@jskit-ai/auth-provider-supabase-core 0.1.98 → 0.1.100

package/test/auth.provider.supabase.test.js

@@ -1,6 +1,8 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 import * as authProviderSupabase from "../src/server/lib/index.js";
+import { createAccountFlows } from "../src/server/lib/accountFlows.js";
+import { createPasswordSecurityFlows } from "../src/server/lib/passwordSecurityFlows.js";
 
 test("auth.provider.supabase exports required symbols", () => {
   assert.equal(typeof authProviderSupabase.createService, "function");
@@ -52,8 +54,12 @@ test("clearSessionCookies clears root and API path session cookie variants", ()
     [
       { name: "sb_access_token", path: "/", maxAge: 0 },
       { name: "sb_refresh_token", path: "/", maxAge: 0 },
+      { name: "sb_recovery_access_token", path: "/", maxAge: 0 },
+      { name: "sb_recovery_refresh_token", path: "/", maxAge: 0 },
       { name: "sb_access_token", path: "/api", maxAge: 0 },
-      { name: "sb_refresh_token", path: "/api", maxAge: 0 }
+      { name: "sb_refresh_token", path: "/api", maxAge: 0 },
+      { name: "sb_recovery_access_token", path: "/api", maxAge: 0 },
+      { name: "sb_recovery_refresh_token", path: "/api", maxAge: 0 }
     ]
   );
 });
@@ -74,10 +80,114 @@ test("clearSessionCookies preserves secure cookie clearing in production", () =>
 
   authService.clearSessionCookies(reply);
 
-  assert.equal(clearCalls.length, 4);
+  assert.equal(clearCalls.length, 8);
   assert.equal(clearCalls.every((call) => call.options.secure === true), true);
 });
 
+test("supabase account flow updateDisplayName accepts the core command payload shape", async () => {
+  let updatePayload = null;
+  const flows = createAccountFlows({
+    ensureConfigured() {},
+    validationError(errors) {
+      return new Error(JSON.stringify(errors));
+    },
+    getSupabaseClient() {
+      return {
+        auth: {
+          async updateUser(payload) {
+            updatePayload = payload;
+            return {
+              data: {
+                user: {
+                  id: "supabase-user-1",
+                  email: "ada@example.com",
+                  user_metadata: {
+                    display_name: payload.data.display_name
+                  },
+                  app_metadata: {}
+                }
+              }
+            };
+          }
+        }
+      };
+    },
+    async setSessionFromRequestCookies() {
+      return {
+        data: {
+          session: {
+            access_token: "access"
+          }
+        }
+      };
+    },
+    async syncProfileFromSupabaseUser(user) {
+      return {
+        id: "profile-1",
+        email: user.email,
+        displayName: user.user_metadata.display_name,
+        authProvider: "supabase",
+        authProviderUserSid: user.id
+      };
+    },
+    mapProfileUpdateError(error) {
+      return error || new Error("profile update failed");
+    }
+  });
+
+  const result = await flows.updateDisplayName(
+    {
+      cookies: {}
+    },
+    {
+      displayName: "Ada Lovelace"
+    }
+  );
+
+  assert.deepEqual(updatePayload, {
+    data: {
+      display_name: "Ada Lovelace"
+    }
+  });
+  assert.equal(result.profile.displayName, "Ada Lovelace");
+});
+
+test("recovery sessions use recovery cookies and do not authenticate the app", async () => {
+  const authService = createServiceFixture();
+  const cookies = {};
+  const cookieOptions = {};
+  const reply = {
+    setCookie(name, value, options) {
+      cookies[name] = value;
+      cookieOptions[name] = options;
+    }
+  };
+
+  authService.writeSessionCookies(reply, {
+    access_token: "recovery-access",
+    refresh_token: "recovery-refresh",
+    expires_in: 300,
+    purpose: "recovery"
+  });
+
+  assert.deepEqual(cookies, {
+    sb_recovery_access_token: "recovery-access",
+    sb_recovery_refresh_token: "recovery-refresh"
+  });
+  assert.equal(cookieOptions.sb_recovery_access_token.maxAge, 300);
+  assert.equal(cookieOptions.sb_recovery_refresh_token.maxAge, 300);
+  assert.equal(authService.hasAccessTokenCookie({ cookies }), true);
+  assert.equal(authService.hasSessionCookie({ cookies }), true);
+
+  const authResult = await authService.authenticateRequest({ cookies });
+  assert.deepEqual(authResult, {
+    authenticated: false,
+    clearSession: false,
+    session: null,
+    transientFailure: false
+  });
+});
+
 test("logout is local-only when no session cookies are present", async () => {
   const authService = createServiceFixture();
 
