@livedesk/client 0.1.229 → 0.1.231

package/bin/livedesk-client.js

@@ -1154,9 +1154,99 @@ export async function fetchSupabaseWithDeadline(
     }
 }
 
+const LIVEDESK_AUTHENTICATED_FETCH = '__liveDeskAuthenticatedFetch';
+
+function decodeSupabaseJwtRole(accessToken) {
+    try {
+        const parts = String(accessToken || '').split('.');
+        if (parts.length !== 3) return '';
+        const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+        return String(payload?.role || '').trim().toLowerCase();
+    } catch {
+        return '';
+    }
+}
+
+function authenticatedSupabaseError(response, payload, fallback) {
+    const message = String(
+        payload?.message
+        || payload?.error_description
+        || payload?.error
+        || payload?.details
+        || fallback
+        || `Supabase request failed with HTTP ${response.status}.`
+    ).trim();
+    const error = new Error(message);
+    error.code = String(payload?.code || '').trim();
+    error.status = Number(response.status || 0);
+    error.details = String(payload?.details || '').trim();
+    error.hint = String(payload?.hint || '').trim();
+    return error;
+}
+
+export async function fetchAuthenticatedSupabaseJson(session, pathname, options = {}) {
+    const normalized = normalizeRuntimeAuthSession(session);
+    if (!normalized.ok) throw new Error(normalized.error);
+    const role = decodeSupabaseJwtRole(normalized.session.access_token);
+    if (role && role !== 'authenticated') {
+        throw new Error(`LiveDesk sign-in token has unexpected database role ${role}. Sign out and sign in again.`);
+    }
+    const cleanPath = String(pathname || '').replace(/^\/+/, '');
+    if (!cleanPath || cleanPath.includes('..')) throw new Error('invalid-supabase-rest-path');
+    const url = new URL(`${SUPABASE_URL.replace(/\/+$/, '')}/rest/v1/${cleanPath}`);
+    for (const [key, value] of Object.entries(options.query || {})) {
+        if (value === undefined || value === null || value === '') continue;
+        url.searchParams.set(key, String(value));
+    }
+    const headers = new Headers(options.headers || {});
+    headers.set('apikey', SUPABASE_PUBLISHABLE_KEY);
+    headers.set('Authorization', `Bearer ${normalized.session.access_token}`);
+    headers.set('Accept', 'application/json');
+    const method = String(options.method || 'GET').toUpperCase();
+    let body;
+    if (options.body !== undefined) {
+        headers.set('Content-Type', 'application/json');
+        body = JSON.stringify(options.body);
+    }
+    const fetchImpl = typeof options.fetchImpl === 'function'
+        ? options.fetchImpl
+        : fetchSupabaseWithDeadline;
+    const response = await fetchImpl(url, { method, headers, body, signal: options.signal });
+    const text = await response.text();
+    let payload = null;
+    if (text) {
+        try { payload = JSON.parse(text); }
+        catch { payload = { message: text }; }
+    }
+    if (!response.ok) throw authenticatedSupabaseError(response, payload, options.errorMessage);
+    return payload;
+}
+
+function explicitAuthenticatedFetch(supabase, override = null) {
+    if (typeof override === 'function') return override;
+    return typeof supabase?.[LIVEDESK_AUTHENTICATED_FETCH] === 'function'
+        ? supabase[LIVEDESK_AUTHENTICATED_FETCH]
+        : null;
+}
+
+export async function callVerifiedSupabaseRpc(supabase, session, functionName, args = {}, options = {}) {
+    const name = String(functionName || '').trim();
+    if (!/^[a-z0-9_]+$/u.test(name)) throw new Error('invalid-supabase-rpc-name');
+    const fetchImpl = explicitAuthenticatedFetch(supabase, options.fetchImpl);
+    if (!fetchImpl) return supabase.rpc(name, args);
+    const data = await fetchAuthenticatedSupabaseJson(session, `rpc/${name}`, {
+        method: 'POST',
+        body: args,
+        fetchImpl,
+        signal: options.signal,
+        errorMessage: `${name} failed.`
+    });
+    return { data, error: null };
+}
+
 async function createSupabaseClient() {
     const { createClient } = await import('@supabase/supabase-js');
