@jskit-ai/auth-provider-supabase-core 0.1.114 → 0.1.116

package/package.descriptor.mjs

@@ -1,7 +1,7 @@
 export default Object.freeze({
   "packageVersion": 1,
   "packageId": "@jskit-ai/auth-provider-supabase-core",
-  "version": "0.1.114",
+  "version": "0.1.116",
   "kind": "runtime",
   "options": {
     "auth-supabase-url": {
@@ -83,8 +83,8 @@ export default Object.freeze({
   "mutations": {
     "dependencies": {
       "runtime": {
-        "@jskit-ai/auth-core": "0.1.114",
-        "@jskit-ai/kernel": "0.1.116",
+        "@jskit-ai/auth-core": "0.1.116",
+        "@jskit-ai/kernel": "0.1.119",
         "dotenv": "^16.4.5",
         "@supabase/supabase-js": "^2.57.4",
         "jose": "^6.1.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/auth-provider-supabase-core",
-  "version": "0.1.114",
+  "version": "0.1.116",
   "type": "module",
   "scripts": {
     "test": "node --test"
@@ -12,8 +12,8 @@
     "./client": "./src/client/index.js"
   },
   "dependencies": {
-    "@jskit-ai/auth-core": "0.1.114",
-    "@jskit-ai/kernel": "0.1.116",
+    "@jskit-ai/auth-core": "0.1.116",
+    "@jskit-ai/kernel": "0.1.119",
     "json-rest-schema": "1.x.x",
     "jose": "^6.1.0",
     "@supabase/supabase-js": "^2.57.4",

package/src/server/lib/devAuthBootstrap.js

@@ -1,5 +1,10 @@
 import { AppError } from "@jskit-ai/kernel/server/runtime/errors";
 import { normalizeRecordId } from "@jskit-ai/kernel/shared/support/normalize";
+import {
+  assertDevAuthPolicy,
+  ensureDevAuthRuntimeAvailable,
+  resolveDevAuthPolicy
+} from "@jskit-ai/auth-core/server/devAuth";
 import { normalizeEmail } from "@jskit-ai/auth-core/server/utils";
 import { loadJose, isExpiredJwtError } from "./authJwt.js";
 
@@ -9,20 +14,6 @@ const DEFAULT_DEV_AUTH_ACCESS_TTL_SECONDS = 60 * 60 * 12;
 const DEFAULT_DEV_AUTH_REFRESH_TTL_SECONDS = 60 * 60 * 24 * 30;
 const encoder = new TextEncoder();
 
-function parseBoolean(value, fallback = false) {
-  const raw = String(value || "").trim().toLowerCase();
-  if (!raw) {
-    return fallback;
-  }
-  if (["1", "true", "yes", "on"].includes(raw)) {
-    return true;
-  }
-  if (["0", "false", "no", "off"].includes(raw)) {
-    return false;
-  }
-  return fallback;
-}
-
 function normalizePositiveInteger(value, fallback) {
   const parsed = Number.parseInt(String(value || "").trim(), 10);
   if (Number.isInteger(parsed) && parsed > 0) {
@@ -31,66 +22,6 @@ function normalizePositiveInteger(value, fallback) {
   return fallback;
 }
 
