@jskit-ai/auth-provider-supabase-core 0.1.95 → 0.1.96

package/package.descriptor.mjs

@@ -1,7 +1,7 @@
 export default Object.freeze({
   "packageVersion": 1,
   "packageId": "@jskit-ai/auth-provider-supabase-core",
-  "version": "0.1.95",
+  "version": "0.1.96",
   "kind": "runtime",
   "options": {
     "auth-supabase-url": {
@@ -83,8 +83,8 @@ export default Object.freeze({
   "mutations": {
     "dependencies": {
       "runtime": {
-        "@jskit-ai/auth-core": "0.1.95",
-        "@jskit-ai/kernel": "0.1.96",
+        "@jskit-ai/auth-core": "0.1.96",
+        "@jskit-ai/kernel": "0.1.98",
         "dotenv": "^16.4.5",
         "@supabase/supabase-js": "^2.57.4",
         "jose": "^6.1.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/auth-provider-supabase-core",
-  "version": "0.1.95",
+  "version": "0.1.96",
   "type": "module",
   "scripts": {
     "test": "node --test"
@@ -12,8 +12,8 @@
     "./client": "./src/client/index.js"
   },
   "dependencies": {
-    "@jskit-ai/auth-core": "0.1.95",
-    "@jskit-ai/kernel": "0.1.96",
+    "@jskit-ai/auth-core": "0.1.96",
+    "@jskit-ai/kernel": "0.1.98",
     "json-rest-schema": "1.x.x",
     "jose": "^6.1.0",
     "@supabase/supabase-js": "^2.57.4",

package/src/server/lib/actions/auth.contributor.js

@@ -240,14 +240,22 @@ const authActionsAfterDevLogin = Object.freeze([
     },
     observability: {},
     async execute(_input, context, deps) {
+      let logoutResult = {
+        ok: true,
+        clearSession: true
+      };
+      if (deps.authService && typeof deps.authService.logout === "function") {
+        logoutResult = await deps.authService.logout(requireRequestContext(context, "auth.logout"));
+      }
+
       if (deps.authSessionEventsService && typeof deps.authSessionEventsService.notifySessionChanged === "function") {
         await deps.authSessionEventsService.notifySessionChanged({
           context
         });
       }
       return {
-        ok: true,
-        clearSession: true
+        ok: logoutResult?.ok !== false,
+        clearSession: logoutResult?.clearSession !== false
       };
     }
   },

package/src/server/lib/authCookies.js

@@ -21,4 +21,14 @@ function cookieOptions(isProduction, maxAge) {
   return options;
 }
 
-export { safeRequestCookies, cookieOptions };
+function cookieClearOptions(isProduction) {
+  return [
+    cookieOptions(isProduction, 0),
+    {
+      ...cookieOptions(isProduction, 0),
+      path: "/api"
+    }
+  ];
+}
+
+export { safeRequestCookies, cookieOptions, cookieClearOptions };

package/src/server/lib/passwordSecurityFlows.js

@@ -32,7 +32,8 @@ function createPasswordSecurityFlows(deps) {
     buildAuthMethodsStatusFromSupabaseUser,
     buildSecurityStatusFromAuthMethodsStatus,
     authMethodPasswordProvider,
-    buildAuthMethodsStatusFromProviderIds
+    buildAuthMethodsStatusFromProviderIds,
+    resolveDevAuthSecurityStatus
   } = deps;
 
   async function requestPasswordReset(payload) {
@@ -316,6 +317,13 @@ function createPasswordSecurityFlows(deps) {
       return buildSecurityStatusFromAuthMethodsStatus(authMethodsStatus);
     }
 
