@kamod-ch/otok-supabase 1.0.0

package/CHANGELOG.md

@@ -0,0 +1,16 @@
+# @kamod-ch/otok-supabase
+
+## 1.1.0
+
+### Minor Changes
+
+- 8380ef2: Add `@kamod-ch/otok-supabase` with SSR cookie auth, Hono middleware, plugin factory, loader helpers, and auth routes. Register the extension in the Otok registry and add the `with-supabase` example.
+
+### Patch Changes
+
+- Updated dependencies [8380ef2]
+  - @kamod-ch/otok@0.6.1
+
+## 1.0.0
+
+Initial release: SSR cookie auth, PKCE, Hono/Otok middleware, typed clients, auth routes, admin entry point, Otok plugin factory, loader helpers, storage/realtime entry points, and registry integration.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kamod
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,248 @@
+# @kamod-ch/otok-supabase
+
+Production-ready Supabase integration for [Otok](https://github.com/kamod-ch/otok) apps: SSR cookie sessions, PKCE, typed Hono middleware, auth routes, and optional route actions.
+
+> **Naming:** This repository publishes extensions as `@kamod-ch/otok-*`. The requested `@otok/supabase` name maps to **`@kamod-ch/otok-supabase`**.
+
+## 1. Purpose and boundaries
+
+This package solves Otok-specific integration concerns only:
+
+- Request/response cookie wiring for `@supabase/ssr`
+- Per-request SSR clients
+- Typed Hono context (`c.var.supabase`)
+- Auth middleware (`getClaims` / `getUser`)
+- Callback, email confirmation, and sign-out routes
+- Safe redirects and Otok-compatible error mapping
+
+It does **not** wrap Supabase queries, Realtime, Storage, or billing. Use `@supabase/supabase-js` directly through the provided clients.
+
+## 2. Installation
+
+```bash
+pnpm add @kamod-ch/otok-supabase @supabase/supabase-js
+```
+
+Peer dependencies: `otok`, `hono`, `@supabase/supabase-js`.
+
+## 3. Prepare your Supabase project
+
+1. Create a project at [supabase.com](https://supabase.com).
+2. Enable Email auth (password and/or magic link).
+3. Add site URL and redirect URLs for `/auth/callback` and `/auth/confirm`.
+4. Apply RLS policies for your tables (see example migration in `examples/with-supabase`).
+
+## 4. Environment variables
+
+Read env in your app and pass values explicitly:
+
+```env
+SUPABASE_URL=https://your-project.supabase.co
+SUPABASE_PUBLISHABLE_KEY=your-publishable-key
+SUPABASE_SERVICE_ROLE_KEY=server-only-service-role-key
+```
+
+Never expose the service role key to the browser.
+
+## 5. Server middleware
+
+### Otok plugin (recommended)
+
+```typescript
+import { defineConfig } from "@kamod-ch/otok";
+import supabase from "@kamod-ch/otok-supabase";
+
+export default defineConfig({
+  plugins: [
+    supabase<Database>({
+      url: env.SUPABASE_URL,
+      publishableKey: env.SUPABASE_PUBLISHABLE_KEY,
+      cookieOptions: { path: "/", sameSite: "lax", secure: true },
+      authRoutes: {
+        successRedirect: "/dashboard",
+        errorRedirect: "/login",
+        redirectAllowlist: ["/", "/dashboard"],
+      },
+    }),
+  ],
+});
+```
+
+The plugin mounts SSR middleware and auth routes via `configureApp`. For loaders, use `@kamod-ch/otok-supabase/loader`:
+
+```typescript
+import { defineLoader } from "@kamod-ch/otok-supabase/loader";
+
+export const loader = defineLoader<Database>(async ({ supabase }) => {
+  const { data } = await supabase.from("projects").select("*");
+  return { projects: data ?? [] };
+});
+```
+
+### Manual Hono middleware
+
+```typescript
+import { supabase } from "@kamod-ch/otok-supabase/server";
+import type { Database } from "./database.types";
+
+const app = new Hono();
+
+app.use(
+  "*",
+  supabase<Database>({
+    url: env.SUPABASE_URL,
+    publishableKey: env.SUPABASE_PUBLISHABLE_KEY,
+    cookieOptions: { path: "/", sameSite: "lax", secure: true },
+  }),
+);
+
+app.get("/projects", async (c) => {
+  const { data, error } = await c.var.supabase.from("projects").select("*");
+  if (error) throw error;
+  return c.json(data);
+});
+```
+
+In Otok apps, mount the same middleware in `createOtokApp({ configure })` — see `examples/with-supabase`.
+
+## 6. Browser client
+
+```typescript
+import { createOtokSupabaseBrowserClient } from "@kamod-ch/otok-supabase/browser";
+
+const supabase = createOtokSupabaseBrowserClient<Database>({
+  url: import.meta.env.SUPABASE_URL,
+  publishableKey: import.meta.env.SUPABASE_PUBLISHABLE_KEY,
+});
+```
+
+Call only in the browser (not at module import time on the server).
+
+## 7. Protect routes
+
+### Fast JWT check — `getClaims()`
+
+```typescript
+import { requireSupabaseAuth } from "@kamod-ch/otok-supabase/auth";
+
+app.use("/dashboard/*", requireSupabaseAuth({ redirectTo: "/login" }));
+app.get("/dashboard", (c) => c.json({ sub: c.var.supabaseClaims.sub }));
+```
+
+### Auth-server user — `getUser()`
+
+```typescript
