@marktiderman/genesis-supabase 0.1.1 → 0.3.0

package/functions/genesis-push-send/index.ts

@@ -0,0 +1,54 @@
+// genesis-push-send: sends pushes through Expo's push service to the devices
+// migration 0005 says may get them now (categories, quiet hours, hidden
+// previews), records a receipt per ticket, polls the receipts and forgets dead
+// devices. A template from @marktiderman/genesis-supabase: copy this folder to
+// your app's `supabase/functions/`, beside migration 0005 (see the package README).
+//
+// Secrets (`supabase secrets set …`): GENESIS_PUSH_SECRET (at least 32
+// characters; every caller sends it as a bearer token) and, when your Expo
+// project requires it (recommended), EXPO_ACCESS_TOKEN. Optional:
+// PUSH_HIDDEN_TITLE and PUSH_HIDDEN_BODY, the neutral text a person who hides
+// previews sees. SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY are set by Supabase.
+// Deploy with `--no-verify-jwt` (or `verify_jwt = false` in config.toml): the
+// function checks GENESIS_PUSH_SECRET itself.
+import { createClient } from "npm:@supabase/supabase-js@2.118.0";
+import { handle, type PushStatus, type PushStore, type PushTarget } from "./handler.ts";
+
+const url = Deno.env.get("SUPABASE_URL") ?? "";
+const serviceKey = Deno.env.get("SUPABASE_SERVICE_ROLE_KEY") ?? "";
+const admin = createClient(url, serviceKey, { auth: { persistSession: false, autoRefreshToken: false } });
+
+async function rpc<T>(fn: string, args: Record<string, unknown>): Promise<T> {
+  const { data, error } = await admin.rpc(fn, args);
+  // The code only: a database message can quote the row it refused.
+  if (error) throw new Error(`${fn}: ${error.code ?? "error"}`);
+  return data as T;
+}
+
+const store: PushStore = {
+  targets: (userId, category, defaultOn, urgent) =>
+    rpc<PushTarget[]>("genesis_push_targets", { p_user_id: userId, p_category: category, p_default_on: defaultOn, p_bypass_quiet_hours: urgent }),
+  status: async (userId, category, defaultOn, urgent) => {
+    const rows = await rpc<PushStatus[]>("genesis_push_status", { p_user_id: userId, p_category: category, p_default_on: defaultOn, p_bypass_quiet_hours: urgent });
+    return rows[0] ?? { deliver: false, reason: "error", quiet_until: null };
+  },
+  recordTickets: async (rows) => {
+    await rpc<number>("genesis_push_tickets_record", { p_tickets: rows });
+  },
+  forgetDevices: async (deviceIds) => {
+    await rpc<number>("genesis_push_devices_forget", { p_device_ids: deviceIds });
+  },
+  claimReceipts: (limit) => rpc<{ id: number; ticket_id: string }[]>("genesis_push_receipts_claim", { p_limit: limit }),
+  settleReceipts: async (results) => {
+    await rpc<number>("genesis_push_receipts_settle", { p_results: results });
+  },
+};
+
+Deno.serve((req) =>
+  handle(req, {
+    env: (name) => Deno.env.get(name),
+    fetch,
+    store,
+    log: (message) => console.error(message),
+  }),
+);

package/functions/genesis-support-cleanup/handler.ts

@@ -0,0 +1,80 @@
+/**
+ * The genesis-support-cleanup Edge Function's request handling, with its
+ * dependencies passed in, so it is tested without Deno or a database.
+ *
+ *   POST {}   (from a schedule: pg_cron + pg_net, or any cron)
+ *     x-genesis-support-secret: <GENESIS_SUPPORT_CLEANUP_SECRET>
+ *
+ * Removes, through the Storage API, the screenshots whose attachment row is
+ * gone (queued in public.support_attachment_purges when a report or an account
+ * is deleted) and the uploads no attachment ever named (older than a day,
+ * `support_orphan_objects`). Supabase refuses direct deletes from
+ * storage.objects, so this is the only way they go. A bounded batch per call.
