n  link.hash = new URLSearchParams({ token_hash: tokenHash, type }).toString();\n  return link.toString();\n}\n\nexport function supabaseAuth(creds: SupabaseCredentials): GRAuthAdapter {\n  assertCredentials(creds);\n\n  const adapter: GRAuthAdapter = {\n    async authenticate(email, password) {\n      const client = await sessionClient(creds);\n      const { data, error } = await client.auth.signInWithPassword({\n        email,\n        password,\n      });\n\n      if (error) return { success: false, error: error.message };\n      if (!data.user) return { success: false, error: \"User not found.\" };\n\n      return {\n        success: true,\n        session: { userId: data.user.id, email: data.user.email },\n      };\n    },\n\n    /**\n     * Uses getUser(), which revalidates the JWT against the Supabase auth\n     * server. getSession() only decodes the cookie, so it would trust a forged\n     * token.\n     */\n    async getSession(): Promise<GRSession | null> {\n      const client = await sessionClient(creds);\n      const { data, error } = await client.auth.getUser();\n      if (error || !data.user) return null;\n      return { userId: data.user.id, email: data.user.email };\n    },\n\n    async logout() {\n      const client = await sessionClient(creds);\n      await client.auth.signOut();\n    },\n\n    /**\n     * Whichever of hash/code/tokenHash is present decides the exchange —\n     * these correspond to Supabase's three redirect styles (legacy implicit\n     * grant, PKCE, and the token_hash style Guardrail's own confirm route\n     * already used), so this handles a link regardless of which one a\n     * project's email templates happen to produce, including the\n     * unconfigured default (implicit grant, hash-based — what an unedited\n     * Supabase project actually sends).\n     *\n     * Goes through sessionClient(), the same cookie-writing client\n     * everything else in this adapter uses — setSession/exchangeCodeForSession/\n     * verifyOtp all persist the resulting session through its existing\n     * getAll/setAll bridge, so this needs no browser-side Supabase client of\n     * its own.\n     */\n    async completeAuthRedirect({ hash, code, tokenHash, type }: AuthRedirectParams) {\n      const client = await sessionClient(creds);\n\n      if (hash) {\n        const hashParams = new URLSearchParams(hash);\n        const access_token = hashParams.get(\"access_token\");\n        const refresh_token = hashParams.get(\"refresh_token\");\n        const hashType = hashParams.get(\"type\") ?? type;\n        if (!access_token || !refresh_token) {\n          return { success: false, error: \"Redirect link is missing its tokens.\" };\n        }\n        const { error } = await client.auth.setSession({ access_token, refresh_token });\n        if (error) return { success: false, error: error.message };\n        return { success: true, needsPassword: needsPasswordFor(hashType) };\n      }\n\n      if (code) {\n        const { error } = await client.auth.exchangeCodeForSession(code);\n        if (error) return { success: false, error: error.message };\n        return { success: true, needsPassword: needsPasswordFor(type) };\n      }\n\n      if (tokenHash && type) {\n        const { error } = await client.auth.verifyOtp({\n          type: type as EmailOtpType,\n          token_hash: tokenHash,\n        });\n        if (error) return { success: false, error: error.message };\n        return { success: true, needsPassword: needsPasswordFor(type) };\n      }\n\n      return { success: false, error: \"No redirect data to complete.\" };\n    },\n\n    async setPassword(password: string) {\n      const client = await sessionClient(creds);\n      const { error } = await client.auth.updateUser({ password });\n      return error ? { success: false, error: error.message } : { success: true };\n    },\n  };\n\n  // Only offered when a service-role key was configured: minting a sign-in link\n  // server-side is an admin operation, and an adapter without the key simply\n  // can't do it, and the admin is told what to add.\n  if (creds.serviceRoleKey) {\n    /**\n     * Creates the account and returns a one-time link, sending nothing — the\n     * site's own onInvite handler delivers it (see resendInvite).\n     *\n     * The link points at the site's own root with the token in the URL\n     * fragment, where the always-mounted AuthRedirectSync completes it. That\n     * needs no route and no Supabase Site URL / redirect allowlist entry, and —\n     * unlike a GET handler that verifies the token — survives an email scanner\n     * that pre-fetches links, since nothing is verified until the page's\n     * JavaScript runs.