+import { requireSupabaseUser } from "@kamod-ch/otok-supabase/auth";
+
+app.use("/account/*", requireSupabaseUser({ response: "json" }));
+```
+
+## 8. Callback routes
+
+```typescript
+import { createSupabaseAuthRoutes } from "@kamod-ch/otok-supabase/auth";
+
+createSupabaseAuthRoutes({
+  successRedirect: "/dashboard",
+  errorRedirect: "/login",
+  redirectAllowlist: ["/", "/dashboard", "/login"],
+}).mount(app);
+```
+
+Routes: `GET /auth/callback`, `GET /auth/confirm`, `POST /auth/signout`.
+
+## 9. Magic link
+
+Use `sendMagicLinkAction()` in a route action or call `supabase.auth.signInWithOtp()` from your own form handler. Configure `emailRedirectTo` to your callback/confirm URLs in Supabase.
+
+## 10. Generate database types
+
+```bash
+supabase gen types typescript \
+  --project-id "$SUPABASE_PROJECT_ID" \
+  --schema public \
+  > src/database.types.ts
+```
+
+## 11. Row Level Security
+
+Always enable RLS on user-facing tables. The example migration in `examples/with-supabase/supabase/migrations/` demonstrates profiles, projects, and project_members policies.
+
+## 12. Admin client
+
+```typescript
+import { createOtokSupabaseAdminClient } from "@kamod-ch/otok-supabase/admin";
+
+const admin = createOtokSupabaseAdminClient<Database>({
+  url: env.SUPABASE_URL,
+  serviceRoleKey: env.SUPABASE_SERVICE_ROLE_KEY,
+});
+```
+
+**Server only.** Bypasses RLS — never import from the root or browser entry points.
+
+## 13. Node deployment
+
+Pass env vars to your Node/Bun adapter as with any Otok app. Middleware uses standard Web APIs (`Headers`, `Request`, `Response`) — no Node-only cookie APIs.
+
+## 14. Cloudflare Workers
+
+Pass `SUPABASE_URL` and `SUPABASE_PUBLISHABLE_KEY` from Worker bindings into `supabase(config)` in your fetch handler or Otok Cloudflare adapter `configure` hook.
+
+## 15. Bun
+
+Same as Node — explicit config object, no `process.env` inside the library.
+
+## 16. Troubleshooting
+
+| Symptom           | Check                                                                         |
+| ----------------- | ----------------------------------------------------------------------------- |
+| Random logouts    | Ensure `supabase()` middleware runs on every request with `getAll` + `setAll` |
+| Redirect loops    | Verify `redirectAllowlist` includes post-login targets                        |
+| 401 on API routes | Set `Accept: application/json` or use `response: "json"`                      |
+| CSRF on sign-out  | Include `_csrf` field matching `otok_csrf` cookie                             |
+
+## 17. Security checklist
+
+- [ ] Publishable key only in browser/SSR client config
+- [ ] Service role key only in server/admin code
+- [ ] RLS enabled on all public tables
+- [ ] Redirect allowlist configured
+- [ ] HTTPS + `secure` cookies in production
+- [ ] Sign-out uses POST + CSRF
+
+## 18. `getClaims` vs `getUser` vs `getSession`
+
+| Method         | Use for                                                               |
+| -------------- | --------------------------------------------------------------------- |
+| `getClaims()`  | Fast route guards — local JWT verification (JWKS for asymmetric keys) |
+| `getUser()`    | Sensitive operations needing Auth-server confirmation                 |
+| `getSession()` | Cookie refresh inside middleware only — **not** authorization         |
+
+## 19. Working with `@kamod-ch/otok-oauth`
+
+Use OAuth for social login and Supabase for database/auth as separate layers, or map OAuth users into Supabase via admin API. Do not mix session cookies without a clear bridge strategy.
+
+## 20. `@supabase/ssr` caveats
+
+- Always implement both `getAll` and `setAll` when response headers can be set
+- Apply cache headers from `setAll` to prevent CDN session leakage
+- Cookie API is encapsulated in this package — pin versions and run tests when upgrading `@supabase/ssr`
+
+## API exports
+
+| Entry        | Exports                                                   |
+| ------------ | --------------------------------------------------------- |
+| `.`          | Config validation, errors, types, server middleware       |
+| `./server`   | `createOtokSupabaseServerClient`, cookie helpers          |
+| `./browser`  | `createOtokSupabaseBrowserClient`                         |
+| `./auth`     | Middleware, routes, actions, redirects                    |
+| `./admin`    | `createOtokSupabaseAdminClient`                           |
+| `./storage`  | `getSupabaseStorage` — Storage entry point                |
+| `./plugin`   | Plugin factory (same as root default export)              |
+| `./registry` | Runtime registry helpers                                  |
+| `./loader`   | `defineLoader` / `defineAction` with `supabase` injection |
+
+## License
+
+MIT

