@jskit-ai/auth-provider-supabase-core 0.1.99 → 0.1.100

package/package.descriptor.mjs

@@ -1,7 +1,7 @@
 export default Object.freeze({
   "packageVersion": 1,
   "packageId": "@jskit-ai/auth-provider-supabase-core",
-  "version": "0.1.99",
+  "version": "0.1.100",
   "kind": "runtime",
   "options": {
     "auth-supabase-url": {
@@ -83,8 +83,8 @@ export default Object.freeze({
   "mutations": {
     "dependencies": {
       "runtime": {
-        "@jskit-ai/auth-core": "0.1.99",
-        "@jskit-ai/kernel": "0.1.101",
+        "@jskit-ai/auth-core": "0.1.100",
+        "@jskit-ai/kernel": "0.1.102",
         "dotenv": "^16.4.5",
         "@supabase/supabase-js": "^2.57.4",
         "jose": "^6.1.0"
@@ -138,10 +138,10 @@ export default Object.freeze({
         "file": "config/server.js",
         "position": "bottom",
         "skipIfContains": "config.auth.profileMode =",
-        "value": "\nconfig.auth ||= {};\nconfig.auth.profileMode = \"standalone\";\n",
-        "reason": "Use standalone auth profile sync until a users package enables users-backed sync.",
+        "value": "\nconfig.auth ||= {};\nconfig.auth.profileMode = \"provider\";\n",
+        "reason": "Use provider-owned auth profiles until a users package enables users-backed sync.",
         "category": "runtime-config",
-        "id": "auth-profile-mode-standalone"
+        "id": "auth-profile-mode-provider"
       },
       {
         "op": "append-text",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/auth-provider-supabase-core",
-  "version": "0.1.99",
+  "version": "0.1.100",
   "type": "module",
   "scripts": {
     "test": "node --test"
@@ -12,8 +12,8 @@
     "./client": "./src/client/index.js"
   },
   "dependencies": {
-    "@jskit-ai/auth-core": "0.1.99",
-    "@jskit-ai/kernel": "0.1.101",
+    "@jskit-ai/auth-core": "0.1.100",
+    "@jskit-ai/kernel": "0.1.102",
     "json-rest-schema": "1.x.x",
     "jose": "^6.1.0",
     "@supabase/supabase-js": "^2.57.4",

package/src/server/lib/accountFlows.js

@@ -315,10 +315,14 @@ function createAccountFlows(deps) {
     };
   }
 
-  async function updateDisplayName(request, displayName) {
+  async function updateDisplayName(request, payload = {}) {
     ensureConfigured();
 
-    const normalizedDisplayName = String(displayName || "").trim();
+    const normalizedDisplayName = String(
+      payload && typeof payload === "object" && !Array.isArray(payload)
+        ? payload.displayName
+        : payload
+    ).trim();
     if (!normalizedDisplayName) {
       throw validationError({
         displayName: "Display name is required."

package/src/server/lib/actions/auth.contributor.js

@@ -1,49 +1,5 @@
-import { createSchema } from "json-rest-schema";
-import {
-  emptyInputValidator
-} from "@jskit-ai/kernel/shared/actions/actionContributorHelpers";
-import {
-  composeSchemaDefinitions
-} from "@jskit-ai/kernel/shared/validators";
-import { deepFreeze } from "@jskit-ai/kernel/shared/support/deepFreeze";
-import {
-  authRegisterCommand,
-  authRegisterConfirmationResendCommand,
-  authLoginPasswordCommand,
-  authLoginOtpRequestCommand,
-  authLoginOtpVerifyCommand,
-  authLoginOAuthStartCommand,
-  authLoginOAuthCompleteCommand,
-  authDevLoginAsCommand,
-  authPasswordResetRequestCommand,
-  authPasswordRecoveryCompleteCommand,
-  authPasswordResetCommand
-} from "@jskit-ai/auth-core/shared/commands";
-
-const authLoginOAuthStartInput = composeSchemaDefinitions([
-  authLoginOAuthStartCommand.operation.params,
-  authLoginOAuthStartCommand.operation.query
-], {
-  mode: "patch",
-  context: "authContributor.authLoginOAuthStartInput"
-});
-
-const authLogoutOutput = deepFreeze({
-  schema: createSchema({
-    ok: { type: "boolean", required: true },
-    clearSession: { type: "boolean", required: true }
-  }),
-  mode: "replace"
-});
-
-function requireRequestContext(context, actionId) {
-  const request = context?.requestMeta?.request || null;
-  if (request) {
-    return request;
-  }
-
-  throw new Error(`${actionId} requires request context.`);
-}
+import { authDevLoginAsCommand } from "@jskit-ai/auth-core/shared/commands";
+import { requireRequestContext } from "@jskit-ai/auth-core/server/actions/auth.contributor";
 
