@jskit-ai/auth-provider-supabase-core 0.1.156 → 0.1.157

package/package.json

@@ -1,19 +1,18 @@
 {
   "name": "@jskit-ai/auth-provider-supabase-core",
-  "version": "0.1.156",
+  "version": "0.1.157",
   "type": "module",
   "scripts": {
     "test": "node --test"
   },
   "exports": {
-    "./server/providers/AuthSupabaseServiceProvider": "./src/server/providers/AuthSupabaseServiceProvider.js",
-    "./server/providers/AuthProviderServiceProvider": "./src/server/providers/AuthProviderServiceProvider.js",
+    "./server/providers/AuthSupabaseProvider": "./src/server/providers/AuthSupabaseProvider.js",
     "./server/lib/index": "./src/server/lib/index.js",
     "./client": "./src/client/index.js"
   },
   "dependencies": {
-    "@jskit-ai/auth-core": "0.1.157",
-    "@jskit-ai/kernel": "0.1.159",
+    "@jskit-ai/auth-core": "0.1.158",
+    "@jskit-ai/kernel": "0.1.160",
     "@supabase/supabase-js": "^2.57.4",
     "jose": "^6.1.0",
     "json-rest-schema": "^1.0.17",
@@ -21,47 +20,22 @@
   },
   "jskit": {
     "kind": "runtime",
-    "options": {
-      "auth-supabase-url": {
-        "required": true,
-        "values": [],
-        "promptLabel": "Supabase URL",
-        "promptHint": "https://YOUR-PROJECT.supabase.co"
-      },
-      "auth-supabase-publishable-key": {
-        "required": true,
-        "values": [],
-        "promptLabel": "Supabase publishable key",
-        "promptHint": "sb_publishable_..."
-      },
-      "app-public-url": {
-        "required": true,
-        "values": [],
-        "defaultValue": "http://localhost:5173",
-        "promptLabel": "App public URL",
-        "promptHint": "Browser URL used for auth redirects"
-      }
-    },
     "capabilities": {
       "provides": [
-        "auth.provider.supabase",
-        "auth.provider"
+        "auth.service"
       ],
       "requires": [
-        "auth.access"
+        "auth.extensions",
+        "runtime.config",
+        "runtime.env"
       ]
     },
     "runtime": {
       "server": {
-        "providerEntrypoint": "src/server/providers/AuthSupabaseServiceProvider.js",
         "providers": [
           {
-            "entrypoint": "src/server/providers/AuthSupabaseServiceProvider.js",
-            "export": "AuthSupabaseServiceProvider"
-          },
-          {
-            "entrypoint": "src/server/providers/AuthProviderServiceProvider.js",
-            "export": "AuthProviderServiceProvider"
+            "entrypoint": "src/server/providers/AuthSupabaseProvider.js",
+            "export": "AuthSupabaseProvider"
           }
         ]
       }
@@ -70,12 +44,8 @@
       "apiSummary": {
         "surfaces": [
           {
-            "subpath": "./server/providers/AuthSupabaseServiceProvider",
-            "summary": "Exports the Supabase auth provider service provider."
-          },
-          {
-            "subpath": "./server/providers/AuthProviderServiceProvider",
-            "summary": "Exports the generic auth provider registration service provider."
+            "subpath": "./server/providers/AuthSupabaseProvider",
+            "summary": "Provides the selected Supabase authentication service through explicit runtime capabilities."
           },
           {
             "subpath": "./server/lib/index",
@@ -86,91 +56,8 @@
             "summary": "Exports no runtime API today (reserved client entrypoint)."
           }
         ],
-        "containerTokens": {
-          "server": [
-            "authService"
-          ],
-          "client": []
-        }
+        "capability": "auth.service"
       }
-    },
-    "mutations": {
-      "dependencies": {
-        "runtime": {
-          "@jskit-ai/auth-core": "0.1.157",
-          "@jskit-ai/kernel": "0.1.159",
-          "dotenv": "^16.4.5",
-          "@supabase/supabase-js": "^2.57.4",
-          "jose": "^6.1.0"
-        },
-        "dev": {}
-      },
-      "packageJson": {
-        "scripts": {}
-      },
-      "procfile": {},
-      "files": [],
-      "text": [
-        {
-          "file": ".env",
-          "op": "upsert-env",
-          "key": "AUTH_PROVIDER",
-          "value": "supabase",
-          "reason": "Select Supabase as the auth provider.",
-          "category": "runtime-config",
-          "id": "auth-provider"
-        },
-        {
-          "file": ".env",
-          "op": "upsert-env",
-          "key": "AUTH_SUPABASE_URL",
-          "value": "${option:auth-supabase-url}",
-          "reason": "Configure Supabase project URL for auth.",
-          "category": "runtime-config",
-          "id": "auth-supabase-url"
-        },
-        {
-          "file": ".env",
-          "op": "upsert-env",
-          "key": "AUTH_SUPABASE_PUBLISHABLE_KEY",
-          "value": "${option:auth-supabase-publishable-key}",
-          "reason": "Configure Supabase publishable key for auth.",
-          "category": "runtime-config",
-          "id": "auth-supabase-publishable-key"
-        },
-        {
-          "file": ".env",
-          "op": "upsert-env",
-          "key": "APP_PUBLIC_URL",
-          "value": "${option:app-public-url}",
-          "reason": "Configure application public URL for auth redirect flows.",
-          "category": "runtime-config",
-          "id": "auth-app-public-url"
-        },
-        {
-          "op": "append-text",
-          "file": "config/server.js",
-          "position": "bottom",
-          "skipIfContains": "config.auth.profileMode =",
-          "value": "\nconfig.auth ||= {};\nconfig.auth.profileMode = \"provider\";\n",
-          "reason": "Use provider-owned auth profiles until a users package enables users-backed sync.",
-          "category": "runtime-config",
-          "id": "auth-profile-mode-provider"
-        },
-        {
-          "op": "append-text",
-          "file": "config/server.js",
-          "position": "bottom",
-          "skipIfContains": [
-            "config.auth.oauth = {",
-            "config.auth = {\n  oauth: {"
-          ],
-          "value": "\nconfig.auth ||= {};\nconfig.auth.oauth = {\n  providers: [],\n  defaultProvider: \"\"\n};\n",
-          "reason": "Append app-owned OAuth provider visibility config for stock auth screens.",
-          "category": "runtime-config",
-          "id": "auth-oauth-app-config"
-        }
-      ]
     }
   }
 }