package/dist/admin/create-admin-client.d.ts

@@ -0,0 +1,4 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+import { type SupabaseAdminConfig } from "../config.js";
+export declare function createOtokSupabaseAdminClient<Database>(config: SupabaseAdminConfig): SupabaseClient<Database>;
+//# sourceMappingURL=create-admin-client.d.ts.map

package/dist/admin/create-admin-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-admin-client.d.ts","sourceRoot":"","sources":["../../src/admin/create-admin-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAA+B,KAAK,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAWrF,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,MAAM,EAAE,mBAAmB,GAAG,cAAc,CAAC,QAAQ,CAAC,CAY7G"}

package/dist/admin/create-admin-client.js

@@ -0,0 +1,22 @@
+import { createClient } from "@supabase/supabase-js";
+import WebSocket from "ws";
+import { validateSupabaseAdminConfig } from "../config.js";
+import { SupabaseConfigurationError } from "../errors.js";
+function assertServerRuntime() {
+    if (typeof window !== "undefined") {
+        throw new SupabaseConfigurationError("createOtokSupabaseAdminClient() is server-only and must not run in the browser.");
+    }
+}
+export function createOtokSupabaseAdminClient(config) {
+    assertServerRuntime();
+    const validated = validateSupabaseAdminConfig(config);
+    return createClient(validated.url, validated.serviceRoleKey, {
+        auth: {
+            autoRefreshToken: false,
+            persistSession: false,
+            detectSessionInUrl: false,
+        },
+        realtime: { transport: WebSocket },
+    });
+}
+//# sourceMappingURL=create-admin-client.js.map

package/dist/admin/create-admin-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-admin-client.js","sourceRoot":"","sources":["../../src/admin/create-admin-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAA4B,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAE1D,SAAS,mBAAmB;IAC1B,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,0BAA0B,CAClC,iFAAiF,CAClF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAW,MAA2B;IACjF,mBAAmB,EAAE,CAAC;IACtB,MAAM,SAAS,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAEtD,OAAO,YAAY,CAAW,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,cAAc,EAAE;QACrE,IAAI,EAAE;YACJ,gBAAgB,EAAE,KAAK;YACvB,cAAc,EAAE,KAAK;YACrB,kBAAkB,EAAE,KAAK;SAC1B;QACD,QAAQ,EAAE,EAAE,SAAS,EAAE,SAAkB,EAAE;KAC5C,CAA6B,CAAC;AACjC,CAAC"}

package/dist/admin/index.d.ts

@@ -0,0 +1,2 @@
+export { createOtokSupabaseAdminClient } from "./create-admin-client.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/admin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/admin/index.js