\n     */\n    adapter.createInviteLink = async (email, { origin }) => {\n      const admin = adminClient(creds);\n\n      const res = await admin.auth.admin.generateLink({ type: \"invite\", email });\n      if (res.error) {\n        // Already has an account. They have a password, so there's nothing to\n        // hand them but the site's address: a token here would be a way to sign\n        // in without it, and a set-password prompt would have them overwrite the\n        // password they use. The address opens the sign-in form (?edit=true).\n        if (isExistingAccountError(res.error)) {\n          return { success: true, link: new URL(\"/?edit=true\", origin).toString(), isNewUser: false };\n        }\n        return { success: false, error: res.error.message };\n      }\n      const hashed = res.data?.properties?.hashed_token;\n      if (!hashed) return { success: false, error: \"No invite link was returned.\" };\n\n      return { success: true, link: tokenLink(origin, hashed, \"invite\"), isNewUser: true };\n    };\n\n    adapter.createPasswordResetLink = async (email, { origin }) => {\n      const res = await adminClient(creds).auth.admin.generateLink({ type: \"recovery\", email });\n      const hashed = res.data?.properties?.hashed_token;\n      if (res.error || !hashed) {\n        return { success: false, error: res.error?.message ?? \"No reset link was returned.\" };\n      }\n      return { success: true, link: tokenLink(origin, hashed, \"recovery\") };\n    };\n  }\n\n  return adapter;\n}\n"],"mappings":"AACA,SAAS,aAAa,mBAAmB,qBAAqB;AAmBvD,SAAS,iBAAiB,MAA0C;AACzE,SAAO,SAAS,YAAY,SAAS,YAAY,SAAS;AAC5D;AAGA,SAAS,uBAAuB,OAAoD;AAClF,SACE,MAAM,SAAS,kBACf,MAAM,SAAS,yBACf,6CAA6C,KAAK,MAAM,OAAO;AAEnE;AAUA,SAAS,UAAU,QAAgB,WAAmB,MAAsB;AAC1E,QAAM,OAAO,IAAI,IAAI,KAAK,MAAM;AAChC,OAAK,OAAO,IAAI,gBAAgB,EAAE,YAAY,WAAW,KAAK,CAAC,EAAE,SAAS;AAC1E,SAAO,KAAK,SAAS;AACvB;AAEO,SAAS,aAAa,OAA2C;AACtE,oBAAkB,KAAK;AAEvB,QAAM,UAAyB;AAAA,IAC7B,MAAM,aAAa,OAAO,UAAU;AAClC,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK,mBAAmB;AAAA,QAC3D;AAAA,QACA;AAAA,MACF,CAAC;AAED,UAAI,MAAO,QAAO,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ;AACzD,UAAI,CAAC,KAAK,KAAM,QAAO,EAAE,SAAS,OAAO,OAAO,kBAAkB;AAElE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS,EAAE,QAAQ,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,MAAM;AAAA,MAC1D;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,aAAwC;AAC5C,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK,QAAQ;AAClD,UAAI,SAAS,CAAC,KAAK,KAAM,QAAO;AAChC,aAAO,EAAE,QAAQ,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,MAAM;AAAA,IACxD;AAAA,IAEA,MAAM,SAAS;AACb,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,OAAO,KAAK,QAAQ;AAAA,IAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAiBA,MAAM,qBAAqB,EAAE,MAAM,MAAM,WAAW,KAAK,GAAuB;AAC9E,YAAM,SAAS,MAAM,cAAc,KAAK;AAExC,UAAI,MAAM;AACR,cAAM,aAAa,IAAI,gBAAgB,IAAI;AAC3C,cAAM,eAAe,WAAW,IAAI,cAAc;AAClD,cAAM,gBAAgB,WAAW,IAAI,eAAe;AACpD,cAAM,WAAW,WAAW,IAAI,MAAM,KAAK;AAC3C,YAAI,CAAC,gBAAgB,CAAC,eAAe;AACnC,iBAAO,EAAE,SAAS,OAAO,OAAO,uCAAuC;AAAA,QACzE;AACA,cAAM,EAAE,MAAM,IAAI,MAAM,OAAO,KAAK,WAAW,EAAE,cAAc,cAAc,CAAC;AAC9E,YAAI,MAAO,QAAO,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ;AACzD,eAAO,EAAE,SAAS,MAAM,eAAe,iBAAiB,QAAQ,EAAE;AAAA,MACpE;AAEA,UAAI,MAAM;AACR,cAAM,EAAE,MAAM,IAAI,MAAM,OAAO,KAAK,uBAAuB,IAAI;AAC/D,YAAI,MAAO,QAAO,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ;AACzD,eAAO,EAAE,SAAS,MAAM,eAAe,iBAAiB,IAAI,EAAE;AAAA,MAChE;AAEA,UAAI,aAAa,MAAM;AACrB,cAAM,EAAE,MAAM,IAAI,MAAM,OAAO,KAAK,UAAU;AAAA,UAC5C;AAAA,UACA,YAAY;AAAA,QACd,CAAC;AACD,YAAI,MAAO,QAAO,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ;AACzD,eAAO,EAAE,SAAS,MAAM,eAAe,iBAAiB,IAAI,EAAE;AAAA,MAChE;AAEA,aAAO,EAAE,SAAS,OAAO,OAAO,gCAAgC;AAAA,IAClE;AAAA,IAEA,MAAM,YAAY,UAAkB;AAClC,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,IAAI,MAAM,OAAO,KAAK,WAAW,EAAE,SAAS,CAAC;AAC3D,aAAO,QAAQ,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ,IAAI,EAAE,SAAS,KAAK;AAAA,IAC5E;AAAA,EACF;AAKA,MAAI,MAAM,gBAAgB;AAYxB,YAAQ,mBAAmB,OAAO,OAAO,EAAE,OAAO,MAAM;AACtD,YAAM,QAAQ,YAAY,KAAK;AAE/B,YAAM,MAAM,MAAM,MAAM,KAAK,MAAM,aAAa,EAAE,MAAM,UAAU,MAAM,CAAC;AACzE,UAAI,IAAI,OAAO;AAKb,YAAI,uBAAuB,IAAI,KAAK,GAAG;AACrC,iBAAO,EAAE,SAAS,MAAM,MAAM,IAAI,IAAI,eAAe,MAAM,EAAE,SAAS,GAAG,WAAW,MAAM;AAAA,QAC5F;AACA,eAAO,EAAE,SAAS,OAAO,OAAO,IAAI,MAAM,QAAQ;AAAA,MACpD;AACA,YAAM,SAAS,IAAI,MAAM,YAAY;AACrC,UAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,+BAA+B;AAE5E,aAAO,EAAE,SAAS,MAAM,MAAM,UAAU,QAAQ,QAAQ,QAAQ,GAAG,WAAW,KAAK;AAAA,IACrF;AAEA,YAAQ,0BAA0B,OAAO,OAAO,EAAE,OAAO,MAAM;AAC7D,YAAM,MAAM,MAAM,YAAY,KAAK,EAAE,KAAK,MAAM,aAAa,EAAE,MAAM,YAAY,MAAM,CAAC;AACxF,YAAM,SAAS,IAAI,MAAM,YAAY;AACrC,UAAI,IAAI,SAAS,CAAC,QAAQ;AACxB,eAAO,EAAE,SAAS,OAAO,OAAO,IAAI,OAAO,WAAW,8BAA8B;AAAA,MACtF;AACA,aAAO,EAAE,SAAS,MAAM,MAAM,UAAU,QAAQ,QAAQ,UAAU,EAAE;AAAA,IACtE;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/dist/adapters/supabase/client.js