package/patterns/supabase-auth/PATTERN.md

@@ -0,0 +1,67 @@
+---
+id: auth/supabase-auth
+title: Supabase authentication
+summary: Add Supabase authentication through normal npm composition, explicit environment values, and app-owned auth policy.
+keywords: auth, authentication, oauth, sessions, supabase
+requires: @jskit-ai/auth-provider-supabase-core
+---
+
+# Supabase authentication
+
+## Use when
+
+Use this pattern when the product deliberately chooses Supabase as its identity
+provider. Install the runtime package normally and configure the application
+environment and visible OAuth providers explicitly.
+
+## Do not use when
+
+Do not use this pattern for local credential storage, a custom identity
+provider, or an application whose authentication decision is still open.
+
+## Product decisions
+
+Decide the public application URL, allowed sign-in methods, visible OAuth
+providers, callback URLs, account-linking policy, and where deployment secrets
+live. Obtain the project URL and publishable key from the selected Supabase
+project.
+
+## Invariants
+
+- Secrets and environment-specific values stay outside committed source.
+- The application owns auth/profile and OAuth visibility policy.
+- The installed runtime package supplies the provider implementation and its
+  npm dependency closure.
+- No setup questionnaire or source mutation is required.
+
+## Framework APIs
+
+Use `@jskit-ai/auth-provider-supabase-core` for the provider and
+`@jskit-ai/auth-core` policy contracts. Configure `config.auth` through the
+application's ordinary server configuration.
+
+## Example files
+
+`example/package.json` declares the selected provider. `example/.env.example`
+names required environment inputs without credentials. `example/config/server.js`
+shows the app-owned profile and OAuth visibility decisions.
+
+## Variation points
+
+Change the OAuth provider list, default provider, profile projection mode,
+public URL, and deployment secret source. Compose account/profile packages only
+when the product needs their behavior.
+
+## Verification
+
+- Start the application with missing values and confirm concise diagnostics.
+- Complete sign-in, callback, refresh, sign-out, and rejected-session cases.
+- Verify allowed redirect origins and negative cross-origin behavior.
+- Run the application auth and browser tests.
+
+## Avoid
+
+- committing provider keys
+- silently selecting Supabase for the user
+- generated configuration fragments with hidden overwrite rules
+- setup receipts, provenance, replay logs, or questionnaire answers