@@ -0,0 +1,2 @@
+export { createOtokSupabaseAdminClient } from "./create-admin-client.js";
+//# sourceMappingURL=index.js.map

package/dist/admin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/auth/actions.d.ts

@@ -0,0 +1,13 @@
+import type { OtokActionContext } from "@kamod-ch/otok/server";
+import type { SupabaseActionResult } from "../types.js";
+export interface SupabasePasswordActionOptions {
+    successRedirect?: string;
+    redirectAllowlist?: readonly string[];
+}
+export declare function signInWithPasswordAction(options?: SupabasePasswordActionOptions): (ctx: OtokActionContext) => Promise<SupabaseActionResult>;
+export declare function signUpAction(options?: SupabasePasswordActionOptions): (ctx: OtokActionContext) => Promise<SupabaseActionResult>;
+export declare function sendMagicLinkAction(options?: SupabasePasswordActionOptions): (ctx: OtokActionContext) => Promise<SupabaseActionResult>;
+export declare function requestPasswordResetAction(options?: SupabasePasswordActionOptions): (ctx: OtokActionContext) => Promise<SupabaseActionResult>;
+export declare function updatePasswordAction(options?: SupabasePasswordActionOptions): (ctx: OtokActionContext) => Promise<SupabaseActionResult>;
+export declare function signOutAction(options?: SupabasePasswordActionOptions): (ctx: OtokActionContext) => Promise<SupabaseActionResult>;
+//# sourceMappingURL=actions.d.ts.map

package/dist/auth/actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/auth/actions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAK/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AA0BxD,MAAM,WAAW,6BAA6B;IAC5C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,6BAAkC,IACpE,KAAK,iBAAiB,KAAG,OAAO,CAAC,oBAAoB,CAAC,CAerE;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAE,6BAAkC,IACxD,KAAK,iBAAiB,KAAG,OAAO,CAAC,oBAAoB,CAAC,CAerE;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,6BAAkC,IAC/D,KAAK,iBAAiB,KAAG,OAAO,CAAC,oBAAoB,CAAC,CAkBrE;AAED,wBAAgB,0BAA0B,CAAC,OAAO,GAAE,6BAAkC,IACtE,KAAK,iBAAiB,KAAG,OAAO,CAAC,oBAAoB,CAAC,CAerE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,6BAAkC,IAChE,KAAK,iBAAiB,KAAG,OAAO,CAAC,oBAAoB,CAAC,CAcrE;AAED,wBAAgB,aAAa,CAAC,OAAO,GAAE,6BAAkC,IACzD,KAAK,iBAAiB,KAAG,OAAO,CAAC,oBAAoB,CAAC,CAarE"}