@@ -28,7 +28,12 @@ async function sessionClient(creds) {
       setAll: (cookiesToSet) => {
         try {
           cookiesToSet.forEach(
-            ({ name, value, options }) => cookieStore.set(name, value, options)
+            ({ name, value, options }) => cookieStore.set(name, value, {
+              ...options,
+              httpOnly: true,
+              sameSite: "lax",
+              secure: process.env.NODE_ENV === "production"
+            })
           );
         } catch {
         }

package/dist/adapters/supabase/client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/adapters/supabase/client.ts"],"sourcesContent":["import { createServerClient } from \"@supabase/ssr\";\nimport { createClient, type SupabaseClient } from \"@supabase/supabase-js\";\nimport { cookies } from \"next/headers\";\n\n/**\n * Credentials are passed in, never read from process.env here.\n *\n * An adapter that reaches into the environment hides its own requirements —\n * nothing in the type signature says which vars must exist, so a missing or\n * stale one surfaces as a runtime fetch failure. It also makes two sites on\n * two different projects impossible, since the credentials become global.\n */\nexport interface SupabaseCredentials {\n  url: string;\n  anonKey: string;\n  /**\n   * Optional, and only for branded invite emails (see createInviteLink): it\n   * lets Guardrail create an account and mint a sign-in link server-side, so\n   * the site can send the email itself. Project-wide by Supabase's design —\n   * it bypasses RLS and reaches every schema — so read it from a server-only\n   * environment variable (never NEXT_PUBLIC_), and it is used for nothing else.\n   */\n  serviceRoleKey?: string;\n}\n\nexport function assertCredentials(creds: SupabaseCredentials): void {\n  if (!creds?.url || !creds?.anonKey) {\n    throw new Error(\n      \"Guardrail (Supabase): both `url` and `anonKey` are required.\",\n    );\n  }\n}\n\nconst anonClients = new Map<string, SupabaseClient>();\n\n/**\n * Cookie-free client for reads. A single cookies() call in the render path\n * opts the whole route out of static generation, so public content reads must\n * never touch them.\n */\nexport function anonClient(creds: SupabaseCredentials): SupabaseClient {\n  const key = `${creds.url}::${creds.anonKey}`;\n  let client = anonClients.get(key);\n  if (!client) {\n    client = createClient(creds.url, creds.anonKey, {\n      auth: { persistSession: false, autoRefreshToken: false },\n    });\n    anonClients.set(key, client);\n  }\n  return client;\n}\n\n/**\n * Request-scoped client carrying the editor's auth cookies, so writes run as\n * the signed-in user and RLS can enforce authorization independently.\n */\nexport async function sessionClient(\n  creds: SupabaseCredentials,\n): Promise<SupabaseClient> {\n  const cookieStore = await cookies();\n\n  return createServerClient(creds.url, creds.anonKey, {\n    cookies: {\n      getAll: () => cookieStore.getAll(),\n      setAll: (cookiesToSet) => {\n        try {\n          cookiesToSet.forEach(({ name, value, options }) =>\n            cookieStore.set(name, value, options),\n          );\n        } catch {\n          // Read-only cookies in a Server Component; safe to ignore when a\n          // Server Action or middleware refreshes the session.\n        }\n      },\n    },\n  });\n}\n\n/**\n * Service-role client, for the one admin call Guardrail makes with it\n * (generating an invite link). Throws if no key was configured — callers are\n * expected to have checked, since the adapter only exposes that capability when\n * one was.\n */\nexport function adminClient(creds: SupabaseCredentials): SupabaseClient {\n  if (!creds.serviceRoleKey) {\n    throw new Error(\"Guardrail (Supabase): serviceRoleKey is not configured.\");\n  }\n  return createClient(creds.url, creds.serviceRoleKey, {\n    auth: { persistSession: false, autoRefreshToken: false },\n  });\n}\n"],"mappings":"AAAA,SAAS,0BAA0B;AACnC,SAAS,oBAAyC;AAClD,SAAS,eAAe;AAuBjB,SAAS,kBAAkB,OAAkC;AAClE,MAAI,CAAC,OAAO,OAAO,CAAC,OAAO,SAAS;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,cAAc,oBAAI,IAA4B;AAO7C,SAAS,WAAW,OAA4C;AACrE,QAAM,MAAM,GAAG,MAAM,GAAG,KAAK,MAAM,OAAO;AAC1C,MAAI,SAAS,YAAY,IAAI,GAAG;AAChC,MAAI,CAAC,QAAQ;AACX,aAAS,aAAa,MAAM,KAAK,MAAM,SAAS;AAAA,MAC9C,MAAM,EAAE,gBAAgB,OAAO,kBAAkB,MAAM;AAAA,IACzD,CAAC;AACD,gBAAY,IAAI,KAAK,MAAM;AAAA,EAC7B;AACA,SAAO;AACT;AAMA,eAAsB,cACpB,OACyB;AACzB,QAAM,cAAc,MAAM,QAAQ;AAElC,SAAO,mBAAmB,MAAM,KAAK,MAAM,SAAS;AAAA,IAClD,SAAS;AAAA,MACP,QAAQ,MAAM,YAAY,OAAO;AAAA,MACjC,QAAQ,CAAC,iBAAiB;AACxB,YAAI;AACF,uBAAa;AAAA,YAAQ,CAAC,EAAE,MAAM,OAAO,QAAQ,MAC3C,YAAY,IAAI,MAAM,OAAO,OAAO;AAAA,UACtC;AAAA,QACF,QAAQ;AAAA,QAGR;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAQO,SAAS,YAAY,OAA4C;AACtE,MAAI,CAAC,MAAM,gBAAgB;AACzB,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,SAAO,aAAa,MAAM,KAAK,MAAM,gBAAgB;AAAA,IACnD,MAAM,EAAE,gBAAgB,OAAO,kBAAkB,MAAM;AAAA,EACzD,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../../../src/adapters/supabase/client.ts"],"sourcesContent":["import { createServerClient } from \"@supabase/ssr\";\nimport { createClient, type SupabaseClient } from \"@supabase/supabase-js\";\nimport { cookies } from \"next/headers\";\n\n/**\n * Credentials are passed in, never read from process.env here.