 const devLoginAsAction = Object.freeze({
   id: "auth.dev.loginAs",
@@ -62,236 +18,4 @@ const devLoginAsAction = Object.freeze({
   }
 });
 
-const authActionsBeforeDevLogin = Object.freeze([
-  {
-    id: "auth.register",
-    version: 1,
-    kind: "command",
-    channels: ["api", "internal"],
-    surfacesFrom: "enabled",
-    input: authRegisterCommand.operation.body,
-    idempotency: "none",
-    audit: {
-      actionName: "auth.register"
-    },
-    observability: {},
-    async execute(input, _context, deps) {
-      return deps.authService.register(input);
-    }
-  },
-  {
-    id: "auth.register.confirmation.resend",
-    version: 1,
-    kind: "command",
-    channels: ["api", "internal"],
-    surfacesFrom: "enabled",
-    input: authRegisterConfirmationResendCommand.operation.body,
-    idempotency: "none",
-    audit: {
-      actionName: "auth.register.confirmation.resend"
-    },
-    observability: {},
-    async execute(input, _context, deps) {
-      return deps.authService.resendRegisterConfirmation(input);
-    }
-  },
-  {
-    id: "auth.login.password",
-    version: 1,
-    kind: "command",
-    channels: ["api", "internal"],
-    surfacesFrom: "enabled",
-    input: authLoginPasswordCommand.operation.body,
-    idempotency: "none",
-    audit: {
-      actionName: "auth.login.password"
-    },
-    observability: {},
-    async execute(input, _context, deps) {
-      return deps.authService.login(input);
-    }
-  },
-  {
-    id: "auth.login.otp.request",
-    version: 1,
-    kind: "command",
-    channels: ["api", "internal"],
-    surfacesFrom: "enabled",
-    input: authLoginOtpRequestCommand.operation.body,
-    idempotency: "none",
-    audit: {
-      actionName: "auth.login.otp.request"
-    },
-    observability: {},
-    async execute(input, _context, deps) {
-      return deps.authService.requestOtpLogin(input);
-    }
-  },
-  {
-    id: "auth.login.otp.verify",
-    version: 1,
-    kind: "command",
-    channels: ["api", "internal"],
-    surfacesFrom: "enabled",
-    input: authLoginOtpVerifyCommand.operation.body,
-    idempotency: "none",
-    audit: {
-      actionName: "auth.login.otp.verify"
-    },
-    observability: {},
-    async execute(input, _context, deps) {
-      return deps.authService.verifyOtpLogin(input);
-    }
-  },
-  {
-    id: "auth.login.oauth.start",
-    version: 1,
-    kind: "command",
-    channels: ["api", "internal"],
-    surfacesFrom: "enabled",
-    input: authLoginOAuthStartInput,
-    idempotency: "none",
-    audit: {
-      actionName: "auth.login.oauth.start"
-    },
-    observability: {},
-    async execute(input, _context, deps) {
-      return deps.authService.oauthStart(input);
-    }
-  },
-  {
-    id: "auth.login.oauth.complete",
-    version: 1,
-    kind: "command",
-    channels: ["api", "internal"],
-    surfacesFrom: "enabled",
-    input: authLoginOAuthCompleteCommand.operation.body,
-    idempotency: "none",
-    audit: {
-      actionName: "auth.login.oauth.complete"
-    },
-    observability: {},
-    async execute(input, _context, deps) {
-      return deps.authService.oauthComplete(input);
-    }
-  }
-]);
-
-const authActionsAfterDevLogin = Object.freeze([
-  {
-    id: "auth.password.reset.request",