package/dist/auth/actions.js

@@ -0,0 +1,98 @@
+import { fail, redirect, validationError } from "@kamod-ch/otok/server";
+import { isDataRequest } from "@kamod-ch/otok/shared";
+import { supabaseFromHono } from "../context.js";
+import { mapSupabaseError } from "../errors.js";
+import { resolveAuthRedirect } from "./redirects.js";
+function requireField(formData, name) {
+    const value = String(formData?.get(name) ?? "").trim();
+    if (!value) {
+        validationError({ fieldErrors: { [name]: [`${name} is required.`] } });
+    }
+    return value;
+}
+function actionRedirectOrJson(c, target, data) {
+    if (isDataRequest(c.request)) {
+        return { ok: true, data, redirect: target };
+    }
+    redirect(target, 303);
+}
+function handleAuthActionError(error, fallback) {
+    const failure = mapSupabaseError(error, fallback);
+    if (failure.fieldErrors) {
+        validationError({ message: failure.message, fieldErrors: failure.fieldErrors }, failure.status === 422 ? 422 : 400);
+    }
+    fail(failure.status, failure);
+}
+export function signInWithPasswordAction(options = {}) {
+    return async (ctx) => {
+        const email = requireField(ctx.formData, "email");
+        const password = requireField(ctx.formData, "password");
+        const supabase = supabaseFromHono(ctx.hono);
+        const { data, error } = await supabase.auth.signInWithPassword({ email, password });
+        if (error)
+            handleAuthActionError(error, "Sign in failed.");
+        const target = resolveAuthRedirect(String(ctx.formData?.get("returnTo") ?? ""), options.successRedirect ?? "/dashboard", options.redirectAllowlist);
+        return actionRedirectOrJson(ctx, target, { user: data.user });
+    };
+}
+export function signUpAction(options = {}) {
+    return async (ctx) => {
+        const email = requireField(ctx.formData, "email");
+        const password = requireField(ctx.formData, "password");
+        const supabase = supabaseFromHono(ctx.hono);
+        const { data, error } = await supabase.auth.signUp({ email, password });
+        if (error)
+            handleAuthActionError(error, "Sign up failed.");
+        const target = resolveAuthRedirect(String(ctx.formData?.get("returnTo") ?? ""), options.successRedirect ?? "/dashboard", options.redirectAllowlist);
+        return actionRedirectOrJson(ctx, target, { user: data.user });
+    };
+}
+export function sendMagicLinkAction(options = {}) {
+    return async (ctx) => {
+        const email = requireField(ctx.formData, "email");
+        const supabase = supabaseFromHono(ctx.hono);
+        const emailRedirectTo = String(ctx.formData?.get("emailRedirectTo") ?? "").trim() || undefined;
+        const { error } = await supabase.auth.signInWithOtp({
+            email,
+            options: emailRedirectTo ? { emailRedirectTo } : undefined,
+        });
+        if (error)
+            handleAuthActionError(error, "Magic link request failed.");
+        const target = resolveAuthRedirect(String(ctx.formData?.get("returnTo") ?? ""), options.successRedirect ?? "/login?checkEmail=1", options.redirectAllowlist);
+        return actionRedirectOrJson(ctx, target, { sent: true });
+    };
+}
+export function requestPasswordResetAction(options = {}) {
+    return async (ctx) => {
+        const email = requireField(ctx.formData, "email");
+        const supabase = supabaseFromHono(ctx.hono);
+        const redirectTo = String(ctx.formData?.get("redirectTo") ?? "").trim() || undefined;
+        const { error } = await supabase.auth.resetPasswordForEmail(email, redirectTo ? { redirectTo } : undefined);
+        if (error)
+            handleAuthActionError(error, "Password reset request failed.");
+        const target = resolveAuthRedirect(String(ctx.formData?.get("returnTo") ?? ""), options.successRedirect ?? "/login?resetSent=1", options.redirectAllowlist);
+        return actionRedirectOrJson(ctx, target, { sent: true });
+    };
+}
+export function updatePasswordAction(options = {}) {
+    return async (ctx) => {
+        const password = requireField(ctx.formData, "password");
+        const supabase = supabaseFromHono(ctx.hono);
+        const { data, error } = await supabase.auth.updateUser({ password });
+        if (error)
+            handleAuthActionError(error, "Password update failed.");
+        const target = resolveAuthRedirect(String(ctx.formData?.get("returnTo") ?? ""), options.successRedirect ?? "/dashboard", options.redirectAllowlist);
+        return actionRedirectOrJson(ctx, target, { user: data.user });
+    };
+}
+export function signOutAction(options = {}) {
+    return async (ctx) => {
+        const supabase = supabaseFromHono(ctx.hono);
+        const { error } = await supabase.auth.signOut();
+        if (error)
+            handleAuthActionError(error, "Sign out failed.");
+        const target = resolveAuthRedirect(String(ctx.formData?.get("returnTo") ?? ""), options.successRedirect ?? "/login", options.redirectAllowlist);
+        return actionRedirectOrJson(ctx, target, { signedOut: true });
+    };
+}
+//# sourceMappingURL=actions.js.map