\n *\n * An adapter that reaches into the environment hides its own requirements —\n * nothing in the type signature says which vars must exist, so a missing or\n * stale one surfaces as a runtime fetch failure. It also makes two sites on\n * two different projects impossible, since the credentials become global.\n */\nexport interface SupabaseCredentials {\n  url: string;\n  anonKey: string;\n  /**\n   * Optional, and only for branded invite emails (see createInviteLink): it\n   * lets Guardrail create an account and mint a sign-in link server-side, so\n   * the site can send the email itself. Project-wide by Supabase's design —\n   * it bypasses RLS and reaches every schema — so read it from a server-only\n   * environment variable (never NEXT_PUBLIC_), and it is used for nothing else.\n   */\n  serviceRoleKey?: string;\n}\n\nexport function assertCredentials(creds: SupabaseCredentials): void {\n  if (!creds?.url || !creds?.anonKey) {\n    throw new Error(\n      \"Guardrail (Supabase): both `url` and `anonKey` are required.\",\n    );\n  }\n}\n\nconst anonClients = new Map<string, SupabaseClient>();\n\n/**\n * Cookie-free client for reads. A single cookies() call in the render path\n * opts the whole route out of static generation, so public content reads must\n * never touch them.\n */\nexport function anonClient(creds: SupabaseCredentials): SupabaseClient {\n  const key = `${creds.url}::${creds.anonKey}`;\n  let client = anonClients.get(key);\n  if (!client) {\n    client = createClient(creds.url, creds.anonKey, {\n      auth: { persistSession: false, autoRefreshToken: false },\n    });\n    anonClients.set(key, client);\n  }\n  return client;\n}\n\n/**\n * Request-scoped client carrying the editor's auth cookies, so writes run as\n * the signed-in user and RLS can enforce authorization independently.\n */\nexport async function sessionClient(\n  creds: SupabaseCredentials,\n): Promise<SupabaseClient> {\n  const cookieStore = await cookies();\n\n  return createServerClient(creds.url, creds.anonKey, {\n    cookies: {\n      getAll: () => cookieStore.getAll(),\n      setAll: (cookiesToSet) => {\n        try {\n          // The session is only ever read on the server (there's no browser\n          // Supabase client), so nothing in the page needs to see it: HttpOnly\n          // keeps an injected script from lifting the tokens, and Secure keeps\n          // them off plain-HTTP requests. @supabase/ssr's defaults are neither.\n          cookiesToSet.forEach(({ name, value, options }) =>\n            cookieStore.set(name, value, {\n              ...options,\n              httpOnly: true,\n              sameSite: \"lax\",\n              secure: process.env.NODE_ENV === \"production\",\n            }),\n          );\n        } catch {\n          // Read-only cookies in a Server Component; safe to ignore when a\n          // Server Action or middleware refreshes the session.\n        }\n      },\n    },\n  });\n}\n\n/**\n * Service-role client, for the one admin call Guardrail makes with it\n * (generating an invite link). Throws if no key was configured — callers are\n * expected to have checked, since the adapter only exposes that capability when\n * one was.\n */\nexport function adminClient(creds: SupabaseCredentials): SupabaseClient {\n  if (!creds.serviceRoleKey) {\n    throw new Error(\"Guardrail (Supabase): serviceRoleKey is not configured.\");\n  }\n  return createClient(creds.url, creds.serviceRoleKey, {\n    auth: { persistSession: false, autoRefreshToken: false },\n  });\n}\n"],"mappings":"AAAA,SAAS,0BAA0B;AACnC,SAAS,oBAAyC;AAClD,SAAS,eAAe;AAuBjB,SAAS,kBAAkB,OAAkC;AAClE,MAAI,CAAC,OAAO,OAAO,CAAC,OAAO,SAAS;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,cAAc,oBAAI,IAA4B;AAO7C,SAAS,WAAW,OAA4C;AACrE,QAAM,MAAM,GAAG,MAAM,GAAG,KAAK,MAAM,OAAO;AAC1C,MAAI,SAAS,YAAY,IAAI,GAAG;AAChC,MAAI,CAAC,QAAQ;AACX,aAAS,aAAa,MAAM,KAAK,MAAM,SAAS;AAAA,MAC9C,MAAM,EAAE,gBAAgB,OAAO,kBAAkB,MAAM;AAAA,IACzD,CAAC;AACD,gBAAY,IAAI,KAAK,MAAM;AAAA,EAC7B;AACA,SAAO;AACT;AAMA,eAAsB,cACpB,OACyB;AACzB,QAAM,cAAc,MAAM,QAAQ;AAElC,SAAO,mBAAmB,MAAM,KAAK,MAAM,SAAS;AAAA,IAClD,SAAS;AAAA,MACP,QAAQ,MAAM,YAAY,OAAO;AAAA,MACjC,QAAQ,CAAC,iBAAiB;AACxB,YAAI;AAKF,uBAAa;AAAA,YAAQ,CAAC,EAAE,MAAM,OAAO,QAAQ,MAC3C,YAAY,IAAI,MAAM,OAAO;AAAA,cAC3B,GAAG;AAAA,cACH,UAAU;AAAA,cACV,UAAU;AAAA,cACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,YACnC,CAAC;AAAA,UACH;AAAA,QACF,QAAQ;AAAA,QAGR;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAQO,SAAS,YAAY,OAA4C;AACtE,MAAI,CAAC,MAAM,gBAAgB;AACzB,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,SAAO,aAAa,MAAM,KAAK,MAAM,gBAAgB;AAAA,IACnD,MAAM,EAAE,gBAAgB,OAAO,kBAAkB,MAAM;AAAA,EACzD,CAAC;AACH;","names":[]}