+ */
+
+export interface PurgeRow {
+  id: number;
+  bucket: string;
+  path: string;
+}
+
+/** What the function does with the service role. */
+export interface CleanupStore {
+  /** The oldest queued purges. */
+  queued(limit: number): Promise<PurgeRow[]>;
+  /** Objects in the bucket no attachment names, uploaded more than a day ago. */
+  orphans(limit: number): Promise<string[]>;
+  /** Storage API remove; returns the paths it removed. */
+  remove(bucket: string, paths: string[]): Promise<string[]>;
+  /** Forget purge rows whose object is gone. */
+  forget(ids: number[]): Promise<void>;
+}
+
+export interface CleanupDeps {
+  env: (name: string) => string | undefined;
+  store: CleanupStore;
+  log: (message: string) => void;
+}
+
+const BATCH = 100;
+const BUCKET = "genesis-support";
+
+function json(status: number, body: Record<string, unknown>): Response {
+  return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json", "cache-control": "no-store" } });
+}
+
+function sameSecret(a: string, b: string): boolean {
+  const x = new TextEncoder().encode(a);
+  const y = new TextEncoder().encode(b);
+  let diff = x.length ^ y.length;
+  for (let i = 0; i < Math.max(x.length, y.length); i++) diff |= (x[i] ?? 0) ^ (y[i] ?? 0);
+  return diff === 0;
+}
+
+export async function handle(req: Request, deps: CleanupDeps): Promise<Response> {
+  if (req.method !== "POST") return json(405, { error: "method_not_allowed" });
+  const secret = deps.env("GENESIS_SUPPORT_CLEANUP_SECRET") ?? "";
+  if (!secret) {
+    deps.log("[genesis-support-cleanup] GENESIS_SUPPORT_CLEANUP_SECRET is not set; refusing every call");
+    return json(500, { error: "not_configured" });
+  }
+  if (!sameSecret(req.headers.get("x-genesis-support-secret") ?? "", secret)) return json(401, { error: "unauthorized" });
+
+  try {
+    const queued = (await deps.store.queued(BATCH)).filter((row) => row.bucket === BUCKET);
+    let purged = 0;
+    if (queued.length) {
+      const paths = queued.map((row) => row.path);
+      await deps.store.remove(BUCKET, paths);
+      // Storage's remove answers with what it removed; an object already gone is gone too.
+      await deps.store.forget(queued.map((row) => row.id));
+      purged = queued.length;
+    }
+    const orphans = await deps.store.orphans(BATCH);
+    const removed = orphans.length ? await deps.store.remove(BUCKET, orphans) : [];
+    return json(200, { ok: true, purged, orphans: removed.length });
+  } catch (error) {
+    deps.log(`[genesis-support-cleanup] ${error instanceof Error ? error.message : String(error)}`);
+    return json(500, { error: "cleanup_failed" });
+  }
+}

package/functions/genesis-support-cleanup/index.ts

@@ -0,0 +1,39 @@
+// genesis-support-cleanup: removes support screenshots whose report or account was
+// deleted, and uploads that were never attached, through the Storage API (Supabase
+// refuses direct deletes from storage.objects). Call it on a schedule. See handler.ts.
+// A template from @marktiderman/genesis-supabase: copy this folder to your app's
+// `supabase/functions/`, beside migration 0006 (see the package README).
+//
+// Secrets: GENESIS_SUPPORT_CLEANUP_SECRET (the schedule sends it as
+// `x-genesis-support-secret`). SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY are set by
+// Supabase. Deploy with `verify_jwt = false`: the secret is the check.
+import { createClient } from "npm:@supabase/supabase-js@2.118.0";
+import { handle, type CleanupStore, type PurgeRow } from "./handler.ts";
+
+const admin = createClient(Deno.env.get("SUPABASE_URL") ?? "", Deno.env.get("SUPABASE_SERVICE_ROLE_KEY") ?? "", {
+  auth: { persistSession: false, autoRefreshToken: false },
+});
+
+const store: CleanupStore = {
+  async queued(limit) {
+    const { data, error } = await admin.from("support_attachment_purges").select("id, bucket, path").order("id").limit(limit);
+    if (error) throw new Error(`support_attachment_purges: ${error.code ?? ""} ${error.message}`);
+    return (data ?? []) as PurgeRow[];
+  },
+  async orphans(limit) {
+    const { data, error } = await admin.rpc("support_orphan_objects", { older_than: "1 day", max_rows: limit });
+    if (error) throw new Error(`support_orphan_objects: ${error.code ?? ""} ${error.message}`);
+    return ((data ?? []) as { path: string }[]).map((row) => row.path);
+  },
+  async remove(bucket, paths) {
+    const { data, error } = await admin.storage.from(bucket).remove(paths);
+    if (error) throw new Error(`storage remove: ${error.message}`);
+    return (data ?? []).map((object) => object.name);
+  },
+  async forget(ids) {
+    const { error } = await admin.from("support_attachment_purges").delete().in("id", ids);
+    if (error) throw new Error(`support_attachment_purges: ${error.code ?? ""} ${error.message}`);
+  },
+};
+
+Deno.serve((req) => handle(req, { env: (name) => Deno.env.get(name), store, log: (message) => console.error(message) }));

package/functions/genesis-support-intake/contract.ts

@@ -0,0 +1,193 @@
+/**
+ * The Genesis support wire contract: what a support client (the web loader, a
+ * native app, any HTTP caller) and the `genesis-support-intake` Edge Function
+ * say to each other. One file, kept byte-identical in two places:
+ * `@marktiderman/genesis-support` (`src/contract.ts`) and the function template
+ * (`functions/genesis-support-intake/contract.ts`); a test fails when they drift.