package/dist/auth/actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/auth/actions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,SAAS,YAAY,CAAC,QAA8B,EAAE,IAAY;IAChE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,eAAe,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAoB,EAAE,MAAc,EAAE,IAAc;IAChF,IAAI,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;IACD,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc,EAAE,QAAgB;IAC7D,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAA6D,EAAE,QAAQ,CAAC,CAAC;IAC1G,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACtH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAChC,CAAC;AAOD,MAAM,UAAU,wBAAwB,CAAC,UAAyC,EAAE;IAClF,OAAO,KAAK,EAAE,GAAsB,EAAiC,EAAE;QACrE,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,IAAI,KAAK;YAAE,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,mBAAmB,CAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAC3C,OAAO,CAAC,eAAe,IAAI,YAAY,EACvC,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QACF,OAAO,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,UAAyC,EAAE;IACtE,OAAO,KAAK,EAAE,GAAsB,EAAiC,EAAE;QACrE,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxE,IAAI,KAAK;YAAE,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,mBAAmB,CAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAC3C,OAAO,CAAC,eAAe,IAAI,YAAY,EACvC,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QACF,OAAO,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,UAAyC,EAAE;IAC7E,OAAO,KAAK,EAAE,GAAsB,EAAiC,EAAE;QACrE,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;QAC/F,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC;YAClD,KAAK;YACL,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3D,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,qBAAqB,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;QAEtE,MAAM,MAAM,GAAG,mBAAmB,CAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAC3C,OAAO,CAAC,eAAe,IAAI,qBAAqB,EAChD,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QACF,OAAO,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,UAAyC,EAAE;IACpF,OAAO,KAAK,EAAE,GAAsB,EAAiC,EAAE;QACrE,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;QACrF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5G,IAAI,KAAK;YAAE,qBAAqB,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;QAE1E,MAAM,MAAM,GAAG,mBAAmB,CAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAC3C,OAAO,CAAC,eAAe,IAAI,oBAAoB,EAC/C,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QACF,OAAO,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,UAAyC,EAAE;IAC9E,OAAO,KAAK,EAAE,GAAsB,EAAiC,EAAE;QACrE,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrE,IAAI,KAAK;YAAE,qBAAqB,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;QAEnE,MAAM,MAAM,GAAG,mBAAmB,CAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAC3C,OAAO,CAAC,eAAe,IAAI,YAAY,EACvC,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QACF,OAAO,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAAyC,EAAE;IACvE,OAAO,KAAK,EAAE,GAAsB,EAAiC,EAAE;QACrE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAChD,IAAI,KAAK;YAAE,qBAAqB,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;QAE5D,MAAM,MAAM,GAAG,mBAAmB,CAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAC3C,OAAO,CAAC,eAAe,IAAI,QAAQ,EACnC,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QACF,OAAO,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,4 @@
+export { requireSupabaseAuth, requireSupabaseUser, requireSupabaseAuthAndUser, safeRedirectPath, resolveAuthRedirect, isApiLikeRequest, prefersHtmlResponse, } from "./middleware.js";
+export { createSupabaseAuthRoutes, type SupabaseAuthRoutes } from "./routes.js";
+export { signInWithPasswordAction, signUpAction, sendMagicLinkAction, requestPasswordResetAction, updatePasswordAction, signOutAction, } from "./actions.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,wBAAwB,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EACL,wBAAwB,EACxB,YAAY,EACZ,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,aAAa,GACd,MAAM,cAAc,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,4 @@
+export { requireSupabaseAuth, requireSupabaseUser, requireSupabaseAuthAndUser, safeRedirectPath, resolveAuthRedirect, isApiLikeRequest, prefersHtmlResponse, } from "./middleware.js";
+export { createSupabaseAuthRoutes } from "./routes.js";
+export { signInWithPasswordAction, signUpAction, sendMagicLinkAction, requestPasswordResetAction, updatePasswordAction, signOutAction, } from "./actions.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,wBAAwB,EAA2B,MAAM,aAAa,CAAC;AAChF,OAAO,EACL,wBAAwB,EACxB,YAAY,EACZ,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,aAAa,GACd,MAAM,cAAc,CAAC"}