-function normalizeRequestHostname(request) {
-  const hostHeader = String(request?.headers?.host || "").trim();
-  if (!hostHeader) {
-    return "";
-  }
-
-  const firstHost = hostHeader.split(",")[0]?.trim();
-  if (!firstHost) {
-    return "";
-  }
-
-  try {
-    return new URL(`http://${firstHost}`).hostname.trim().toLowerCase();
-  } catch {
-    return firstHost
-      .replace(/^\[/, "")
-      .replace(/\]$/, "")
-      .split(":")[0]
-      .trim()
-      .toLowerCase();
-  }
-}
-
-function resolveDirectRemoteAddress(request) {
-  return String(request?.socket?.remoteAddress || request?.raw?.socket?.remoteAddress || "").trim();
-}
-
-function normalizeLoopbackIp(value) {
-  return String(value || "")
-    .trim()
-    .toLowerCase()
-    .replace(/^\[|\]$/g, "")
-    .replace(/^::ffff:/, "");
-}
-
-function isLoopbackIp(value) {
-  const normalized = normalizeLoopbackIp(value);
-  return normalized === "::1" || normalized === "127.0.0.1" || normalized.startsWith("127.");
-}
-
-function isLoopbackHostname(value) {
-  const normalized = String(value || "")
-    .trim()
-    .toLowerCase()
-    .replace(/^\[|\]$/g, "");
-  return (
-    normalized === "localhost" ||
-    normalized.endsWith(".localhost") ||
-    normalized === "::1" ||
-    normalized === "127.0.0.1"
-  );
-}
-
-function isLocalDevAuthRequest(request) {
-  return (
-    isLoopbackIp(resolveDirectRemoteAddress(request)) &&
-    isLoopbackHostname(normalizeRequestHostname(request))
-  );
-}
-
 function isDevAuthToken(token) {
   return String(token || "").trim().startsWith(DEV_AUTH_TOKEN_PREFIX);
 }
@@ -107,10 +38,13 @@ function resolveDevAuthConfig({
   accessTtlSeconds = DEFAULT_DEV_AUTH_ACCESS_TTL_SECONDS,
   refreshTtlSeconds = DEFAULT_DEV_AUTH_REFRESH_TTL_SECONDS
 } = {}) {
+  const policy = resolveDevAuthPolicy({
+    enabled,
+    nodeEnv,
+    secret
+  });
   return Object.freeze({
-    enabled: parseBoolean(enabled, false),
-    secret: String(secret || "").trim(),
-    isProduction: String(nodeEnv || "development").trim().toLowerCase() === "production",
+    ...policy,
     jwtAudience: String(jwtAudience || "authenticated").trim() || "authenticated",
     accessTtlSeconds: normalizePositiveInteger(accessTtlSeconds, DEFAULT_DEV_AUTH_ACCESS_TTL_SECONDS),
     refreshTtlSeconds: normalizePositiveInteger(refreshTtlSeconds, DEFAULT_DEV_AUTH_REFRESH_TTL_SECONDS)
@@ -118,16 +52,10 @@ function resolveDevAuthConfig({
 }
 
 function assertDevAuthBootstrapConfig(config, { userProfilesRepository = null } = {}) {
+  assertDevAuthPolicy(config);
   if (!config?.enabled) {
     return;
   }
-
-  if (config.isProduction) {
-    throw new Error("AUTH_DEV_BYPASS_ENABLED must not be enabled in production.");
-  }
-  if (!config.secret) {
-    throw new Error("AUTH_DEV_BYPASS_SECRET is required when AUTH_DEV_BYPASS_ENABLED=true.");
-  }
   if (
     !userProfilesRepository ||
     typeof userProfilesRepository.findById !== "function" ||
@@ -139,18 +67,6 @@ function assertDevAuthBootstrapConfig(config, { userProfilesRepository = null }
   }
 }
 
-function ensureDevAuthBootstrapAvailable(config, request) {
-  if (!config?.enabled || config?.isProduction) {
-    throw new AppError(404, "Not found.");
-  }
-  if (!config.secret) {
-    throw new AppError(500, "AUTH_DEV_BYPASS_SECRET is required when AUTH_DEV_BYPASS_ENABLED=true.");
-  }
-  if (!isLocalDevAuthRequest(request)) {
-    throw new AppError(403, "Dev auth bootstrap is only available from localhost.");
-  }
-}
-
 function buildProfileFromTokenClaims(payload) {
   const id = normalizeRecordId(payload?.sub, { fallback: null });
   const email = normalizeEmail(payload?.email || "");
@@ -322,7 +238,9 @@ async function authenticateDevAuthRequest(
     return null;
   }
 
-  if (!config?.enabled || config?.isProduction || !config?.secret || !isLocalDevAuthRequest(request)) {
+  try {
+    ensureDevAuthRuntimeAvailable(config, request);
+  } catch {
     return {
       authenticated: false,
       clearSession: true,
@@ -391,7 +309,6 @@ export {
   assertDevAuthBootstrapConfig,
   authenticateDevAuthRequest,
   createDevAuthSession,
-  ensureDevAuthBootstrapAvailable,
   isDevAuthToken,
   resolveDevAuthConfig,
   resolveDevAuthProfile

package/src/server/lib/index.js

@@ -1,2 +1 @@
 export { createService, __testables } from "./service.js";
-export { devLoginAsAction } from "./actions/auth.contributor.js";

