@livedesk/client 0.1.228 → 0.1.230

package/bin/livedesk-client.js

@@ -1154,9 +1154,99 @@ export async function fetchSupabaseWithDeadline(
     }
 }
 
+const LIVEDESK_AUTHENTICATED_FETCH = '__liveDeskAuthenticatedFetch';
+
+function decodeSupabaseJwtRole(accessToken) {
+    try {
+        const parts = String(accessToken || '').split('.');
+        if (parts.length !== 3) return '';
+        const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+        return String(payload?.role || '').trim().toLowerCase();
+    } catch {
+        return '';
+    }
+}
+
+function authenticatedSupabaseError(response, payload, fallback) {
+    const message = String(
+        payload?.message
+        || payload?.error_description
+        || payload?.error
+        || payload?.details
+        || fallback
+        || `Supabase request failed with HTTP ${response.status}.`
+    ).trim();
+    const error = new Error(message);
+    error.code = String(payload?.code || '').trim();
+    error.status = Number(response.status || 0);
+    error.details = String(payload?.details || '').trim();
+    error.hint = String(payload?.hint || '').trim();
+    return error;
+}
+
+export async function fetchAuthenticatedSupabaseJson(session, pathname, options = {}) {
+    const normalized = normalizeRuntimeAuthSession(session);
+    if (!normalized.ok) throw new Error(normalized.error);
+    const role = decodeSupabaseJwtRole(normalized.session.access_token);
+    if (role && role !== 'authenticated') {
+        throw new Error(`LiveDesk sign-in token has unexpected database role ${role}. Sign out and sign in again.`);
+    }
+    const cleanPath = String(pathname || '').replace(/^\/+/, '');
+    if (!cleanPath || cleanPath.includes('..')) throw new Error('invalid-supabase-rest-path');
+    const url = new URL(`${SUPABASE_URL.replace(/\/+$/, '')}/rest/v1/${cleanPath}`);
+    for (const [key, value] of Object.entries(options.query || {})) {
+        if (value === undefined || value === null || value === '') continue;
+        url.searchParams.set(key, String(value));
+    }
+    const headers = new Headers(options.headers || {});
+    headers.set('apikey', SUPABASE_PUBLISHABLE_KEY);
+    headers.set('Authorization', `Bearer ${normalized.session.access_token}`);
+    headers.set('Accept', 'application/json');
+    const method = String(options.method || 'GET').toUpperCase();
+    let body;
+    if (options.body !== undefined) {
+        headers.set('Content-Type', 'application/json');
+        body = JSON.stringify(options.body);
+    }
+    const fetchImpl = typeof options.fetchImpl === 'function'
+        ? options.fetchImpl
+        : fetchSupabaseWithDeadline;
+    const response = await fetchImpl(url, { method, headers, body, signal: options.signal });
+    const text = await response.text();
+    let payload = null;
+    if (text) {
+        try { payload = JSON.parse(text); }
+        catch { payload = { message: text }; }
+    }
+    if (!response.ok) throw authenticatedSupabaseError(response, payload, options.errorMessage);
+    return payload;
+}
+
+function explicitAuthenticatedFetch(supabase, override = null) {
+    if (typeof override === 'function') return override;
+    return typeof supabase?.[LIVEDESK_AUTHENTICATED_FETCH] === 'function'
+        ? supabase[LIVEDESK_AUTHENTICATED_FETCH]
+        : null;
+}
+
+export async function callVerifiedSupabaseRpc(supabase, session, functionName, args = {}, options = {}) {
+    const name = String(functionName || '').trim();
+    if (!/^[a-z0-9_]+$/u.test(name)) throw new Error('invalid-supabase-rpc-name');
+    const fetchImpl = explicitAuthenticatedFetch(supabase, options.fetchImpl);
+    if (!fetchImpl) return supabase.rpc(name, args);
+    const data = await fetchAuthenticatedSupabaseJson(session, `rpc/${name}`, {
+        method: 'POST',
+        body: args,
+        fetchImpl,
+        signal: options.signal,
+        errorMessage: `${name} failed.`
+    });
+    return { data, error: null };
+}
+
 async function createSupabaseClient() {
     const { createClient } = await import('@supabase/supabase-js');
-    return createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
+    const client = createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
         global: {
             fetch: fetchSupabaseWithDeadline
         },
@@ -1169,6 +1259,13 @@ async function createSupabaseClient() {
             storage: createFileStorage(preferredClientAuthPath())
         }
     });
+    Object.defineProperty(client, LIVEDESK_AUTHENTICATED_FETCH, {
+        value: fetchSupabaseWithDeadline,
+        enumerable: false,
+        configurable: false,
+        writable: false
+    });
+    return client;
 }
 