+    if (typeof resolveDevAuthSecurityStatus === "function") {
+      const devAuthSecurityStatus = await resolveDevAuthSecurityStatus(request);
+      if (devAuthSecurityStatus) {
+        return devAuthSecurityStatus;
+      }
+    }
+
     const current = await resolveCurrentAuthContext(request);
     return buildSecurityStatusFromAuthMethodsStatus(current.authMethodsStatus);
   }

package/src/server/lib/service.js

@@ -42,7 +42,7 @@ import {
   findAuthMethodById,
   findLinkedIdentityByProvider
 } from "./authMethodStatus.js";
-import { safeRequestCookies, cookieOptions } from "./authCookies.js";
+import { safeRequestCookies, cookieOptions, cookieClearOptions } from "./authCookies.js";
 import { loadJose, isExpiredJwtError, classifyJwtVerifyError } from "./authJwt.js";
 import { buildDisabledPasswordSecret } from "./authSecrets.js";
 import { createAccountFlows } from "./accountFlows.js";
@@ -55,6 +55,7 @@ import {
   authenticateDevAuthRequest,
   createDevAuthSession,
   ensureDevAuthBootstrapAvailable,
+  isDevAuthToken,
   resolveDevAuthConfig,
   resolveDevAuthProfile
 } from "./devAuthBootstrap.js";
@@ -372,6 +373,39 @@ function createService(options) {
     };
   }
 
+  function resolveRequestSessionTokens(request) {
+    const cookies = safeRequestCookies(request);
+    return {
+      accessToken: String(cookies[ACCESS_TOKEN_COOKIE] || ""),
+      refreshToken: String(cookies[REFRESH_TOKEN_COOKIE] || "")
+    };
+  }
+
+  async function authenticateDevAuthRequestFromCookies(request, tokens = resolveRequestSessionTokens(request)) {
+    const devAuthResult = await authenticateDevAuthRequest(
+      {
+        request,
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken
+      },
+      {
+        config: devAuthConfig,
+        userProfilesRepository
+      }
+    );
+
+    if (!devAuthResult || devAuthResult.authenticated !== true) {
+      return devAuthResult;
+    }
+
+    return {
+      ...devAuthResult,
+      profile: requireAuthenticatedProfile(devAuthResult.profile, {
+        context: "dev auth profile"
+      })
+    };
+  }
+
   function writeSessionCookies(reply, session) {
     const accessToken = String(session?.access_token || "");
     const refreshToken = String(session?.refresh_token || "");
@@ -387,9 +421,49 @@ function createService(options) {
   }
 
   function clearSessionCookies(reply) {
-    const clearOptions = cookieOptions(isProduction, 0);
-    reply.clearCookie(ACCESS_TOKEN_COOKIE, clearOptions);
-    reply.clearCookie(REFRESH_TOKEN_COOKIE, clearOptions);
+    for (const clearOptions of cookieClearOptions(isProduction)) {
+      reply.clearCookie(ACCESS_TOKEN_COOKIE, clearOptions);
+      reply.clearCookie(REFRESH_TOKEN_COOKIE, clearOptions);
+    }
+  }
+
+  async function logout(request) {
+    const cookies = safeRequestCookies(request);
+    const accessToken = String(cookies[ACCESS_TOKEN_COOKIE] || "").trim();
+    const refreshToken = String(cookies[REFRESH_TOKEN_COOKIE] || "").trim();
+
+    if (!accessToken && !refreshToken) {
+      return {
+        ok: true,
+        clearSession: true
+      };
+    }
+
+    if (isDevAuthToken(accessToken) || isDevAuthToken(refreshToken)) {
+      return {
+        ok: true,
+        clearSession: true
+      };
+    }
+
+    ensureConfigured();
+    const supabase = getSupabaseClient();
+    await setSessionFromRequestCookies(request, {
+      supabaseClient: supabase
+    });
+
+    const response = await supabase.auth.signOut({
+      scope: "local"
+    });
+
+    if (response.error) {
+      throw mapAuthError(response.error, Number(response.error?.status || 400));
+    }
+
+    return {
+      ok: true,
+      clearSession: true
+    };
   }
 
   function requireSynchronizedProfile(profile) {
@@ -571,6 +645,25 @@ function createService(options) {
     };
   }
 