package/src/server/lib/service.js

@@ -1,6 +1,7 @@
 import { createClient } from "@supabase/supabase-js";
 import { AppError } from "@jskit-ai/kernel/server/runtime/errors";
 import { normalizeAuthCapabilities } from "@jskit-ai/auth-core/shared/authCapabilities";
+import { ensureDevAuthExchangeAvailable } from "@jskit-ai/auth-core/server/devAuth";
 import { normalizeAuthActor, normalizeAuthResult } from "@jskit-ai/auth-core/server/authActor";
 import {
   AUTH_METHOD_PASSWORD_ID,
@@ -56,7 +57,6 @@ import {
   assertDevAuthBootstrapConfig,
   authenticateDevAuthRequest,
   createDevAuthSession,
-  ensureDevAuthBootstrapAvailable,
   isDevAuthToken,
   resolveDevAuthConfig,
   resolveDevAuthProfile
@@ -1032,7 +1032,7 @@ function createService(options) {
   }
 
   async function devLoginAs(request, input = {}) {
-    ensureDevAuthBootstrapAvailable(devAuthConfig, request);
+    ensureDevAuthExchangeAvailable(devAuthConfig, request);
     const rawProfile = await resolveDevAuthProfile(input, {
       userProfilesRepository,
       validationError

package/src/server/providers/AuthSupabaseServiceProvider.js

@@ -1,9 +1,8 @@
 import { resolveAllowedOriginsFromSurfaceDefinitions } from "@jskit-ai/kernel/shared/support/returnToPath";
-import { withActionDefaults } from "@jskit-ai/kernel/shared/actions";
 import { applyAuthServiceDecorators } from "@jskit-ai/auth-core/server/authServiceDecoratorRegistry";
 import { normalizeEmail } from "@jskit-ai/auth-core/server/utils";
 import { createService } from "../lib/service.js";
-import { devLoginAsAction } from "../lib/actions/auth.contributor.js";
+
 const PROFILE_MODE_PROVIDER = "provider";
 const PROFILE_MODE_STANDALONE = "standalone";
 const PROFILE_MODE_USERS = "users";
@@ -17,20 +16,6 @@ function splitCsv(value) {
     .filter(Boolean);
 }
 
-function parseBoolean(value, fallback = false) {
-  const raw = String(value || "").trim().toLowerCase();
-  if (!raw) {
-    return fallback;
-  }
-  if (["1", "true", "yes", "on"].includes(raw)) {
-    return true;
-  }
-  if (["0", "false", "no", "off"].includes(raw)) {
-    return false;
-  }
-  return fallback;
-}
-
 function normalizeRecord(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
@@ -103,18 +88,6 @@ function resolveAuthProfileMode(appConfig = {}) {
   );
 }
 
-function isDevAuthBypassEnabledForRegistration(env) {
-  if (!isDevAuthBypassRequested(env)) {
-    return false;
-  }
-
-  return String(env?.NODE_ENV || "development").trim().toLowerCase() !== "production";
-}
-
-function isDevAuthBypassRequested(env) {
-  return parseBoolean(env?.AUTH_DEV_BYPASS_ENABLED, false);
-}
-
 function createProviderIdentityProfileSyncService({ authProviderId = "supabase" } = {}) {
   return Object.freeze({
     async findByIdentity() {
@@ -201,17 +174,13 @@ function isDeferredJsonRestBootGap(app, error) {
 class AuthSupabaseServiceProvider {
   static id = "auth.provider.supabase";
 
-  static dependsOn = ["runtime.actions"];
-
   register(app) {
     if (
       !app ||
       typeof app.singleton !== "function" ||
-      typeof app.has !== "function" ||
-      typeof app.actions !== "function" ||
-      typeof app.service !== "function"
+      typeof app.has !== "function"
     ) {
-      throw new Error("AuthSupabaseServiceProvider requires application singleton()/has()/actions()/service().");
+      throw new Error("AuthSupabaseServiceProvider requires application singleton()/has().");
     }
 
     assertSelectedAuthProvider(resolveRuntimeEnv(app));
@@ -227,7 +196,6 @@ class AuthSupabaseServiceProvider {
       const authProvider = resolveAuthProviderConfig(env, appConfig);
       const repositories = resolveOptionalRepositories(scope);
       const userSettingsRepository = repositories.userSettingsRepository || null;
-      const devAuthBypassEnabled = parseBoolean(env.AUTH_DEV_BYPASS_ENABLED, false);
       const authProfileMode = resolveAuthProfileMode(appConfig);
       let userProfileSyncService = createProviderIdentityProfileSyncService({
         authProviderId: authProvider.id
@@ -258,7 +226,7 @@ class AuthSupabaseServiceProvider {
         userProfileSyncService,
         profileProjectionEnabled,
         userProfilesRepository: repositories.userProfilesRepository || null,
-        devAuthBypassEnabled,
+        devAuthBypassEnabled: env.AUTH_DEV_BYPASS_ENABLED,
         devAuthBypassSecret: String(env.AUTH_DEV_BYPASS_SECRET || "").trim(),
         devAuthAccessTtlSeconds: env.AUTH_DEV_ACCESS_TTL_SECONDS,
         devAuthRefreshTtlSeconds: env.AUTH_DEV_REFRESH_TTL_SECONDS
@@ -266,17 +234,6 @@ class AuthSupabaseServiceProvider {
 