package/dist/adapters/supabase/confirm.d.ts

@@ -2,20 +2,20 @@ import { SupabaseCredentials } from './client.js';
 import '@supabase/supabase-js';
 
 /**
- * Route handler that turns an emailed link into a session.
+ * Route handler for emailed links of the older `/guardrail/confirm?token_hash=…`
+ * shape. Guardrail's own links no longer point here — they carry the token in
+ * the URL fragment of the site root, and need no route at all — but links
+ * already sitting in inboxes still do, so this keeps them working.
  *
- * Mount it in the app:
+ * It deliberately does NOT verify the token. A GET that spends a one-time token
+ * is burned by anything that prefetches links (email scanners, link previews)
+ * and can be used to sign a victim into someone else's session. Instead it
+ * hands the token to the browser in the URL fragment, where the always-mounted
+ * AuthRedirectSync completes it — the same path a fresh link takes.
+ *
+ * Mount it in the app only if you have links in the wild:
  *   // app/guardrail/confirm/route.ts
  *   export const GET = supabaseConfirmRoute({ url, anonKey });
- *
- * verifyOtp with a token_hash works in whichever browser opens the link, unlike
- * a PKCE code exchange. Once the session cookie is set, the next render claims
- * any pending invitation addressed to that email.
- *
- * An invite, magic link, or recovery link also sets the same "needs a
- * password" flag the in-page redirect handler does, so the person lands on the
- * Set Password prompt rather than silently signed in with no way to log in
- * next time — both ways of completing a link behave the same.
  */
 declare function supabaseConfirmRoute(creds: SupabaseCredentials, options?: {
     next?: string;

package/dist/adapters/supabase/confirm.js

@@ -1,10 +1,13 @@
-import { cookies } from "next/headers";
-import { redirect } from "next/navigation";
-import { assertCredentials, sessionClient } from "./client";
-import { needsPasswordFor } from "./auth";
-import { GR_COOKIES, GR_NEEDS_PASSWORD_TTL_SECONDS } from "../../core/defs";
+import { assertCredentials } from "./client";
 function safePath(value, fallback) {
   if (!value || !value.startsWith("/") || value.startsWith("//")) return fallback;
+  if (/[\\\u0000-\u001f\u007f]/.test(value)) return fallback;
+  try {
+    const base = "http://localhost";
+    if (new URL(value, base).origin !== base) return fallback;
+  } catch {
+    return fallback;
+  }
   return value;
 }
 function supabaseConfirmRoute(creds, options = {}) {
@@ -16,20 +19,13 @@ function supabaseConfirmRoute(creds, options = {}) {
     const type = url.searchParams.get("type");
     const next = safePath(url.searchParams.get("next"), fallback);
     if (tokenHash && type) {
-      const client = await sessionClient(creds);
-      const { error } = await client.auth.verifyOtp({ type, token_hash: tokenHash });
-      if (!error) {
-        if (needsPasswordFor(type)) {
-          (await cookies()).set(GR_COOKIES.NEEDS_PASSWORD, "true", {
-            path: "/",
-            maxAge: GR_NEEDS_PASSWORD_TTL_SECONDS
-          });
-        }
-        redirect(next);
-      }
-      console.error("Guardrail (Supabase): link verification failed", error.message);
+      const fragment = new URLSearchParams({ token_hash: tokenHash, type }).toString();
+      return Response.redirect(new URL(`${next.split("#")[0]}#${fragment}`, url), 303);
     }
-    redirect(`${fallback}${fallback.includes("?") ? "&" : "?"}gr_auth_error=link`);
+    return Response.redirect(
+      new URL(`${fallback}${fallback.includes("?") ? "&" : "?"}gr_auth_error=link`, url),
+      303
+    );
   };
 }
 export {