package/dist/auth/middleware.d.ts

@@ -0,0 +1,7 @@
+import type { MiddlewareHandler } from "hono";
+import type { RequireSupabaseAuthOptions, RequireSupabaseUserOptions, SupabaseAuthClaimsEnv, SupabaseAuthFullEnv, SupabaseAuthUserEnv } from "../types.js";
+export declare function requireSupabaseAuth<Database = unknown>(options?: RequireSupabaseAuthOptions): MiddlewareHandler<SupabaseAuthClaimsEnv<Database>>;
+export declare function requireSupabaseUser<Database = unknown>(options?: RequireSupabaseUserOptions): MiddlewareHandler<SupabaseAuthUserEnv<Database>>;
+export declare function requireSupabaseAuthAndUser<Database = unknown>(options?: RequireSupabaseUserOptions): MiddlewareHandler<SupabaseAuthFullEnv<Database>>;
+export { safeRedirectPath, resolveAuthRedirect, isApiLikeRequest, prefersHtmlResponse } from "./redirects.js";
+//# sourceMappingURL=middleware.d.ts.map

package/dist/auth/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAW,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEvD,OAAO,KAAK,EACV,0BAA0B,EAC1B,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,aAAa,CAAC;AAuBrB,wBAAgB,mBAAmB,CAAC,QAAQ,GAAG,OAAO,EACpD,OAAO,GAAE,0BAA+B,GACvC,iBAAiB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAYpD;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,GAAG,OAAO,EACpD,OAAO,GAAE,0BAA+B,GACvC,iBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAoBlD;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,GAAG,OAAO,EAC3D,OAAO,GAAE,0BAA+B,GACvC,iBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAoBlD;AAED,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/auth/middleware.js

@@ -0,0 +1,70 @@
+import { createMiddleware } from "hono/factory";
+import { isDataRequest } from "@kamod-ch/otok/shared";
+import { mapSupabaseError } from "../errors.js";
+import { isApiLikeRequest, prefersHtmlResponse, resolveAuthRedirect, safeRedirectPath } from "./redirects.js";
+function resolveRedirectTarget(c, options) {
+    const requested = c.req.query("returnTo") ?? c.req.query("next");
+    const fallback = options.redirectTo ?? "/login";
+    return resolveAuthRedirect(requested, fallback, options.redirectAllowlist);
+}
+function handleUnauthenticated(c, options) {
+    const request = c.req.raw;
+    const responseMode = options.response ?? (prefersHtmlResponse(request) ? "redirect" : "json");
+    const redirectTarget = resolveRedirectTarget(c, options);
+    if (responseMode === "redirect" && !isApiLikeRequest(request) && !isDataRequest(request)) {
+        const location = safeRedirectPath(redirectTarget, options.redirectAllowlist ?? ["/"]) ?? "/login";
+        return c.redirect(location, 303);
+    }
+    return c.json({ status: 401, message: "Authentication required." }, 401);
+}
+export function requireSupabaseAuth(options = {}) {
+    return createMiddleware(async (c, next) => {
+        const supabase = c.var.supabase;
+        const { data, error } = await supabase.auth.getClaims();
+        if (error || !data?.claims) {
+            return handleUnauthenticated(c, options);
+        }
+        c.set("supabaseClaims", data.claims);
+        await next();
+    });
+}
+export function requireSupabaseUser(options = {}) {
+    return createMiddleware(async (c, next) => {
+        const supabase = c.var.supabase;
+        const { data, error } = await supabase.auth.getUser();
+        if (error) {
+            const failure = mapSupabaseError(error, "Authentication required.");
+            if (failure.status === 401) {
+                return handleUnauthenticated(c, options);
+            }
+            return c.json(failure, failure.status);
+        }
+        if (!data.user) {
+            return handleUnauthenticated(c, options);
+        }
+        c.set("supabaseUser", data.user);
+        await next();
+    });
+}
+export function requireSupabaseAuthAndUser(options = {}) {
+    return createMiddleware(async (c, next) => {
+        const supabase = c.var.supabase;
+        const claimsResult = await supabase.auth.getClaims();
+        if (claimsResult.error || !claimsResult.data?.claims) {
+            return handleUnauthenticated(c, options);
+        }
+        c.set("supabaseClaims", claimsResult.data.claims);
+        const userResult = await supabase.auth.getUser();
+        if (userResult.error) {
+            const failure = mapSupabaseError(userResult.error, "Authentication required.");
+            return c.json(failure, failure.status);
+        }
+        if (!userResult.data.user) {
+            return handleUnauthenticated(c, options);
+        }
+        c.set("supabaseUser", userResult.data.user);
+        await next();
+    });
+}
+export { safeRedirectPath, resolveAuthRedirect, isApiLikeRequest, prefersHtmlResponse } from "./redirects.js";
+//# sourceMappingURL=middleware.js.map