 function getNestedErrorCode(error) {
@@ -1383,14 +1480,10 @@ async function activateSupabaseSession(supabase, session) {
     if (!normalized.ok) {
         throw new Error(normalized.error);
     }
-    const { data: current } = await supabase.auth.getSession();
-    if (current?.session?.access_token === normalized.session.access_token) {
-        const activeSession = current.session;
-        if (!writeSavedSessionToFile(activeSession)) {
-            throw new Error('refresh-token-required');
-        }
-        return activeSession;
-    }
+    // Always install the verified session into this exact Supabase client.
+    // A freshly created client can read the persisted token through getSession()
+    // before PostgREST has adopted its Authorization header. Skipping setSession
+    // in that state makes the UI look signed in while table and RPC calls run as anon.
     const { data, error } = await supabase.auth.setSession({
         access_token: normalized.session.access_token,
         refresh_token: normalized.session.refresh_token
@@ -3152,7 +3245,7 @@ async function startConnectionChoiceServer(supabase, options = {}) {
                         dashboardState.choice?.session || savedSession
                     );
                     const expectedRoleVersion = Number(dashboardState.roleVersion || 0);
-                    const { data, error } = await enqueueDeviceRoleMutation(() => supabase.rpc('set_livedesk_device_role', {
+                    const { data, error } = await enqueueDeviceRoleMutation(() => callVerifiedSupabaseRpc(supabase, session, 'set_livedesk_device_role', {
                         p_device_id: deviceId,
                         p_role: 'hub',
                         p_assigned_hub_id: null,
@@ -3498,7 +3591,7 @@ async function chooseClientConnection(supabase, options = {}) {
                     };
                 }
                 const expectedRoleVersion = Number(snapshot?.roleVersion || 0);
-                const { data, error } = await enqueueDeviceRoleMutation(() => activeSupabase.rpc('set_livedesk_device_role', {
+                const { data, error } = await enqueueDeviceRoleMutation(() => callVerifiedSupabaseRpc(activeSupabase, session, 'set_livedesk_device_role', {
                     p_device_id: options.deviceId,
                     p_role: role,
                     p_assigned_hub_id: null,
@@ -4078,20 +4171,38 @@ export async function resolveManagerFromSupabase(supabase, options = {}) {
     if (options.signal?.aborted) {
         throw createHubDiscoveryError('hub-registry-aborted', 'LiveDesk Hub registry lookup was cancelled.');
     }
-    await refreshSessionIfNeeded(supabase);
+    const session = await refreshSessionIfNeeded(supabase);
+    if (!session?.access_token) {
+        throw createHubDiscoveryError('hub-registry-auth-required', 'Sign in again before finding the LiveDesk Hub.');
+    }
     if (options.signal?.aborted) {
         throw createHubDiscoveryError('hub-registry-aborted', 'LiveDesk Hub registry lookup was cancelled.');
     }
-    let query = supabase
-        .from('livedesk_remote_host_targets')
-        .select('node_id, endpoint, endpoint_candidates, pair_token, active, expires_at, updated_at, manager_version')
-        .eq('product_key', 'livedesk');
-    if (options.signal && typeof query.abortSignal === 'function') {
-        query = query.abortSignal(options.signal);
-    }
-    const { data, error } = await query.maybeSingle();
-    if (error) {
-        throw error;
+    const fetchImpl = explicitAuthenticatedFetch(supabase, options.fetchImpl);
+    let data;
+    if (fetchImpl) {
+        const payload = await fetchAuthenticatedSupabaseJson(session, 'livedesk_remote_host_targets', {
+            fetchImpl,
+            signal: options.signal,
+            query: {
+                select: 'node_id,endpoint,endpoint_candidates,pair_token,active,expires_at,updated_at,manager_version',
+                product_key: 'eq.livedesk',
+                limit: '1'
+            },
+            errorMessage: 'LiveDesk could not read the current Hub registration.'
+        });
+        data = Array.isArray(payload) ? payload[0] : payload;
+    } else {
+        let query = supabase
+            .from('livedesk_remote_host_targets')
+            .select('node_id, endpoint, endpoint_candidates, pair_token, active, expires_at, updated_at, manager_version')
+            .eq('product_key', 'livedesk');
+        if (options.signal && typeof query.abortSignal === 'function') {
+            query = query.abortSignal(options.signal);
+        }
+        const result = await query.maybeSingle();
+        if (result.error) throw result.error;
+        data = result.data;
     }
     if (!data?.active) {
         throw createHubDiscoveryError(
@@ -4152,7 +4263,7 @@ async function registerClientDeviceWithSupabase(supabase, options = {}) {
             if (roleRestartRequest?.role) {
                 return { data: { ok: false, skipped: true, reason: 'role-transition-pending' }, error: null };
             }
-            return supabase.rpc('register_livedesk_device', {
+            return callVerifiedSupabaseRpc(supabase, options.session, 'register_livedesk_device', {
                 p_device_id: options.deviceId,
                 p_device_name: options.deviceName || os.hostname(),
                 p_role: 'client',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/client",
-  "version": "0.1.228",
+  "version": "0.1.230",
   "description": "LiveDesk local remote client",
   "type": "module",
   "bin": {