package/dist/adapters/supabase/confirm.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/adapters/supabase/confirm.ts"],"sourcesContent":["import type { EmailOtpType } from \"@supabase/supabase-js\";\nimport { cookies } from \"next/headers\";\nimport { redirect } from \"next/navigation\";\nimport { assertCredentials, sessionClient } from \"./client\";\nimport type { SupabaseCredentials } from \"./client\";\nimport { needsPasswordFor } from \"./auth\";\nimport { GR_COOKIES, GR_NEEDS_PASSWORD_TTL_SECONDS } from \"../../core/defs\";\n\n/**\n * Only same-origin paths. Accepting an arbitrary `next` would make this route\n * an open redirect — a signed-in link on your domain that forwards anywhere.\n */\nfunction safePath(value: string | null, fallback: string): string {\n  if (!value || !value.startsWith(\"/\") || value.startsWith(\"//\")) return fallback;\n  return value;\n}\n\n/**\n * Route handler that turns an emailed link into a session.\n *\n * Mount it in the app:\n *   // app/guardrail/confirm/route.ts\n *   export const GET = supabaseConfirmRoute({ url, anonKey });\n *\n * verifyOtp with a token_hash works in whichever browser opens the link, unlike\n * a PKCE code exchange. Once the session cookie is set, the next render claims\n * any pending invitation addressed to that email.\n *\n * An invite, magic link, or recovery link also sets the same \"needs a\n * password\" flag the in-page redirect handler does, so the person lands on the\n * Set Password prompt rather than silently signed in with no way to log in\n * next time — both ways of completing a link behave the same.\n */\nexport function supabaseConfirmRoute(\n  creds: SupabaseCredentials,\n  options: { next?: string } = {},\n) {\n  assertCredentials(creds);\n  const fallback = options.next ?? \"/?edit=true\";\n\n  return async function GET(request: Request): Promise<Response> {\n    const url = new URL(request.url);\n    const tokenHash = url.searchParams.get(\"token_hash\");\n    const type = url.searchParams.get(\"type\") as EmailOtpType | null;\n    const next = safePath(url.searchParams.get(\"next\"), fallback);\n\n    if (tokenHash && type) {\n      const client = await sessionClient(creds);\n      const { error } = await client.auth.verifyOtp({ type, token_hash: tokenHash });\n      if (!error) {\n        if (needsPasswordFor(type)) {\n          (await cookies()).set(GR_COOKIES.NEEDS_PASSWORD, \"true\", {\n            path: \"/\",\n            maxAge: GR_NEEDS_PASSWORD_TTL_SECONDS,\n          });\n        }\n        redirect(next);\n      }\n      console.error(\"Guardrail (Supabase): link verification failed\", error.message);\n    }\n\n    redirect(`${fallback}${fallback.includes(\"?\") ? \"&\" : \"?\"}gr_auth_error=link`);\n  };\n}\n"],"mappings":"AACA,SAAS,eAAe;AACxB,SAAS,gBAAgB;AACzB,SAAS,mBAAmB,qBAAqB;AAEjD,SAAS,wBAAwB;AACjC,SAAS,YAAY,qCAAqC;AAM1D,SAAS,SAAS,OAAsB,UAA0B;AAChE,MAAI,CAAC,SAAS,CAAC,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,EAAG,QAAO;AACvE,SAAO;AACT;AAkBO,SAAS,qBACd,OACA,UAA6B,CAAC,GAC9B;AACA,oBAAkB,KAAK;AACvB,QAAM,WAAW,QAAQ,QAAQ;AAEjC,SAAO,eAAe,IAAI,SAAqC;AAC7D,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,YAAY,IAAI,aAAa,IAAI,YAAY;AACnD,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAM,OAAO,SAAS,IAAI,aAAa,IAAI,MAAM,GAAG,QAAQ;AAE5D,QAAI,aAAa,MAAM;AACrB,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,IAAI,MAAM,OAAO,KAAK,UAAU,EAAE,MAAM,YAAY,UAAU,CAAC;AAC7E,UAAI,CAAC,OAAO;AACV,YAAI,iBAAiB,IAAI,GAAG;AAC1B,WAAC,MAAM,QAAQ,GAAG,IAAI,WAAW,gBAAgB,QAAQ;AAAA,YACvD,MAAM;AAAA,YACN,QAAQ;AAAA,UACV,CAAC;AAAA,QACH;AACA,iBAAS,IAAI;AAAA,MACf;AACA,cAAQ,MAAM,kDAAkD,MAAM,OAAO;AAAA,IAC/E;AAEA,aAAS,GAAG,QAAQ,GAAG,SAAS,SAAS,GAAG,IAAI,MAAM,GAAG,oBAAoB;AAAA,EAC/E;AACF;","names":[]}
+{"version":3,"sources":["../../../src/adapters/supabase/confirm.ts"],"sourcesContent":["import { assertCredentials } from \"./client\";\nimport type { SupabaseCredentials } from \"./client\";\n\n/**\n * Only same-origin paths. Accepting an arbitrary `next` would make this route\n * an open redirect — a signed-in link on your domain that forwards anywhere.\n */\nfunction safePath(value: string | null, fallback: string): string {\n  if (!value || !value.startsWith(\"/\") || value.startsWith(\"//\")) return fallback;\n  // Browsers treat \"\\\" as \"/\" and drop tab/CR/LF inside a URL, so \"/\\evil.com\"\n  // and \"/\\t/evil.com\" both end up as \"//evil.com\". Refuse them outright, then\n  // confirm by parsing that the result still lands on this origin.\n  if (/[\\\\\\u0000-\\u001f\\u007f]/.test(value)) return fallback;\n  try {\n    const base = \"http://localhost\";\n    if (new URL(value, base).origin !== base) return fallback;\n  } catch {\n    return fallback;\n  }\n  return value;\n}\n\n/**\n * Route handler for emailed links of the older `/guardrail/confirm?token_hash=…`\n * shape. Guardrail's own links no longer point here — they carry the token in\n * the URL fragment of the site root, and need no route at all — but links\n * already sitting in inboxes still do, so this keeps them working.\n *\n * It deliberately does NOT verify the token. A GET that spends a one-time token\n * is burned by anything that prefetches links (email scanners, link previews)\n * and can be used to sign a victim into someone else's session. Instead it\n * hands the token to the browser in the URL fragment, where the always-mounted\n * AuthRedirectSync completes it — the same path a fresh link takes.\n *\n * Mount it in the app only if you have links in the wild:\n *   // app/guardrail/confirm/route.ts\n *   export const GET = supabaseConfirmRoute({ url, anonKey });\n */\nexport function supabaseConfirmRoute(\n  creds: SupabaseCredentials,\n  options: { next?: string } = {},\n) {\n  assertCredentials(creds);\n  const fallback = options.next ?? \"/?edit=true\";\n\n  return async function GET(request: Request): Promise<Response> {\n    const url = new URL(request.url);\n    const tokenHash = url.searchParams.get(\"token_hash\");\n    const type = url.searchParams.get(\"type\");\n    const next = safePath(url.searchParams.get(\"next\"), fallback);\n\n    if (tokenHash && type) {\n      const fragment = new URLSearchParams({ token_hash: tokenHash, type }).toString();\n      return Response.redirect(new URL(`${next.split(\"#\")[0]}#${fragment}`, url), 303);\n    }\n\n    return Response.redirect(\n      new URL(`${fallback}${fallback.includes(\"?\") ? \"&\" : \"?\"}gr_auth_error=link`, url),\n      303,\n    );\n  };\n}\n"],"mappings":"AAAA,SAAS,yBAAyB;AAOlC,SAAS,SAAS,OAAsB,UAA0B;AAChE,MAAI,CAAC,SAAS,CAAC,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,EAAG,QAAO;AAIvE,MAAI,0BAA0B,KAAK,KAAK,EAAG,QAAO;AAClD,MAAI;AACF,UAAM,OAAO;AACb,QAAI,IAAI,IAAI,OAAO,IAAI,EAAE,WAAW,KAAM,QAAO;AAAA,EACnD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAkBO,SAAS,qBACd,OACA,UAA6B,CAAC,GAC9B;AACA,oBAAkB,KAAK;AACvB,QAAM,WAAW,QAAQ,QAAQ;AAEjC,SAAO,eAAe,IAAI,SAAqC;AAC7D,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,YAAY,IAAI,aAAa,IAAI,YAAY;AACnD,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAM,OAAO,SAAS,IAAI,aAAa,IAAI,MAAM,GAAG,QAAQ;AAE5D,QAAI,aAAa,MAAM;AACrB,YAAM,WAAW,IAAI,gBAAgB,EAAE,YAAY,WAAW,KAAK,CAAC,EAAE,SAAS;AAC/E,aAAO,SAAS,SAAS,IAAI,IAAI,GAAG,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,IAAI,QAAQ,IAAI,GAAG,GAAG,GAAG;AAAA,IACjF;AAEA,WAAO,SAAS;AAAA,MACd,IAAI,IAAI,GAAG,QAAQ,GAAG,SAAS,SAAS,GAAG,IAAI,MAAM,GAAG,sBAAsB,GAAG;AAAA,MACjF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/adapters/supabase/index.d.ts