-    version: 1,
-    kind: "command",
-    channels: ["api", "internal"],
-    surfacesFrom: "enabled",
-    input: authPasswordResetRequestCommand.operation.body,
-    idempotency: "none",
-    audit: {
-      actionName: "auth.password.reset.request"
-    },
-    observability: {},
-    async execute(input, _context, deps) {
-      return deps.authService.requestPasswordReset(input);
-    }
-  },
-  {
-    id: "auth.password.recovery.complete",
-    version: 1,
-    kind: "command",
-    channels: ["api", "internal"],
-    surfacesFrom: "enabled",
-    input: authPasswordRecoveryCompleteCommand.operation.body,
-    idempotency: "none",
-    audit: {
-      actionName: "auth.password.recovery.complete"
-    },
-    observability: {},
-    async execute(input, _context, deps) {
-      return deps.authService.completePasswordRecovery(input);
-    }
-  },
-  {
-    id: "auth.password.reset",
-    version: 1,
-    kind: "command",
-    channels: ["api", "internal"],
-    surfacesFrom: "enabled",
-    input: authPasswordResetCommand.operation.body,
-    idempotency: "none",
-    audit: {
-      actionName: "auth.password.reset"
-    },
-    observability: {},
-    async execute(input, context, deps) {
-      return deps.authService.resetPassword(requireRequestContext(context, "auth.password.reset"), input);
-    }
-  },
-  {
-    id: "auth.logout",
-    version: 1,
-    kind: "command",
-    channels: ["api", "automation", "internal"],
-    surfacesFrom: "enabled",
-    input: emptyInputValidator,
-    output: authLogoutOutput,
-    idempotency: "none",
-    audit: {
-      actionName: "auth.logout"
-    },
-    observability: {},
-    async execute(_input, context, deps) {
-      let logoutResult = {
-        ok: true,
-        clearSession: true
-      };
-      if (deps.authService && typeof deps.authService.logout === "function") {
-        logoutResult = await deps.authService.logout(requireRequestContext(context, "auth.logout"));
-      }
-
-      if (deps.authSessionEventsService && typeof deps.authSessionEventsService.notifySessionChanged === "function") {
-        await deps.authSessionEventsService.notifySessionChanged({
-          context
-        });
-      }
-      return {
-        ok: logoutResult?.ok !== false,
-        clearSession: logoutResult?.clearSession !== false
-      };
-    }
-  },
-  {
-    id: "auth.session.read",
-    version: 1,
-    kind: "query",
-    channels: ["api", "internal"],
-    surfacesFrom: "enabled",
-    input: emptyInputValidator,
-    idempotency: "none",
-    audit: {
-      actionName: "auth.session.read"
-    },
-    observability: {},
-    async execute(_input, context, deps) {
-      return deps.authService.authenticateRequest(requireRequestContext(context, "auth.session.read"));
-    }
-  }
-]);
-
-const baseAuthActions = Object.freeze([
-  ...authActionsBeforeDevLogin,
-  ...authActionsAfterDevLogin
-]);
-
-function buildAuthActions({ includeDevLoginAs = false } = {}) {
-  if (!includeDevLoginAs) {
-    return baseAuthActions;
-  }
-
-  return Object.freeze([
-    ...authActionsBeforeDevLogin,
-    devLoginAsAction,
-    ...authActionsAfterDevLogin
-  ]);
-}
-
-export { baseAuthActions, buildAuthActions, devLoginAsAction };
+export { devLoginAsAction };