package/patterns/supabase-auth/example/.env.example

@@ -0,0 +1,4 @@
+AUTH_PROVIDER=supabase
+AUTH_SUPABASE_URL=https://your-project.supabase.co
+AUTH_SUPABASE_PUBLISHABLE_KEY=replace-me
+APP_PUBLIC_URL=http://localhost:5173

package/patterns/supabase-auth/example/config/server.js

@@ -0,0 +1,11 @@
+const config = {
+  auth: {
+    profileMode: "provider",
+    oauth: {
+      providers: [],
+      defaultProvider: ""
+    }
+  }
+};
+
+export default config;

package/patterns/supabase-auth/example/package.json

@@ -0,0 +1,7 @@
+{
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "@jskit-ai/auth-provider-supabase-core": "0.1.157"
+  }
+}

package/src/server/providers/AuthSupabaseProvider.js

@@ -0,0 +1,127 @@
+import {
+  attachDeferredAuthService,
+  createDeferredAuthService
+} from "@jskit-ai/auth-core/server/deferredAuthService";
+import { normalizeEmail } from "@jskit-ai/auth-core/server/utils";
+import { defineProvider } from "@jskit-ai/kernel/shared/capabilities";
+import { resolveAllowedOriginsFromSurfaceDefinitions } from "@jskit-ai/kernel/shared/support/returnToPath";
+import { createService } from "../lib/service.js";
+
+const PROFILE_MODES = Object.freeze(["provider", "users"]);
+
+function normalizeRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+
+function splitCsv(value) {
+  return String(value || "").split(",").map((entry) => entry.trim()).filter(Boolean);
+}
+
+function oauthConfig(config) {
+  const oauth = normalizeRecord(normalizeRecord(config.auth).oauth);
+  return {
+    providers: Array.isArray(oauth.providers)
+      ? oauth.providers.map((entry) => String(entry || "").trim()).filter(Boolean)
+      : splitCsv(oauth.providers),
+    defaultProvider: String(oauth.defaultProvider || "").trim()
+  };
+}
+
+function providerConfig(env, config) {
+  const configuredOauth = oauthConfig(config);
+  const envProviders = splitCsv(env.AUTH_OAUTH_PROVIDERS);
+  return {
+    id: "supabase",
+    supabaseUrl: String(env.AUTH_SUPABASE_URL || env.SUPABASE_URL || "").trim(),
+    supabasePublishableKey: String(
+      env.AUTH_SUPABASE_PUBLISHABLE_KEY || env.SUPABASE_PUBLISHABLE_KEY || ""
+    ).trim(),
+    jwtAudience: String(env.AUTH_JWT_AUDIENCE || "authenticated").trim(),
+    oauthProviders: envProviders.length > 0 ? envProviders : configuredOauth.providers,
+    oauthDefaultProvider: String(env.AUTH_OAUTH_DEFAULT_PROVIDER || "").trim() || configuredOauth.defaultProvider
+  };
+}
+
+function profileMode(config) {
+  const mode = String(normalizeRecord(config.auth).profileMode || "provider").trim().toLowerCase();
+  if (!PROFILE_MODES.includes(mode)) {
+    throw new Error(`Unsupported config.auth.profileMode "${mode}". Supported values: ${PROFILE_MODES.join(", ")}.`);
+  }
+  return mode;
+}
+
+function createProviderProfileProjector() {
+  return Object.freeze({
+    async findByIdentity() { return null; },
+    async syncIdentityProfile(profileLike) {
+      const profile = normalizeRecord(profileLike);
+      const authProviderUserSid = String(profile.authProviderUserSid || "").trim();
+      const email = normalizeEmail(profile.email || "");
+      if (!authProviderUserSid || !email) {