@@ -1,10 +1,11 @@
-import { GRDBAdapter, GRAuthAdapter, GRMembershipAdapter, GRRepeaterAdapter } from '../../core/adapter-types.js';
+import { GRDBAdapter, GRAuthAdapter, GRMembershipAdapter, GRRepeaterAdapter, GRRateLimiter } from '../../core/adapter-types.js';
 export { supabaseDB } from './db.js';
 export { supabaseAuth } from './auth.js';
 export { supabaseMembers } from './members.js';
 export { supabaseConfirmRoute } from './confirm.js';
 export { DEFAULT_BUCKET, SupabaseStorageOptions, supabaseStorage } from './storage.js';
 export { supabaseRepeaters } from './repeaters.js';
+export { supabaseRateLimit } from './rateLimit.js';
 import { SupabaseCredentials } from './client.js';
 import 'react';
 import '../../core/types.js';
@@ -20,6 +21,7 @@ declare function supabaseAdapters(creds: SupabaseCredentials): {
     auth: GRAuthAdapter;
     members: GRMembershipAdapter;
     repeaters: GRRepeaterAdapter;
+    rateLimit?: GRRateLimiter | undefined;
 };
 
 export { SupabaseCredentials, supabaseAdapters };

package/dist/adapters/supabase/index.js

@@ -4,12 +4,16 @@ import { supabaseMembers } from "./members";
 import { supabaseConfirmRoute } from "./confirm";
 import { supabaseStorage, DEFAULT_BUCKET } from "./storage";
 import { supabaseRepeaters } from "./repeaters";
+import { supabaseRateLimit } from "./rateLimit";
 import { supabaseDB as supabaseDB2 } from "./db";
 import { supabaseAuth as supabaseAuth2 } from "./auth";
 import { supabaseMembers as supabaseMembers2 } from "./members";
 import { supabaseRepeaters as supabaseRepeaters2 } from "./repeaters";
+import { supabaseRateLimit as supabaseRateLimit2 } from "./rateLimit";
 function supabaseAdapters(creds) {
+  const rateLimit = supabaseRateLimit2(creds);
   return {
+    ...rateLimit ? { rateLimit } : {},
     db: supabaseDB2(creds),
     auth: supabaseAuth2(creds),
     members: supabaseMembers2(creds),
@@ -23,6 +27,7 @@ export {
   supabaseConfirmRoute,
   supabaseDB,
   supabaseMembers,
+  supabaseRateLimit,
   supabaseRepeaters,
   supabaseStorage
 };