@@ -106,62 +216,103 @@ test("logout is local-only for dev auth cookies", async () => {
   });
 });
 
-test("auth logout action delegates to provider logout and notifies session changes", async () => {
-  const action = authProviderSupabase
-    .buildAuthActions()
-    .find((definition) => definition.id === "auth.logout");
-  const request = {
-    id: "request-1"
-  };
-  const calls = [];
-
-  const result = await action.execute(
-    {},
-    {
-      requestMeta: {
-        request
-      }
+test("supabase password reset consumes the recovery session reader", async () => {
+  let normalSessionReads = 0;
+  let recoverySessionReads = 0;
+  let signOutCalls = 0;
+  const flows = createPasswordSecurityFlows({
+    ensureConfigured() {},
+    validationError(errors) {
+      const error = new Error("Validation failed.");
+      error.errors = errors;
+      return error;
     },
-    {
-      authService: {
-        async logout(receivedRequest) {
-          calls.push({
-            type: "logout",
-            request: receivedRequest
-          });
-          return {
-            ok: true,
-            clearSession: true
-          };
+    getSupabaseClient() {
+      return {
+        auth: {
+          async updateUser(input) {
+            assert.deepEqual(input, { password: "new password value" });
+            return {
+              data: {
+                user: {
+                  id: "supabase-user-1",
+                  email: "reset@example.com"
+                }
+              },
+              error: null
+            };
+          },
+          async signOut(options) {
+            signOutCalls += 1;
+            assert.deepEqual(options, {
+              scope: "local"
+            });
+            return {
+              error: null
+            };
+          }
         }
-      },
-      authSessionEventsService: {
-        async notifySessionChanged(payload) {
-          calls.push({
-            type: "notify",
-            context: payload.context
-          });
+      };
+    },
+    async setSessionFromRequestCookies() {
+      normalSessionReads += 1;
+      throw new Error("normal session reader should not be used for reset.");
+    },
+    async setRecoverySessionFromRequestCookies(_request, { supabaseClient }) {
+      recoverySessionReads += 1;
+      assert.equal(typeof supabaseClient.auth.updateUser, "function");
+      return {
+        data: {
+          user: {
+            id: "supabase-user-1",
+            email: "reset@example.com"
+          },
+          session: {
+            access_token: "recovery-access",
+            refresh_token: "recovery-refresh"
+          }
         }
-      }
+      };
+    },
+    async syncProfileFromSupabaseUser(user) {
+      return {
+        id: "1",
+        email: user.email,
+        displayName: "Reset Example",
+        authProvider: "supabase",
+        authProviderUserSid: user.id
+      };
+    },
+    async resolvePasswordSignInPolicyForUserId(userId) {
+      assert.equal(userId, "1");
+      return {
+        passwordSignInEnabled: true
+      };
+    },
+    async setPasswordSetupRequiredForUserId(userId, required) {
+      assert.equal(userId, "1");
+      assert.equal(required, false);
+    },
+    mapPasswordUpdateError(error) {
+      return error instanceof Error ? error : new Error("Password update failed.");
     }
-  );
-
-  assert.deepEqual(result, {
-    ok: true,
-    clearSession: true
   });
-  assert.deepEqual(calls, [
+
+  await flows.resetPassword(
     {
-      type: "logout",
-      request
+      cookies: {
+        sb_access_token: "normal-access",
+        sb_refresh_token: "normal-refresh",
+        sb_recovery_access_token: "recovery-access",
+        sb_recovery_refresh_token: "recovery-refresh"
+      }
     },
     {
-      type: "notify",
-      context: {
-        requestMeta: {
-          request
-        }
-      }
+      password: "new password value"
     }
-  ]);
+  );
+
+  assert.equal(recoverySessionReads, 1);
+  assert.equal(normalSessionReads, 0);
+  assert.equal(signOutCalls, 1);
 });