       return applyAuthServiceDecorators(scope, authService);
     });
-
-    if (isDevAuthBypassEnabledForRegistration(resolveRuntimeEnv(app))) {
-      app.actions(
-        withActionDefaults([devLoginAsAction], {
-          domain: "auth",
-          dependencies: {
-            authService: "authService"
-          }
-        })
-      );
-    }
   }
 
   boot(app) {

package/test/devAuthBootstrap.test.js

@@ -2,6 +2,8 @@ import assert from "node:assert/strict";
 import test from "node:test";
 import { createService } from "../src/server/lib/index.js";
 
+const DEV_AUTH_SECRET = "dev-bootstrap-secret";
+
 function createProfile(overrides = {}) {
   return {
     id: "7",
@@ -64,6 +66,17 @@ function createLocalRequest(overrides = {}) {
   };
 }
 
+function createDevAuthExchangeRequest(overrides = {}) {
+  const request = createLocalRequest(overrides);
+  return {
+    ...request,
+    headers: {
+      ...request.headers,
+      "x-jskit-dev-auth-secret": DEV_AUTH_SECRET
+    }
+  };
+}
+
 function createServiceFixture(overrides = {}) {
   return createService({
     authProvider: {
@@ -75,7 +88,7 @@ function createServiceFixture(overrides = {}) {
     appPublicUrl: "http://localhost:5173",
     nodeEnv: "development",
     devAuthBypassEnabled: true,
-    devAuthBypassSecret: "dev-bootstrap-secret",
+    devAuthBypassSecret: DEV_AUTH_SECRET,
     userProfilesRepository: createUserProfilesRepository(),
     userProfileSyncService: createUserProfileSyncService(),
     ...overrides
@@ -84,7 +97,7 @@ function createServiceFixture(overrides = {}) {
 
 test("dev auth bootstrap can issue and authenticate a local session without Supabase", async () => {
   const authService = createServiceFixture();
-  const loginRequest = createLocalRequest();
+  const loginRequest = createDevAuthExchangeRequest();
 
   const loginResult = await authService.devLoginAs(loginRequest, {
     userId: "7"
@@ -111,7 +124,7 @@ test("dev auth bootstrap can issue and authenticate a local session without Supa
 
 test("dev auth bootstrap resolves security status without Supabase", async () => {
   const authService = createServiceFixture();
-  const loginResult = await authService.devLoginAs(createLocalRequest(), {
+  const loginResult = await authService.devLoginAs(createDevAuthExchangeRequest(), {
     userId: "7"
   });
 
@@ -153,7 +166,7 @@ test("dev auth security status rejects invalid dev sessions without recovery-lin
 test("dev auth bootstrap supports email lookup", async () => {
   const authService = createServiceFixture();
 
-  const result = await authService.devLoginAs(createLocalRequest(), {
+  const result = await authService.devLoginAs(createDevAuthExchangeRequest(), {
     email: "ADA@EXAMPLE.COM"
   });
 
@@ -161,6 +174,24 @@ test("dev auth bootstrap supports email lookup", async () => {
   assert.equal(result.profile.email, "ada@example.com");
 });
 
+test("dev auth bootstrap rejects a missing or incorrect exchange secret", async () => {
+  const authService = createServiceFixture();
+
+  await assert.rejects(
+    () => authService.devLoginAs(createLocalRequest(), { userId: "7" }),
+    /not authorized/
+  );
+  await assert.rejects(
+    () => authService.devLoginAs(createLocalRequest({
+      headers: {
+        host: "localhost:3000",
+        "x-jskit-dev-auth-secret": "wrong-secret"
+      }
+    }), { userId: "7" }),
+    /not authorized/
+  );
+});
+
 test("dev auth bootstrap canonicalizes producer profiles before returning them", async () => {
   const rawProfile = createProfile({
     email: " ADA@EXAMPLE.COM ",
@@ -177,7 +208,7 @@ test("dev auth bootstrap canonicalizes producer profiles before returning them",
     userProfilesRepository: createUserProfilesRepository(rawProfile)
   });
 