+ *
+ * Dependency-free and additive: `CONTRACT_VERSION` changes only with a shape
+ * change, and a reader tolerates fields and widget types it doesn't know, so an
+ * old client keeps working.
+ */
+
+/** Bumped only on a shape change. Old clients must keep working. */
+export const CONTRACT_VERSION = 1 as const;
+
+/** The widget kinds a boot can turn on. */
+export type WidgetType = "feedback" | "roadmap" | "changelog" | "survey" | "messaging";
+
+/** On the wire the type is open: a client switches on the known ones and ignores the rest. */
+export type WidgetTypeWire = WidgetType | (string & {});
+
+/**
+ * How the person is known to the server.
+ * - `genesis-session`: signed in to the app's own Supabase (a user access token). The default.
+ * - `signed`: the app's backend mints a short-lived token for the person (reserved).
+ * - `anonymous`: a device id only (reserved; the database refuses writes without a session).
+ */
+export type IdentityMode = "anonymous" | "signed" | "genesis-session";
+
+export type LauncherPosition = "bottom-right" | "bottom-left" | "top-right" | "top-left";
+
+/** Theme hints a web launcher may use. Genesis apps use their own theme instead. */
+export interface ThemeTokens {
+  colorBg?: string;
+  colorFg?: string;
+  colorPrimary?: string;
+  colorPrimaryFg?: string;
+  radius?: string;
+  fontFamily?: string;
+  launcherLabel?: string;
+  launcherPosition?: LauncherPosition;
+}
+
+/** One enabled widget and its public config (never a secret). */
+export interface WidgetConfig {
+  type: WidgetTypeWire;
+  config: Record<string, unknown>;
+}
+
+/** The boot handshake (`GET`): world-readable, so only public values. */
+export interface BootConfig {
+  contractVersion: number;
+  project: { id: string; name: string };
+  identityMode: IdentityMode;
+  theme: ThemeTokens;
+  widgets: WidgetConfig[];
+  flags: Record<string, boolean>;
+}
+
+export type FeedbackReportType = "bug" | "idea" | "question" | "praise";
+export type FeedbackStatus = "open" | "submitted" | "in_progress" | "addressed" | "wont_fix";
+export type FindingSeverity = "low" | "medium" | "high" | "critical";
+
+export const FEEDBACK_REPORT_TYPES: readonly FeedbackReportType[] = ["bug", "idea", "question", "praise"];
+export const FEEDBACK_STATUSES: readonly FeedbackStatus[] = ["open", "submitted", "in_progress", "addressed", "wont_fix"];
+const SEVERITIES: readonly FindingSeverity[] = ["low", "medium", "high", "critical"];
+
+/** Client to server: open a report. Screenshots go to storage, not in this body. */
+export interface SubmitFeedbackInput {
+  type?: FeedbackReportType;
+  title?: string;
+  body: string;
+  route?: string;
+  appVersion?: string;
+  envType?: string;
+  severity?: FindingSeverity;
+  tags?: string[];
+  /** Small, free-form context (breadcrumbs, a pin on the page). At most 16 KB as JSON. */
+  context?: Record<string, unknown>;
+}
+
+/** Server to client: the report created. `findingId` is the report's id (one finding per report here). */
+export interface SubmitFeedbackResult {
+  reportId: string;
+  findingId: string;
+  status: FeedbackStatus;
+}
+
+/** One of the caller's own reports. */
+export interface FeedbackReportSummary {
+  id: string;
+  type: FeedbackReportType;
+  title: string;
+  status: FeedbackStatus;
+  route: string | null;
+  createdAt: string;
+  findingCount: number;
+}
+
+/** The operations the intake function multiplexes on (`{ op, ...args }`). */
+export type FeedbackOp = "submit" | "list";
+
+/** Headers a client sends. The person's access token goes in `Authorization: Bearer …`. */
+export const WIDGET_HEADERS = {
+  /** The project's publishable key (an identifier, not a secret). */
+  key: "x-genesis-key",
+  /** `signed` mode: the minted short-lived token. */
+  identity: "x-genesis-identity",
+  /** `anonymous` mode: the device id. */
+  device: "x-genesis-device",
+  /** A proof-of-work or captcha token, for anonymous writes. */
+  challenge: "x-genesis-challenge",
