@lifeaitools/clauth 0.7.5 → 1.1.0

package/supabase/functions/auth-vault/index.ts

@@ -119,12 +119,27 @@ async function handleEnable(sb: any, body: any, mh: string) {
 }
 
 async function handleAdd(sb: any, body: any, mh: string) {
-  const { name, label, key_type, description } = body;
+  const { name, label, key_type, description, project } = body;
   if (!name || !label || !key_type) return { error: "name, label, key_type required" };
-  const { error } = await sb.from("clauth_services").insert({ name, label, key_type, description: description || null });
+  const row: any = { name, label, key_type, description: description || null };
+  if (project) row.project = project;
+  const { error } = await sb.from("clauth_services").insert(row);
   if (error) return { error: error.message };
   await auditLog(sb, mh, name, "add", "success");
-  return { success: true, name, label, key_type };
+  return { success: true, name, label, key_type, project: project || null };
+}
+
+async function handleUpdate(sb: any, body: any, mh: string) {
+  const { service, project, label, description } = body;
+  if (!service) return { error: "service required" };
+  const updates: any = { updated_at: new Date().toISOString() };
+  if (project !== undefined) updates.project = project || null; // empty string clears project
+  if (label !== undefined) updates.label = label;
+  if (description !== undefined) updates.description = description || null;
+  const { error } = await sb.from("clauth_services").update(updates).eq("name", service);
+  if (error) return { error: error.message };
+  await auditLog(sb, mh, service, "update", "success", `fields: ${Object.keys(updates).join(", ")}`);
+  return { success: true, service, ...updates };
 }
 
 async function handleRemove(sb: any, body: any, mh: string) {
@@ -152,9 +167,13 @@ async function handleRevoke(sb: any, body: any, mh: string) {
   return { success: true, service };
 }
 
-async function handleStatus(sb: any, mh: string) {
-  const { data: services } = await sb.from("clauth_services")
-    .select("name, label, key_type, enabled, vault_key, last_retrieved, last_rotated, created_at").order("name");
+async function handleStatus(sb: any, body: any, mh: string) {
+  let q = sb.from("clauth_services")
+    .select("name, label, key_type, enabled, vault_key, last_retrieved, last_rotated, created_at, project")
+    .order("project", { ascending: true, nullsFirst: true })
+    .order("name");
+  if (body.project) q = q.eq("project", body.project);
+  const { data: services } = await q;
   await auditLog(sb, mh, "all", "status", "success");
   return { services: services || [] };
 }
@@ -225,9 +244,10 @@ Deno.serve(async (req: Request) => {
     case "write":    return Response.json(await handleWrite(sb, body, mh));
     case "enable":   return Response.json(await handleEnable(sb, body, mh));
     case "add":      return Response.json(await handleAdd(sb, body, mh));
+    case "update":   return Response.json(await handleUpdate(sb, body, mh));
     case "remove":   return Response.json(await handleRemove(sb, body, mh));
     case "revoke":   return Response.json(await handleRevoke(sb, body, mh));
-    case "status":          return Response.json(await handleStatus(sb, mh));
+    case "status":          return Response.json(await handleStatus(sb, body, mh));
     case "change-password": return Response.json(await handleChangePassword(sb, body, mh));
     case "test":            return Response.json({ valid: true, machine_hash: mh, timestamp: body.timestamp, ip });
     default:         return Response.json({ error: "unknown_route", route }, { status: 404 });

package/supabase/migrations/003_clauth_config.sql

@@ -0,0 +1,13 @@
+-- clauth_config: key/value store for daemon configuration
+-- Used to persist tunnel hostname and other daemon settings
+CREATE TABLE IF NOT EXISTS clauth_config (
+  key        text PRIMARY KEY,
+  value      jsonb NOT NULL,
+  updated_at timestamptz DEFAULT now()
+);
+
+-- RLS: only service role can access (same pattern as other clauth tables)
+ALTER TABLE clauth_config ENABLE ROW LEVEL SECURITY;
+
+-- Seed: no tunnel by default (user must run clauth tunnel setup)
+-- INSERT INTO clauth_config (key, value) VALUES ('tunnel_hostname', 'null');