package/test/providerRuntime.test.js

@@ -1,9 +1,11 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 import { createApplication } from "@jskit-ai/kernel/_testable";
+import { AuthActionsServiceProvider } from "@jskit-ai/auth-core/server/providers/AuthActionsServiceProvider";
 import { registerAuthServiceDecorator } from "@jskit-ai/auth-core/server/authServiceDecoratorRegistry";
 import { ActionRuntimeServiceProvider } from "@jskit-ai/kernel/server/actions";
 import { createProviderClass } from "../../kernel/shared/runtime/application.js";
+import { AuthProviderServiceProvider } from "../src/server/providers/AuthProviderServiceProvider.js";
 import { AuthSupabaseServiceProvider } from "../src/server/providers/AuthSupabaseServiceProvider.js";
 
 function createAppConfigFixture({ auth = null } = {}) {
@@ -35,7 +37,7 @@ function isBootFailureWithCause(error, pattern) {
   );
 }
 
-test("auth supabase provider defaults to users mode and contributes auth actions", async () => {
+test("auth supabase provider defaults to provider profile mode and contributes auth actions", async () => {
   const app = createApplication();
   app.instance("appConfig", createAppConfigFixture());
   app.instance("jskit.env", {
@@ -69,11 +71,53 @@ test("auth supabase provider defaults to users mode and contributes auth actions
   });
 
   await app.start({
-    providers: [ActionRuntimeServiceProvider, AuthSupabaseServiceProvider]
+    providers: [
+      ActionRuntimeServiceProvider,
+      AuthSupabaseServiceProvider,
+      AuthProviderServiceProvider,
+      AuthActionsServiceProvider
+    ]
   });
 
   const authService = app.make("authService");
   assert.equal(typeof authService?.login, "function");
+  assert.deepEqual(authService.getCapabilities(), {
+    provider: {
+      id: "supabase",
+      label: "Supabase"
+    },
+    features: {
+      password: {
+        login: true,
+        register: true,
+        change: true,
+        methodToggle: false
+      },
+      passwordRecovery: {
+        request: true,
+        complete: true,
+        delivery: "smtp"
+      },
+      otp: {
+        login: true
+      },
+      oauthLogin: {
+        enabled: false,
+        providers: [],
+        defaultProvider: null
+      },
+      emailConfirmation: true,
+      profileUpdate: true,
+      providerLinking: {
+        start: false,
+        unlink: false
+      },
+      securityStatus: true,
+      signOutOtherSessions: true,
+      appProfileProjection: false,
+      devLoginAs: false
+    }
+  });
 
   const actionExecutor = app.make("actionExecutor");
   assert.equal(typeof actionExecutor?.execute, "function");
@@ -111,14 +155,22 @@ test("auth supabase provider registers authService in standalone mode without us
   });
 
   await app.start({
-    providers: [ActionRuntimeServiceProvider, AuthSupabaseServiceProvider]
+    providers: [
+      ActionRuntimeServiceProvider,
+      AuthSupabaseServiceProvider,
+      AuthProviderServiceProvider,
+      AuthActionsServiceProvider
+    ]
   });
 
   const authService = app.make("authService");
   assert.equal(typeof authService?.login, "function");
+  const status = await authService.getSecurityStatus();
+  assert.equal(status.actions.changePassword, true);
+  assert.equal(status.actions.setPasswordEnabled, false);
 });
 
-test("auth supabase provider requires users.profile.sync.service in default users mode", async () => {
+test("auth supabase provider reports password method toggle only with persistent settings repository", async () => {
   const app = createApplication();
   app.instance("appConfig", createAppConfigFixture());
   app.instance("jskit.env", {
@@ -136,12 +188,61 @@ test("auth supabase provider requires users.profile.sync.service in default user
   app.instance("domainEvents", {
     async publish() {}
   });
+  app.instance("internal.repository.user-settings", {
+    async ensureForUserId() {
+      return {
+        passwordSignInEnabled: true,
+        passwordSetupRequired: false
+      };
+    },
+    async updatePasswordSignInEnabled() {
+      return {
+        passwordSignInEnabled: true,
+        passwordSetupRequired: false
+      };
+    }
+  });
 
   await app.start({
     providers: [ActionRuntimeServiceProvider, AuthSupabaseServiceProvider]
   });
 