+  async function resolveDevAuthSecurityStatus(request) {
+    const devAuthResult = await authenticateDevAuthRequestFromCookies(request);
+    if (!devAuthResult) {
+      return null;
+    }
+
+    if (devAuthResult.authenticated !== true) {
+      throw new AppError(401, "Authentication required.");
+    }
+
+    const passwordSignInPolicy = await resolvePasswordSignInPolicyForUserId(devAuthResult.profile.id);
+    const authMethodsStatus = buildAuthMethodsStatusFromProviderIds([AUTH_METHOD_PASSWORD_PROVIDER], {
+      ...passwordSignInPolicy,
+      oauthProviders: authOAuthProviders
+    });
+
+    return buildSecurityStatusFromAuthMethodsStatus(authMethodsStatus);
+  }
+
   const { register, resendRegisterConfirmation, login, requestOtpLogin, verifyOtpLogin, updateDisplayName } = createAccountFlows({
     ensureConfigured,
     validationError,
@@ -652,34 +745,15 @@ function createService(options) {
       buildAuthMethodsStatusFromProviderIds(providerIds, {
         ...statusOptions,
         oauthProviders: authOAuthProviders
-      })
+      }),
+    resolveDevAuthSecurityStatus
   });
 
   async function authenticateRequest(request) {
-    const cookies = safeRequestCookies(request);
-    const accessToken = String(cookies[ACCESS_TOKEN_COOKIE] || "");
-    const refreshToken = String(cookies[REFRESH_TOKEN_COOKIE] || "");
+    const { accessToken, refreshToken } = resolveRequestSessionTokens(request);
 
-    const devAuthResult = await authenticateDevAuthRequest(
-      {
-        request,
-        accessToken,
-        refreshToken
-      },
-      {
-        config: devAuthConfig,
-        userProfilesRepository
-      }
-    );
+    const devAuthResult = await authenticateDevAuthRequestFromCookies(request, { accessToken, refreshToken });
     if (devAuthResult) {
-      if (devAuthResult.authenticated === true) {
-        return {
-          ...devAuthResult,
-          profile: requireAuthenticatedProfile(devAuthResult.profile, {
-            context: "dev auth profile"
-          })
-        };
-      }
       return devAuthResult;
     }
 
@@ -860,6 +934,7 @@ function createService(options) {
     setPasswordSignInEnabled,
     unlinkProvider,
     signOutOtherSessions,
+    logout,
     getSecurityStatus,
     getSettingsProfileAuthInfo,
     getOAuthProviderCatalog,
@@ -909,6 +984,7 @@ const __testables = {
   findLinkedIdentityByProvider,
   safeRequestCookies,
   cookieOptions,
+  cookieClearOptions,
   isExpiredJwtError,
   classifyJwtVerifyError
 };