-  const loginResult = await authService.devLoginAs(createLocalRequest(), {
+  const loginResult = await authService.devLoginAs(createDevAuthExchangeRequest(), {
     userId: "7"
   });
 
@@ -195,14 +226,14 @@ test("dev auth bootstrap canonicalizes producer profiles before returning them",
 
 test("dev auth bootstrap rejects non-local requests and clears leaked dev sessions", async () => {
   const authService = createServiceFixture();
-  const issued = await authService.devLoginAs(createLocalRequest(), {
+  const issued = await authService.devLoginAs(createDevAuthExchangeRequest(), {
     userId: "7"
   });
 
   await assert.rejects(
     () =>
       authService.devLoginAs(
-        createLocalRequest({
+        createDevAuthExchangeRequest({
           ip: "203.0.113.10",
           hostname: "example.com",
           headers: { host: "example.com" }
@@ -232,7 +263,7 @@ test("dev auth bootstrap does not trust forwarded localhost headers", async () =
   await assert.rejects(
     () =>
       authService.devLoginAs(
-        createLocalRequest({
+        createDevAuthExchangeRequest({
           ip: "203.0.113.10",
           socket: {
             remoteAddress: "203.0.113.10"

package/test/providerRuntime.test.js

@@ -37,7 +37,7 @@ function isBootFailureWithCause(error, pattern) {
   );
 }
 
-test("auth supabase provider defaults to provider profile mode and contributes auth actions", async () => {
+test("auth supabase provider defaults to provider profile mode and composes with shared auth actions", async () => {
   const app = createApplication();
   app.instance("appConfig", createAppConfigFixture());
   app.instance("jskit.env", {
@@ -126,7 +126,7 @@ test("auth supabase provider defaults to provider profile mode and contributes a
   assert.equal(Array.isArray(definitions), true);
   assert.equal(definitions.some((definition) => definition.id === "auth.login.password"), true);
   assert.equal(definitions.some((definition) => definition.id === "auth.register.confirmation.resend"), true);
-  assert.equal(definitions.some((definition) => definition.id === "auth.dev.loginAs"), false);
+  assert.equal(definitions.some((definition) => definition.id === "auth.dev.loginAs"), true);
   const sessionRead = definitions.find((definition) => definition.id === "auth.session.read");
   assert.deepEqual(sessionRead?.surfaces, ["home", "console"]);
 });
@@ -204,7 +204,12 @@ test("auth supabase provider reports password method toggle only with persistent
   });
 
   await app.start({
-    providers: [ActionRuntimeServiceProvider, AuthSupabaseServiceProvider]
+    providers: [
+      ActionRuntimeServiceProvider,
+      AuthSupabaseServiceProvider,
+      AuthProviderServiceProvider,
+      AuthActionsServiceProvider
+    ]
   });
 
   const authService = app.make("authService");
@@ -348,7 +353,12 @@ test("auth supabase provider can boot dev auth without Supabase credentials", as
   });
 
   await app.start({
-    providers: [ActionRuntimeServiceProvider, AuthSupabaseServiceProvider]
+    providers: [
+      ActionRuntimeServiceProvider,
+      AuthSupabaseServiceProvider,
+      AuthProviderServiceProvider,
+      AuthActionsServiceProvider
+    ]
   });
 
   const authService = app.make("authService");

package/src/server/lib/actions/auth.contributor.js

@@ -1,21 +0,0 @@
-import { authDevLoginAsCommand } from "@jskit-ai/auth-core/shared/commands";
-import { requireRequestContext } from "@jskit-ai/auth-core/server/actions/auth.contributor";
-
-const devLoginAsAction = Object.freeze({
-  id: "auth.dev.loginAs",
-  version: 1,
-  kind: "command",
-  channels: ["api", "internal"],
-  surfacesFrom: "enabled",
-  input: authDevLoginAsCommand.operation.body,
-  idempotency: "none",
-  audit: {
-    actionName: "auth.dev.loginAs"
-  },
-  observability: {},
-  async execute(input, context, deps) {
-    return deps.authService.devLoginAs(requireRequestContext(context, "auth.dev.loginAs"), input);
-  }
-});
-
-export { devLoginAsAction };