package/dist/adapters/supabase/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/adapters/supabase/index.ts"],"sourcesContent":["export { supabaseDB } from \"./db\";\nexport { supabaseAuth } from \"./auth\";\nexport { supabaseMembers } from \"./members\";\nexport { supabaseConfirmRoute } from \"./confirm\";\nexport { supabaseStorage, DEFAULT_BUCKET } from \"./storage\";\nexport { supabaseRepeaters } from \"./repeaters\";\nexport type { SupabaseStorageOptions } from \"./storage\";\nexport type { SupabaseCredentials } from \"./client\";\n\nimport { supabaseDB } from \"./db\";\nimport { supabaseAuth } from \"./auth\";\nimport { supabaseMembers } from \"./members\";\nimport { supabaseRepeaters } from \"./repeaters\";\nimport type { SupabaseCredentials } from \"./client\";\n\n/**\n * All three slots backed by one Supabase project. Use the individual factories\n * instead when mixing backends — Supabase for content, another provider for\n * identity, say.\n */\nexport function supabaseAdapters(creds: SupabaseCredentials) {\n  return {\n    db: supabaseDB(creds),\n    auth: supabaseAuth(creds),\n    members: supabaseMembers(creds),\n    repeaters: supabaseRepeaters(creds),\n  };\n}\n"],"mappings":"AAAA,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAChC,SAAS,4BAA4B;AACrC,SAAS,iBAAiB,sBAAsB;AAChD,SAAS,yBAAyB;AAIlC,SAAS,cAAAA,mBAAkB;AAC3B,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,mBAAAC,wBAAuB;AAChC,SAAS,qBAAAC,0BAAyB;AAQ3B,SAAS,iBAAiB,OAA4B;AAC3D,SAAO;AAAA,IACL,IAAIH,YAAW,KAAK;AAAA,IACpB,MAAMC,cAAa,KAAK;AAAA,IACxB,SAASC,iBAAgB,KAAK;AAAA,IAC9B,WAAWC,mBAAkB,KAAK;AAAA,EACpC;AACF;","names":["supabaseDB","supabaseAuth","supabaseMembers","supabaseRepeaters"]}
+{"version":3,"sources":["../../../src/adapters/supabase/index.ts"],"sourcesContent":["export { supabaseDB } from \"./db\";\nexport { supabaseAuth } from \"./auth\";\nexport { supabaseMembers } from \"./members\";\nexport { supabaseConfirmRoute } from \"./confirm\";\nexport { supabaseStorage, DEFAULT_BUCKET } from \"./storage\";\nexport { supabaseRepeaters } from \"./repeaters\";\nexport { supabaseRateLimit } from \"./rateLimit\";\nexport type { SupabaseStorageOptions } from \"./storage\";\nexport type { SupabaseCredentials } from \"./client\";\n\nimport { supabaseDB } from \"./db\";\nimport { supabaseAuth } from \"./auth\";\nimport { supabaseMembers } from \"./members\";\nimport { supabaseRepeaters } from \"./repeaters\";\nimport { supabaseRateLimit } from \"./rateLimit\";\nimport type { SupabaseCredentials } from \"./client\";\n\n/**\n * All three slots backed by one Supabase project. Use the individual factories\n * instead when mixing backends — Supabase for content, another provider for\n * identity, say.\n */\nexport function supabaseAdapters(creds: SupabaseCredentials) {\n  // Database-backed limits for sign-in, resets and the like, whenever there's a\n  // service-role key to make the call with. Without one the built-in in-memory\n  // limiter applies.\n  const rateLimit = supabaseRateLimit(creds);\n  return {\n    ...(rateLimit ? { rateLimit } : {}),\n    db: supabaseDB(creds),\n    auth: supabaseAuth(creds),\n    members: supabaseMembers(creds),\n    repeaters: supabaseRepeaters(creds),\n  };\n}\n"],"mappings":"AAAA,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAChC,SAAS,4BAA4B;AACrC,SAAS,iBAAiB,sBAAsB;AAChD,SAAS,yBAAyB;AAClC,SAAS,yBAAyB;AAIlC,SAAS,cAAAA,mBAAkB;AAC3B,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,mBAAAC,wBAAuB;AAChC,SAAS,qBAAAC,0BAAyB;AAClC,SAAS,qBAAAC,0BAAyB;AAQ3B,SAAS,iBAAiB,OAA4B;AAI3D,QAAM,YAAYA,mBAAkB,KAAK;AACzC,SAAO;AAAA,IACL,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IACjC,IAAIJ,YAAW,KAAK;AAAA,IACpB,MAAMC,cAAa,KAAK;AAAA,IACxB,SAASC,iBAAgB,KAAK;AAAA,IAC9B,WAAWC,mBAAkB,KAAK;AAAA,EACpC;AACF;","names":["supabaseDB","supabaseAuth","supabaseMembers","supabaseRepeaters","supabaseRateLimit"]}

package/dist/adapters/supabase/rateLimit.d.ts

@@ -0,0 +1,24 @@
+import { SupabaseCredentials } from './client.js';
+import { GRRateLimiter } from '../../core/adapter-types.js';
+import '@supabase/supabase-js';
+import 'react';
+import '../../core/types.js';
+
+/**
+ * Rate-limit counters in the project's own `guardrail` schema (see the
+ * rate_limits migration), so a site gets limits that hold across serverless
+ * instances with nothing extra to run. One database round trip per counted
+ * attempt — slower than Redis, and fine at the rate people sign in.
+ *
+ * Needs the service-role key, because sign-in and "Forgot password?" have no
+ * session to carry the call. Used automatically by supabaseAdapters() when
+ * that key is present.
+ *
+ * Failure handling: if the migration hasn't been applied yet (the function
+ * doesn't exist), this warns once and counts in memory instead — an upgrade
+ * that forgot the migration shouldn't lock everyone out of signing in. Any
+ * other database error throws, which blocks the request (fail closed).
+ */
+declare function supabaseRateLimit(creds: SupabaseCredentials): GRRateLimiter | undefined;
+
+export { supabaseRateLimit };