-  assert.throws(() => app.make("authService"), /config\.auth\.profileMode is "users"/);
+  const authService = app.make("authService");
+  assert.equal(authService.getCapabilities().features.password.methodToggle, true);
+  const status = await authService.getSecurityStatus();
+  assert.equal(status.actions.setPasswordEnabled, true);
+});
+
+test("auth supabase provider requires users.profile.sync.service in explicit users mode", async () => {
+  const app = createApplication();
+  app.instance("appConfig", createAppConfigFixture({
+    auth: {
+      profileMode: "users"
+    }
+  }));
+  app.instance("jskit.env", {
+    AUTH_SUPABASE_URL: "https://example.supabase.co",
+    AUTH_SUPABASE_PUBLISHABLE_KEY: "sb_publishable_test_key",
+    APP_PUBLIC_URL: "http://localhost:5173",
+    NODE_ENV: "test"
+  });
+  app.instance("jskit.logger", {
+    info() {},
+    warn() {},
+    error() {},
+    debug() {}
+  });
+  app.instance("domainEvents", {
+    async publish() {}
+  });
+
+  await assert.rejects(
+    () =>
+      app.start({
+        providers: [ActionRuntimeServiceProvider, AuthSupabaseServiceProvider]
+      }),
+    (error) => isBootFailureWithCause(error, /config\.auth\.profileMode is "users"/)
+  );
 });
 
 test("auth supabase provider rejects unsupported config.auth.profileMode values", async () => {
@@ -167,11 +268,42 @@ test("auth supabase provider rejects unsupported config.auth.profileMode values"
     async publish() {}
   });
 
-  await app.start({
-    providers: [ActionRuntimeServiceProvider, AuthSupabaseServiceProvider]
+  await assert.rejects(
+    () =>
+      app.start({
+        providers: [ActionRuntimeServiceProvider, AuthSupabaseServiceProvider]
+      }),
+    (error) => isBootFailureWithCause(error, /Unsupported config\.auth\.profileMode/)
+  );
+});
+
+test("auth supabase provider rejects AUTH_PROVIDER mismatches", async () => {
+  const app = createApplication();
+  app.instance("appConfig", createAppConfigFixture());
+  app.instance("jskit.env", {
+    AUTH_PROVIDER: "local",
+    AUTH_SUPABASE_URL: "https://example.supabase.co",
+    AUTH_SUPABASE_PUBLISHABLE_KEY: "sb_publishable_test_key",
+    APP_PUBLIC_URL: "http://localhost:5173",
+    NODE_ENV: "test"
+  });
+  app.instance("jskit.logger", {
+    info() {},
+    warn() {},
+    error() {},
+    debug() {}
+  });
+  app.instance("domainEvents", {
+    async publish() {}
   });
 
-  assert.throws(() => app.make("authService"), /Unsupported config\.auth\.profileMode/);
+  await assert.rejects(
+    () =>
+      app.start({
+        providers: [ActionRuntimeServiceProvider, AuthSupabaseServiceProvider]
+      }),
+    (error) => /AUTH_PROVIDER is "local"/.test(String(error.details?.cause?.message || error.message || ""))
+  );
 });
 
 test("auth supabase provider can boot dev auth without Supabase credentials", async () => {
@@ -223,6 +355,12 @@ test("auth supabase provider can boot dev auth without Supabase credentials", as
   assert.equal(typeof authService?.devLoginAs, "function");
   assert.equal(typeof authService?.isDevAuthBootstrapEnabled, "function");
   assert.equal(authService.isDevAuthBootstrapEnabled(), true);
+  const capabilities = authService.getCapabilities();
+  assert.equal(capabilities.features.password.login, false);
+  assert.equal(capabilities.features.passwordRecovery.request, false);
+  assert.equal(capabilities.features.otp.login, false);
+  assert.equal(capabilities.features.signOutOtherSessions, false);
+  assert.equal(capabilities.features.devLoginAs, true);
 
   const actionExecutor = app.make("actionExecutor");
   const definitions = actionExecutor.listDefinitions();

package/src/server/lib/authSessionEventsService.js

@@ -1,20 +0,0 @@
-import { normalizeRecordId } from "@jskit-ai/kernel/shared/support/normalize";
-
-function createAuthSessionEventsService() {
-  async function notifySessionChanged(options = {}) {
-    const actorId = normalizeRecordId(options?.context?.actor?.id, { fallback: null });
-    if (!actorId) {
-      return null;
-    }
-
-    return {
-      id: actorId
-    };
-  }
-
-  return Object.freeze({
-    notifySessionChanged
-  });
-}
-
-export { createAuthSessionEventsService };