package/dist/auth/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAQtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAE9G,SAAS,qBAAqB,CAAC,CAAU,EAAE,OAAmC;IAC5E,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAC;IAChD,OAAO,mBAAmB,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAU,EAAE,OAAmC;IAC5E,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1B,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9F,MAAM,cAAc,GAAG,qBAAqB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAEzD,IAAI,YAAY,KAAK,UAAU,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QACzF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,cAAc,EAAE,OAAO,CAAC,iBAAiB,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC;QAClG,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,0BAA0B,EAAE,EAAE,GAAG,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,UAAsC,EAAE;IAExC,OAAO,gBAAgB,CAAkC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACzE,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAExD,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC3B,OAAO,qBAAqB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,UAAsC,EAAE;IAExC,OAAO,gBAAgB,CAAgC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvE,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAEtD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;YACpE,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC3B,OAAO,qBAAqB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,MAAa,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,qBAAqB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,UAAsC,EAAE;IAExC,OAAO,gBAAgB,CAAgC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvE,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACrD,IAAI,YAAY,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YACrD,OAAO,qBAAqB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAElD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACjD,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;YAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,MAAa,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,OAAO,qBAAqB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/auth/redirects.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Validates a post-auth redirect target against an allowlist.
+ * Only same-origin relative paths are accepted; `//` and external URLs are rejected.
+ */
+export declare function safeRedirectPath(raw: string | null | undefined, allowlist?: readonly string[]): string | null;
+export declare function resolveAuthRedirect(requested: string | null | undefined, fallback: string, allowlist?: readonly string[]): string;
+export declare function isApiLikeRequest(request: Request): boolean;
+export declare function prefersHtmlResponse(request: Request): boolean;
+//# sourceMappingURL=redirects.d.ts.map

package/dist/auth/redirects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirects.d.ts","sourceRoot":"","sources":["../../src/auth/redirects.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC9B,SAAS,GAAE,SAAS,MAAM,EAAsB,GAC/C,MAAM,GAAG,IAAI,CAWf;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,SAAS,MAAM,EAAsB,GAC/C,MAAM,CASR;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAO1D;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAG7D"}

package/dist/auth/redirects.js

@@ -0,0 +1,45 @@
+import { SupabaseAuthError } from "../errors.js";
+const DEFAULT_ALLOWLIST = ["/"];
+/**
+ * Validates a post-auth redirect target against an allowlist.
+ * Only same-origin relative paths are accepted; `//` and external URLs are rejected.
+ */
+export function safeRedirectPath(raw, allowlist = DEFAULT_ALLOWLIST) {
+    if (!raw)
+        return null;
+    if (!raw.startsWith("/") || raw.startsWith("//"))
+        return null;
+    const allowed = allowlist.length > 0 ? allowlist : DEFAULT_ALLOWLIST;
+    const matches = allowed.some((prefix) => {
+        if (prefix === "/")
+            return true;
+        return raw === prefix || raw.startsWith(`${prefix}/`);
+    });
+    return matches ? raw : null;
+}
+export function resolveAuthRedirect(requested, fallback, allowlist = DEFAULT_ALLOWLIST) {
+    const safe = safeRedirectPath(requested, allowlist);
+    if (!safe) {
+        if (requested) {
+            throw new SupabaseAuthError("Unsafe redirect target.", 400);
+        }
+        return fallback;
+    }
+    return safe;
+}
+export function isApiLikeRequest(request) {
+    const accept = request.headers.get("accept") ?? "";
+    if (accept.includes("application/json"))
+        return true;
+    if (accept.includes("application/vnd.otok+json"))
+        return true;
+    if (request.headers.get("x-otok-data") === "1")
+        return true;
+    const requestedWith = request.headers.get("x-requested-with");
+    return requestedWith?.toLowerCase() === "xmlhttprequest";
+}
+export function prefersHtmlResponse(request) {
+    const accept = request.headers.get("accept") ?? "";
+    return accept.includes("text/html") || (!isApiLikeRequest(request) && !accept.includes("application/json"));
+}
+//# sourceMappingURL=redirects.js.map