package/test/auth.provider.supabase.test.js

@@ -5,3 +5,163 @@ import * as authProviderSupabase from "../src/server/lib/index.js";
 test("auth.provider.supabase exports required symbols", () => {
   assert.equal(typeof authProviderSupabase.createService, "function");
 });
+
+function createServiceFixture(overrides = {}) {
+  return authProviderSupabase.createService({
+    authProvider: {
+      id: "supabase",
+      supabaseUrl: "",
+      supabasePublishableKey: ""
+    },
+    appPublicUrl: "http://localhost:5173",
+    nodeEnv: "development",
+    userProfileSyncService: {
+      async findByIdentity() {
+        return null;
+      },
+      async syncIdentityProfile(profile) {
+        return {
+          id: "1",
+          email: String(profile?.email || "ada@example.com"),
+          displayName: String(profile?.displayName || "Ada Example"),
+          authProvider: String(profile?.authProvider || "supabase"),
+          authProviderUserSid: String(profile?.authProviderUserSid || "supabase-user-1")
+        };
+      }
+    },
+    ...overrides
+  });
+}
+
+test("clearSessionCookies clears root and API path session cookie variants", () => {
+  const authService = createServiceFixture();
+  const clearCalls = [];
+  const reply = {
+    clearCookie(name, options) {
+      clearCalls.push({
+        name,
+        options
+      });
+    }
+  };
+
+  authService.clearSessionCookies(reply);
+
+  assert.deepEqual(
+    clearCalls.map((call) => ({ name: call.name, path: call.options.path, maxAge: call.options.maxAge })),
+    [
+      { name: "sb_access_token", path: "/", maxAge: 0 },
+      { name: "sb_refresh_token", path: "/", maxAge: 0 },
+      { name: "sb_access_token", path: "/api", maxAge: 0 },
+      { name: "sb_refresh_token", path: "/api", maxAge: 0 }
+    ]
+  );
+});
+
+test("clearSessionCookies preserves secure cookie clearing in production", () => {
+  const authService = createServiceFixture({
+    nodeEnv: "production"
+  });
+  const clearCalls = [];
+  const reply = {
+    clearCookie(name, options) {
+      clearCalls.push({
+        name,
+        options
+      });
+    }
+  };
+
+  authService.clearSessionCookies(reply);
+
+  assert.equal(clearCalls.length, 4);
+  assert.equal(clearCalls.every((call) => call.options.secure === true), true);
+});
+
+test("logout is local-only when no session cookies are present", async () => {
+  const authService = createServiceFixture();
+
+  const result = await authService.logout({
+    cookies: {}
+  });
+
+  assert.deepEqual(result, {
+    ok: true,
+    clearSession: true
+  });
+});
+
+test("logout is local-only for dev auth cookies", async () => {
+  const authService = createServiceFixture();
+
+  const result = await authService.logout({
+    cookies: {
+      sb_access_token: "jskit-dev.invalid"
+    }
+  });
+
+  assert.deepEqual(result, {
+    ok: true,
+    clearSession: true
+  });
+});
+
+test("auth logout action delegates to provider logout and notifies session changes", async () => {
+  const action = authProviderSupabase
+    .buildAuthActions()
+    .find((definition) => definition.id === "auth.logout");
+  const request = {
+    id: "request-1"
+  };
+  const calls = [];
+
+  const result = await action.execute(
+    {},
+    {
+      requestMeta: {
+        request
+      }
+    },
+    {
+      authService: {
+        async logout(receivedRequest) {
+          calls.push({
+            type: "logout",
+            request: receivedRequest
+          });
+          return {
+            ok: true,
+            clearSession: true
+          };
+        }
+      },
+      authSessionEventsService: {
+        async notifySessionChanged(payload) {
+          calls.push({
+            type: "notify",
+            context: payload.context
+          });
+        }
+      }
+    }
+  );
+
+  assert.deepEqual(result, {
+    ok: true,
+    clearSession: true
+  });
+  assert.deepEqual(calls, [
+    {
+      type: "logout",
+      request
+    },
+    {
+      type: "notify",
+      context: {
+        requestMeta: {
+          request
+        }
+      }
+    }
+  ]);
+});

package/test/devAuthBootstrap.test.js

@@ -109,6 +109,47 @@ test("dev auth bootstrap can issue and authenticate a local session without Supa
   assert.equal(authResult.session, null);
 });
 
+test("dev auth bootstrap resolves security status without Supabase", async () => {
+  const authService = createServiceFixture();
+  const loginResult = await authService.devLoginAs(createLocalRequest(), {
+    userId: "7"
+  });
+
+  const securityStatus = await authService.getSecurityStatus(
+    createLocalRequest({
+      cookies: {
+        sb_access_token: loginResult.session.access_token,
+        sb_refresh_token: loginResult.session.refresh_token
+      }
+    })
+  );
+
+  const passwordMethod = securityStatus.authMethods.find((method) => method.id === "password");
+  assert.equal(securityStatus.authPolicy.minimumEnabledMethods, 1);
+  assert.equal(passwordMethod?.configured, true);
+  assert.equal(passwordMethod?.enabled, true);
+});
+
+test("dev auth security status rejects invalid dev sessions without recovery-link errors", async () => {
+  const authService = createServiceFixture();
+
+  await assert.rejects(
+    () =>
+      authService.getSecurityStatus(
+        createLocalRequest({
+          cookies: {
+            sb_access_token: "jskit-dev.invalid"
+          }
+        })
+      ),
+    (error) => {
+      assert.equal(error.statusCode || error.status, 401);
+      assert.equal(error.message, "Authentication required.");
+      return true;
+    }
+  );
+});
+
 test("dev auth bootstrap supports email lookup", async () => {
   const authService = createServiceFixture();