package/src/server/lib/authMethodStatus.js

@@ -10,6 +10,7 @@ import {
   buildAuthMethodDefinitions,
   buildOAuthMethodId
 } from "@jskit-ai/auth-core/shared/authMethods";
+import { buildSecurityStatusFromAuthMethodsStatus as buildCoreSecurityStatusFromAuthMethodsStatus } from "@jskit-ai/auth-core/shared/authSecurityStatus";
 
 function normalizeIdentityProviderId(value) {
   return String(value || "")
@@ -168,29 +169,8 @@ function buildAuthMethodsStatusFromSupabaseUser(user, options = {}) {
   return buildAuthMethodsStatusFromProviderIds(collectProviderIdsFromSupabaseUser(user), options);
 }
 
-function buildSecurityStatusFromAuthMethodsStatus(authMethodsStatus) {
-  const minimumEnabledMethods = Number(authMethodsStatus?.minimumEnabledMethods || AUTH_METHOD_MINIMUM_ENABLED);
-  let enabledMethodsCount = 0;
-
-  const storedCount = Number(authMethodsStatus?.enabledMethodsCount);
-  if (Number.isFinite(storedCount)) {
-    enabledMethodsCount = storedCount;
-  } else if (Array.isArray(authMethodsStatus?.methods)) {
-    enabledMethodsCount = countEnabledMethods(authMethodsStatus.methods);
-  }
-
-  return {
-    mfa: {
-      status: "not_enabled",
-      enrolled: false,
-      methods: []
-    },
-    authPolicy: {
-      minimumEnabledMethods,
-      enabledMethodsCount
-    },
-    authMethods: Array.isArray(authMethodsStatus?.methods) ? authMethodsStatus.methods : []
-  };
+function buildSecurityStatusFromAuthMethodsStatus(authMethodsStatus, options = {}) {
+  return buildCoreSecurityStatusFromAuthMethodsStatus(authMethodsStatus, options);
 }
 
 function findAuthMethodById(authMethodsStatus, methodId) {

package/src/server/lib/index.js

@@ -1,2 +1,2 @@
 export { createService, __testables } from "./service.js";
-export { baseAuthActions, buildAuthActions, devLoginAsAction } from "./actions/auth.contributor.js";
+export { devLoginAsAction } from "./actions/auth.contributor.js";

package/src/server/lib/passwordSecurityFlows.js

@@ -18,6 +18,7 @@ function createPasswordSecurityFlows(deps) {
     mapRecoveryError,
     syncProfileFromSupabaseUser,
     setSessionFromRequestCookies,
+    setRecoverySessionFromRequestCookies,
     resolvePasswordSignInPolicyForUserId,
     mapPasswordUpdateError,
     setPasswordSetupRequiredForUserId,
@@ -130,7 +131,10 @@ function createPasswordSecurityFlows(deps) {
 
     return {
       profile,
-      session
+      session: {
+        ...session,
+        purpose: "recovery"
+      }
     };
   }
 
@@ -144,7 +148,7 @@ function createPasswordSecurityFlows(deps) {
     const parsed = result.validatedObject;
 
     const supabase = getSupabaseClient();
-    const sessionResponse = await setSessionFromRequestCookies(request, {
+    const sessionResponse = await setRecoverySessionFromRequestCookies(request, {
       supabaseClient: supabase
     });
     const profile = await syncProfileFromSupabaseUser(
@@ -169,6 +173,14 @@ function createPasswordSecurityFlows(deps) {
 
     const updatedProfile = await syncProfileFromSupabaseUser(user, user.email);
     await setPasswordSetupRequiredForUserId(updatedProfile.id, false);
+
+    const signOutResponse = await supabase.auth.signOut({
+      scope: "local"
+    });
+
+    if (signOutResponse.error) {
+      throw mapAuthError(signOutResponse.error, Number(signOutResponse.error?.status || 400));
+    }
   }
 
   async function changePassword(request, payload) {