-    return createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
+    const client = createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
         global: {
             fetch: fetchSupabaseWithDeadline
         },
@@ -1169,6 +1259,13 @@ async function createSupabaseClient() {
             storage: createFileStorage(preferredClientAuthPath())
         }
     });
+    Object.defineProperty(client, LIVEDESK_AUTHENTICATED_FETCH, {
+        value: fetchSupabaseWithDeadline,
+        enumerable: false,
+        configurable: false,
+        writable: false
+    });
+    return client;
 }
 
 function getNestedErrorCode(error) {
@@ -3148,7 +3245,7 @@ async function startConnectionChoiceServer(supabase, options = {}) {
                         dashboardState.choice?.session || savedSession
                     );
                     const expectedRoleVersion = Number(dashboardState.roleVersion || 0);
-                    const { data, error } = await enqueueDeviceRoleMutation(() => supabase.rpc('set_livedesk_device_role', {
+                    const { data, error } = await enqueueDeviceRoleMutation(() => callVerifiedSupabaseRpc(supabase, session, 'set_livedesk_device_role', {
                         p_device_id: deviceId,
                         p_role: 'hub',
                         p_assigned_hub_id: null,
@@ -3494,7 +3591,7 @@ async function chooseClientConnection(supabase, options = {}) {
                     };
                 }
                 const expectedRoleVersion = Number(snapshot?.roleVersion || 0);
-                const { data, error } = await enqueueDeviceRoleMutation(() => activeSupabase.rpc('set_livedesk_device_role', {
+                const { data, error } = await enqueueDeviceRoleMutation(() => callVerifiedSupabaseRpc(activeSupabase, session, 'set_livedesk_device_role', {
                     p_device_id: options.deviceId,
                     p_role: role,
                     p_assigned_hub_id: null,
@@ -4074,20 +4171,45 @@ export async function resolveManagerFromSupabase(supabase, options = {}) {
     if (options.signal?.aborted) {
         throw createHubDiscoveryError('hub-registry-aborted', 'LiveDesk Hub registry lookup was cancelled.');
     }
-    await refreshSessionIfNeeded(supabase);
+    const fetchImpl = explicitAuthenticatedFetch(supabase, options.fetchImpl);
+    const supplied = normalizeRuntimeAuthSession(options.session, { requireRefreshToken: true });
+    const suppliedExpiresAt = Number(supplied.session?.expires_at || 0);
+    const suppliedFresh = supplied.ok && (suppliedExpiresAt <= 0
+        || suppliedExpiresAt - Math.floor(Date.now() / 1000) > SESSION_REFRESH_SKEW_SECONDS);
+    let session = suppliedFresh ? supplied.session : await refreshSessionIfNeeded(supabase);
+    if (!session?.access_token) {
+        throw createHubDiscoveryError('hub-registry-auth-required', 'Sign in again before finding the LiveDesk Hub.');
+    }
+    if (!fetchImpl && suppliedFresh) {
+        session = await activateSupabaseSession(supabase, session);
+    }
     if (options.signal?.aborted) {
         throw createHubDiscoveryError('hub-registry-aborted', 'LiveDesk Hub registry lookup was cancelled.');
     }
-    let query = supabase
-        .from('livedesk_remote_host_targets')
-        .select('node_id, endpoint, endpoint_candidates, pair_token, active, expires_at, updated_at, manager_version')
-        .eq('product_key', 'livedesk');
-    if (options.signal && typeof query.abortSignal === 'function') {
-        query = query.abortSignal(options.signal);
-    }
-    const { data, error } = await query.maybeSingle();
-    if (error) {
-        throw error;
+    let data;
+    if (fetchImpl) {
+        const payload = await fetchAuthenticatedSupabaseJson(session, 'livedesk_remote_host_targets', {
+            fetchImpl,
+            signal: options.signal,
+            query: {
+                select: 'node_id,endpoint,endpoint_candidates,pair_token,active,expires_at,updated_at,manager_version',
+                product_key: 'eq.livedesk',
+                limit: '1'
+            },
+            errorMessage: 'LiveDesk could not read the current Hub registration.'