+  /** The contract version the client was built against. */
+  contract: "x-genesis-contract",
+} as const;
+
+/** Text limits, the same as the database's checks. */
+export const LIMITS = { title: 300, body: 20000, route: 2000, appVersion: 200, tag: 60, tags: 50, contextBytes: 16384 } as const;
+
+/** A path segment that names someone or something private: an email, a UUID, a number, a long token. */
+function privateSegment(segment: string): string | null {
+  let s = segment;
+  try {
+    s = decodeURIComponent(segment);
+  } catch {
+    // a malformed escape: judge it as written
+  }
+  if (s.includes("@")) return ":email";
+  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s)) return ":id";
+  if (/^\d+$/.test(s)) return ":id";
+  // A long run of letters and digits with a digit in it reads as a token or a code, not a word.
+  if (s.length >= 16 && /\d/.test(s) && /^[A-Za-z0-9_.~-]+$/.test(s)) return ":token";
+  return null;
+}
+
+/**
+ * A route as a path only, safe to store and send: the query string and
+ * fragment (tokens, codes, emails) are dropped, and path segments that look
+ * private (an email, an id, a long token) become `:email`, `:id` or `:token`
+ * (`/users/jane@x.test/reset/abc123…` → `/users/:email/reset/:token`).
+ */
+export function cleanRoute(route: string | null | undefined): string | undefined {
+  if (typeof route !== "string") return undefined;
+  const path = route.replace(/[?#].*$/, "").trim();
+  if (!path) return undefined;
+  const safe = path
+    .split("/")
+    .map((segment) => (segment ? (privateSegment(segment) ?? segment) : segment))
+    .join("/");
+  return safe.slice(0, LIMITS.route);
+}
+
+export type SubmitValidation =
+  | { ok: true; value: SubmitFeedbackInput }
+  | { ok: false; error: "invalid_args" | "payload_too_large"; field: string };
+
+const byteLength = (s: string) => new TextEncoder().encode(s).length;
+
+/** Checks a `submit` body the way the server does: known keys only, every limit. */
+export function validateSubmitInput(raw: unknown): SubmitValidation {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return { ok: false, error: "invalid_args", field: "body" };
+  const input = raw as Record<string, unknown>;
+  const known = new Set(["type", "title", "body", "route", "appVersion", "envType", "severity", "tags", "context"]);
+  for (const key of Object.keys(input)) if (!known.has(key)) return { ok: false, error: "invalid_args", field: key };
+  const optionalString = (key: string, max: number): boolean => input[key] == null || (typeof input[key] === "string" && (input[key] as string).length <= max);
+  if (typeof input.body !== "string" || !input.body.trim()) return { ok: false, error: "invalid_args", field: "body" };
+  if (input.body.length > LIMITS.body) return { ok: false, error: "payload_too_large", field: "body" };
+  if (input.type != null && !FEEDBACK_REPORT_TYPES.includes(input.type as FeedbackReportType)) return { ok: false, error: "invalid_args", field: "type" };
+  if (input.severity != null && !SEVERITIES.includes(input.severity as FindingSeverity)) return { ok: false, error: "invalid_args", field: "severity" };
+  if (!optionalString("title", LIMITS.title)) return { ok: false, error: "invalid_args", field: "title" };
+  if (!optionalString("route", LIMITS.route)) return { ok: false, error: "invalid_args", field: "route" };
+  if (!optionalString("appVersion", LIMITS.appVersion)) return { ok: false, error: "invalid_args", field: "appVersion" };
+  if (!optionalString("envType", 60)) return { ok: false, error: "invalid_args", field: "envType" };
+  if (input.tags != null) {
+    if (!Array.isArray(input.tags) || input.tags.length > LIMITS.tags) return { ok: false, error: "invalid_args", field: "tags" };
+    if (!input.tags.every((t) => typeof t === "string" && t.length <= LIMITS.tag)) return { ok: false, error: "invalid_args", field: "tags" };
+  }
+  if (input.context != null) {
+    if (typeof input.context !== "object" || Array.isArray(input.context)) return { ok: false, error: "invalid_args", field: "context" };