+        throw new TypeError("Provider identity profile requires authProviderUserSid and email.");
+      }
+      return {
+        id: authProviderUserSid,
+        authProvider: String(profile.authProvider || "supabase").trim() || "supabase",
+        authProviderUserSid,
+        email,
+        displayName: String(profile.displayName || email.split("@")[0] || "User").trim(),
+        profileSource: "auth-provider"
+      };
+    }
+  });
+}
+
+function assertSelectedProvider(env) {
+  const selected = String(env.AUTH_PROVIDER || "").trim().toLowerCase();
+  if (selected && selected !== "supabase") {
+    throw new Error(`AUTH_PROVIDER is "${selected}", but the installed auth provider is Supabase.`);
+  }
+}
+
+const AuthSupabaseProvider = defineProvider({
+  id: "auth.supabase",
+  requires: {
+    config: "runtime.config",
+    env: "runtime.env",
+    extensions: "auth.extensions"
+  },
+  optional: {
+    identity: "users.identity"
+  },
+  provides: {
+    authService: "auth.service"
+  },
+  setup({ env }) {
+    assertSelectedProvider(env);
+    return { authService: createDeferredAuthService() };
+  },
+  boot({ config, env, extensions, identity }, { outputs }) {
+    assertSelectedProvider(env);
+    const mode = profileMode(config);
+    if (mode === "users" && !identity) {
+      throw new Error('Supabase auth profileMode "users" requires the users.identity capability.');
+    }
+    const projector = mode === "users" ? identity.profileProjector : createProviderProfileProjector();
+    const appPublicUrl = String(env.APP_PUBLIC_URL || "").trim();
+    const baseService = createService({
+      authProvider: providerConfig(env, config),
+      appPublicUrl,
+      authAllowedReturnToOrigins: resolveAllowedOriginsFromSurfaceDefinitions(config.surfaceDefinitions || {}, {
+        seedOrigins: [appPublicUrl]
+      }),
+      nodeEnv: String(env.NODE_ENV || "development").trim() || "development",
+      userSettingsRepository: mode === "users" ? identity.repositories.userSettings : null,
+      userProfilesRepository: mode === "users" ? identity.repositories.userProfiles : null,
+      userProfileSyncService: projector,
+      profileProjectionEnabled: mode === "users",
+      devAuthBypassEnabled: env.AUTH_DEV_BYPASS_ENABLED,
+      devAuthBypassSecret: String(env.AUTH_DEV_BYPASS_SECRET || "").trim(),
+      devAuthAccessTtlSeconds: env.AUTH_DEV_ACCESS_TTL_SECONDS,
+      devAuthRefreshTtlSeconds: env.AUTH_DEV_REFRESH_TTL_SECONDS
+    });
+    attachDeferredAuthService(outputs.authService, extensions.decorateService(baseService));
+  }
+});
+
+export { AuthSupabaseProvider };

package/test/entrypoints.boundary.test.js

@@ -3,8 +3,7 @@ import { readFile } from "node:fs/promises";
 import test from "node:test";
 
 const EXPECTED_EXPORTS = Object.freeze({
-  "./server/providers/AuthSupabaseServiceProvider": "./src/server/providers/AuthSupabaseServiceProvider.js",
-  "./server/providers/AuthProviderServiceProvider": "./src/server/providers/AuthProviderServiceProvider.js",
+  "./server/providers/AuthSupabaseProvider": "./src/server/providers/AuthSupabaseProvider.js",
   "./server/lib/index": "./src/server/lib/index.js",
   "./client": "./src/client/index.js"
 });