+        });
+        data = Array.isArray(payload) ? payload[0] : payload;
+    } else {
+        let query = supabase
+            .from('livedesk_remote_host_targets')
+            .select('node_id, endpoint, endpoint_candidates, pair_token, active, expires_at, updated_at, manager_version')
+            .eq('product_key', 'livedesk');
+        if (options.signal && typeof query.abortSignal === 'function') {
+            query = query.abortSignal(options.signal);
+        }
+        const result = await query.maybeSingle();
+        if (result.error) throw result.error;
+        data = result.data;
     }
     if (!data?.active) {
         throw createHubDiscoveryError(
@@ -4148,7 +4270,7 @@ async function registerClientDeviceWithSupabase(supabase, options = {}) {
             if (roleRestartRequest?.role) {
                 return { data: { ok: false, skipped: true, reason: 'role-transition-pending' }, error: null };
             }
-            return supabase.rpc('register_livedesk_device', {
+            return callVerifiedSupabaseRpc(supabase, options.session, 'register_livedesk_device', {
                 p_device_id: options.deviceId,
                 p_device_name: options.deviceName || os.hostname(),
                 p_role: 'client',
@@ -4182,6 +4304,7 @@ export async function waitForManagerFromSupabase(supabase, options = {}) {
     let lastMessage = '';
     let wakeListener = null;
     let initialError = options.initialError || null;
+    let discoverySession = options.session || null;
     console.log('Waiting for a LiveDesk Hub. LiveDesk is listening for Hub-online events with adaptive registry retries as a fallback.');
     try {
         while (true) {
@@ -4191,7 +4314,16 @@ export async function waitForManagerFromSupabase(supabase, options = {}) {
             if (!wakeListener) {
                 try {
                     wakeListener = await createWakeListener({
-                        getAccessToken: async () => (await refreshSessionIfNeeded(supabase))?.access_token || ''
+                        getAccessToken: async () => {
+                            const normalized = normalizeRuntimeAuthSession(discoverySession, { requireRefreshToken: true });
+                            const expiresAt = Number(normalized.session?.expires_at || 0);
+                            if (normalized.ok && (expiresAt <= 0
+                                || expiresAt - Math.floor(Date.now() / 1000) > SESSION_REFRESH_SKEW_SECONDS)) {
+                                return normalized.session.access_token;
+                            }
+                            discoverySession = await refreshSessionIfNeeded(supabase);
+                            return discoverySession?.access_token || '';
+                        }
                     });
                 } catch (error) {
                     if (attempts === 0) {
@@ -4210,6 +4342,7 @@ export async function waitForManagerFromSupabase(supabase, options = {}) {
                     signal => resolveManagerFromSupabase(supabase, {
                         allowRelayFallback: options.allowRelayFallback === true,
                         probeEndpoint: options.probeEndpoint,
+                        session: discoverySession,
                         signal
                     }),
                     {
@@ -4380,6 +4513,7 @@ async function prepareLoginConnection(parsed, existingConnectionPage = null, get
                         }
                         return await resolveManagerFromSupabase(supabase, {
                             allowRelayFallback,
+                            session,
                             signal
                         });
                     }
@@ -4412,6 +4546,7 @@ async function prepareLoginConnection(parsed, existingConnectionPage = null, get
             if (!resolved) {
                 resolved = await waitForManagerFromSupabase(supabase, {
                     allowRelayFallback,
+                    session,
                     initialError: initialDiscoveryError,
                     shouldStop: () => Boolean(roleRestartRequest?.role)
                 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/client",
-  "version": "0.1.229",
+  "version": "0.1.231",
   "description": "LiveDesk local remote client",
   "type": "module",
   "bin": {