+    if (byteLength(JSON.stringify(input.context)) > LIMITS.contextBytes) return { ok: false, error: "payload_too_large", field: "context" };
+  }
+  const value: SubmitFeedbackInput = { body: input.body };
+  if (input.type != null) value.type = input.type as FeedbackReportType;
+  if (input.title != null) value.title = input.title as string;
+  const route = cleanRoute(input.route as string | undefined);
+  if (route) value.route = route;
+  if (input.appVersion != null) value.appVersion = input.appVersion as string;
+  if (input.envType != null) value.envType = input.envType as string;
+  if (input.severity != null) value.severity = input.severity as FindingSeverity;
+  if (input.tags != null) value.tags = input.tags as string[];
+  if (input.context != null) value.context = input.context as Record<string, unknown>;
+  return { ok: true, value };
+}

package/functions/genesis-support-intake/handler.ts

@@ -0,0 +1,170 @@
+/**
+ * The genesis-support-intake Edge Function's request handling, with its
+ * dependencies passed in (index.ts wires the real ones), so it is tested
+ * without Deno or a database.
+ *
+ *   GET                       the boot handshake: a public BootConfig
+ *   POST { op: "submit", … }  opens a report (SubmitFeedbackInput) as the caller
+ *   POST { op: "list" }       the caller's own reports (FeedbackReportSummary[])
+ *     Authorization: Bearer <the person's access token>
+ *
+ * Every database call runs as the caller (a client made with their token), so
+ * row level security decides, exactly as for the app's own Supabase client:
+ * this function never holds the service role. It exists for clients that
+ * don't run supabase-js (a script-tag loader, another backend).
+ *
+ * Browser origins: only those in GENESIS_SUPPORT_ORIGINS (comma-separated)
+ * get CORS headers, and a request from any other origin is refused. Native
+ * apps send no Origin. Responses carry an `error` code, never a database
+ * message.
+ */
+import {
+  CONTRACT_VERSION,
+  WIDGET_HEADERS,
+  validateSubmitInput,
+  type BootConfig,
+  type FeedbackReportSummary,
+  type FeedbackStatus,
+  type FeedbackReportType,
+  type SubmitFeedbackResult,
+} from "./contract.ts";
+
+/** The slice of a supabase-js client (made with the caller's token) the handler uses. */
+export interface CallerClient {
+  insertReport(row: Record<string, unknown>): Promise<{ id: string; status: string } | { error: string }>;
+  listReports(limit: number): Promise<Array<Record<string, unknown>> | { error: string }>;
+}
+
+export interface IntakeDeps {
+  env: (name: string) => string | undefined;
+  /** A client acting as the person behind this access token. */
+  clientFor(accessToken: string): CallerClient;
+  log: (message: string) => void;
+}
+
+const MAX_BODY_BYTES = 64 * 1024;
+
+function allowedOrigins(env: IntakeDeps["env"]): string[] {
+  return (env("GENESIS_SUPPORT_ORIGINS") ?? "")
+    .split(",")
+    .map((o) => o.trim().replace(/\/$/, ""))
+    .filter(Boolean);
+}
+
+function corsHeaders(origin: string | null, allowed: string[]): Record<string, string> {
+  const headers: Record<string, string> = { Vary: "Origin" };
+  if (origin && allowed.includes(origin)) {
+    headers["Access-Control-Allow-Origin"] = origin;
+    headers["Access-Control-Allow-Headers"] = ["authorization", "content-type", "apikey", ...Object.values(WIDGET_HEADERS)].join(", ");
+    headers["Access-Control-Allow-Methods"] = "GET, POST, OPTIONS";
+    headers["Access-Control-Max-Age"] = "600";
+  }
+  return headers;
+}
+
+function json(status: number, body: unknown, cors: Record<string, string>, extra: Record<string, string> = {}): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { ...cors, "content-type": "application/json", "cache-control": "no-store", ...extra },
+  });
+}
+
+/** The public boot projection. Nothing here is secret: it is readable by anyone. */
+export function bootConfig(env: IntakeDeps["env"]): BootConfig {
