@jskit-ai/auth-provider-supabase-core 0.1.179 → 0.1.181

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/auth-provider-supabase-core",
-  "version": "0.1.179",
+  "version": "0.1.181",
   "type": "module",
   "scripts": {
     "test": "node --test"
@@ -59,7 +59,7 @@
     }
   },
   "peerDependencies": {
-    "@jskit-ai/auth-core": "0.1.180",
-    "@jskit-ai/kernel": "0.1.182"
+    "@jskit-ai/auth-core": "0.1.182",
+    "@jskit-ai/kernel": "0.1.184"
   }
 }

package/patterns/supabase-auth/PATTERN.md

@@ -40,6 +40,31 @@ Use `@jskit-ai/auth-provider-supabase-core` for the provider and
 `@jskit-ai/auth-core` policy contracts. Configure `config.auth` through the
 application's ordinary server configuration.
 
+## Provider login policy and prerelease migration
+
+Provider-specific login query parameters belong to the application. For example,
+an application choosing Google's account picker can configure:
+
+```js
+const config = {
+  auth: {
+    oauth: {
+      providers: ["google"],
+      defaultProvider: "google",
+      queryParams: { google: { prompt: "select_account" } }
+    }
+  }
+};
+```
+
+Pre-release applications that relied on the previous implicit Google
+`select_account` parameter must add this configuration if they want to retain
+that behavior. The runtime no longer supplies it automatically. This is a manual
+V0 migration; there is no fallback to the old policy. These values control the
+Supabase login flow. They do not configure a Gmail API connection or confer
+mailbox permissions. The application still owns its identity and account-linking
+policy, while connectors manage separately authorized provider access.
+
 ## Example files
 
 `example/package.json` declares the selected provider. `example/.env.example`

package/patterns/supabase-auth/example/package.json

@@ -2,6 +2,6 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "@jskit-ai/auth-provider-supabase-core": "0.1.179"
+    "@jskit-ai/auth-provider-supabase-core": "0.1.181"
   }
 }

package/src/server/lib/oauthProviderCatalog.js

@@ -12,7 +12,7 @@ const SUPABASE_OAUTH_PROVIDER_METADATA = Object.freeze({
   figma: Object.freeze({ id: "figma", label: "Figma" }),
   github: Object.freeze({ id: "github", label: "GitHub" }),
   gitlab: Object.freeze({ id: "gitlab", label: "GitLab" }),
-  google: Object.freeze({ id: "google", label: "Google", queryParams: { prompt: "select_account" } }),
+  google: Object.freeze({ id: "google", label: "Google" }),
   kakao: Object.freeze({ id: "kakao", label: "Kakao" }),
   keycloak: Object.freeze({ id: "keycloak", label: "Keycloak" }),
   linkedin_oidc: Object.freeze({ id: "linkedin_oidc", label: "LinkedIn" }),

package/src/server/lib/service.js

@@ -180,7 +180,7 @@ function createService(options) {
       passwordRecovery: {
         request: supabaseConfigured,
         complete: supabaseConfigured,
-        delivery: supabaseConfigured ? "smtp" : "disabled"
+        delivery: supabaseConfigured ? "email" : "disabled"
       },
       otp: {
         login: supabaseConfigured

package/src/server/providers/AuthSupabaseProvider.js

@@ -23,7 +23,8 @@ function oauthConfig(config) {
     providers: Array.isArray(oauth.providers)
       ? oauth.providers.map((entry) => String(entry || "").trim()).filter(Boolean)
       : splitCsv(oauth.providers),
-    defaultProvider: String(oauth.defaultProvider || "").trim()
+    defaultProvider: String(oauth.defaultProvider || "").trim(),
+    queryParams: normalizeRecord(oauth.queryParams)
   };
 }
 
@@ -38,7 +39,8 @@ function providerConfig(env, config) {
     ).trim(),
     jwtAudience: String(env.AUTH_JWT_AUDIENCE || "authenticated").trim(),
     oauthProviders: envProviders.length > 0 ? envProviders : configuredOauth.providers,
-    oauthDefaultProvider: String(env.AUTH_OAUTH_DEFAULT_PROVIDER || "").trim() || configuredOauth.defaultProvider
+    oauthDefaultProvider: String(env.AUTH_OAUTH_DEFAULT_PROVIDER || "").trim() || configuredOauth.defaultProvider,
+    oauthProviderQueryParams: configuredOauth.queryParams
   };
 }
 

package/test/providerRuntime.test.js

@@ -24,7 +24,7 @@ function env(overrides = {}) {
   };
 }
 
-async function startRuntime({ profileMode = "provider", envOverrides = {}, identity = null, decorate = null } = {}) {
+async function startRuntime({ profileMode = "provider", envOverrides = {}, identity = null, decorate = null, oauth = {} } = {}) {
   const extensions = createAuthExtensions();
   if (decorate) {
     extensions.registerServiceDecorator({
@@ -43,7 +43,7 @@ async function startRuntime({ profileMode = "provider", envOverrides = {}, ident
   });
   const inputs = {
     "auth.extensions": extensions,
-    "runtime.config": config(profileMode),
+    "runtime.config": { ...config(profileMode), auth: { profileMode, oauth } },
     "runtime.env": env(envOverrides),
     ...(identity ? { "users.identity": identity } : {})
   };
@@ -109,3 +109,22 @@ test("AuthSupabaseProvider requires users.identity only when users profile proje
     /requires the users\.identity capability/
   );
 });
+
+
+test("Supabase login query policy belongs to application configuration", async (t) => {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async () => { throw new Error("This fixture must not contact Supabase."); };
+  t.after(() => { globalThis.fetch = originalFetch; });
+  for (const queryParams of [{}, { google: { prompt: "select_account" } }]) {
+    const { authService, runtime } = await startRuntime({ oauth: { providers: ["google"], queryParams } });
+    try {
+      const result = await authService.oauthStart({ provider: "google", returnTo: "/" });
+      const url = new URL(result.url);
+      assert.equal(url.origin, "https://example.supabase.co");
+      assert.equal(url.searchParams.get("provider"), "google");
+      assert.equal(url.searchParams.get("prompt"), queryParams.google?.prompt || null);
+    } finally {
+      await runtime.shutdown();
+    }
+  }
+});