+  const widgets = (env("GENESIS_SUPPORT_WIDGETS") ?? "feedback,roadmap")
+    .split(",")
+    .map((w) => w.trim())
+    .filter(Boolean)
+    .map((type) => ({ type, config: {} }));
+  return {
+    contractVersion: CONTRACT_VERSION,
+    project: { id: env("GENESIS_SUPPORT_APP_ID") ?? "app", name: env("GENESIS_SUPPORT_APP_NAME") ?? "" },
+    identityMode: "genesis-session",
+    theme: {},
+    widgets,
+    flags: {},
+  };
+}
+
+function bearer(req: Request): string | null {
+  const header = req.headers.get("authorization") ?? "";
+  const match = /^Bearer\s+(\S+)$/i.exec(header);
+  return match?.[1] ?? null;
+}
+
+export async function handle(req: Request, deps: IntakeDeps): Promise<Response> {
+  const origin = req.headers.get("origin");
+  const allowed = allowedOrigins(deps.env);
+  const cors = corsHeaders(origin, allowed);
+  if (origin && !allowed.includes(origin)) return json(403, { error: "origin_not_allowed" }, cors);
+  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: cors });
+  if (req.method === "GET") return json(200, bootConfig(deps.env), cors, { "cache-control": "public, max-age=60" });
+  if (req.method !== "POST") return json(405, { error: "method_not_allowed" }, cors);
+
+  const text = await req.text();
+  if (new TextEncoder().encode(text).length > MAX_BODY_BYTES) return json(413, { error: "payload_too_large", field: "body" }, cors);
+  let raw: Record<string, unknown>;
+  try {
+    const parsed: unknown = JSON.parse(text);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("not an object");
+    raw = parsed as Record<string, unknown>;
+  } catch {
+    return json(400, { error: "invalid_json" }, cors);
+  }
+  const { op, ...args } = raw;
+
+  const token = bearer(req);
+  if (!token) return json(401, { error: "identity_required" }, cors);
+  const client = deps.clientFor(token);
+
+  try {
+    if (op === "submit") {
+      const checked = validateSubmitInput(args);
+      if (!checked.ok) return json(checked.error === "payload_too_large" ? 413 : 400, { error: checked.error, field: checked.field }, cors);
+      const a = checked.value;
+      const context: Record<string, unknown> = { ...(a.context ?? {}) };
+      if (a.envType) context.envType = a.envType;
+      if (a.severity) context.severity = a.severity;
+      if (a.tags?.length) context.tags = a.tags;
+      const created = await client.insertReport({
+        type: a.type ?? "bug",
+        title: a.title ?? a.body.slice(0, 120),
+        message: a.body,
+        route: a.route ?? null,
+        app_version: a.appVersion ?? null,
+        context,
+      });
+      if ("error" in created) return refusal(created.error, cors, deps);
+      const result: SubmitFeedbackResult = { reportId: created.id, findingId: created.id, status: created.status as FeedbackStatus };
+      return json(200, result, cors);
+    }
+    if (op === "list") {
+      const limit = typeof args.limit === "number" && Number.isInteger(args.limit) ? Math.min(Math.max(args.limit, 1), 100) : 30;
+      const rows = await client.listReports(limit);
+      if (!Array.isArray(rows)) return refusal(rows.error, cors, deps);
+      const summaries: FeedbackReportSummary[] = rows.map((r) => ({
+        id: String(r.id),
+        type: (r.type as FeedbackReportType) ?? "bug",
+        title: typeof r.title === "string" && r.title ? r.title : String(r.message ?? "").slice(0, 120),
+        status: (r.status as FeedbackStatus) ?? "open",
+        route: (r.route as string | null) ?? null,
+        createdAt: String(r.created_at),
+        findingCount: 1,
+      }));
+      return json(200, summaries, cors);
+    }
+    return json(400, { error: "unknown_op" }, cors);
+  } catch (error) {
+    deps.log(`[genesis-support-intake] ${error instanceof Error ? error.message : String(error)}`);
+    return json(500, { error: "internal" }, cors);
+  }
+}
+
+/** A database refusal as a code the client can act on. The database's message is logged, never returned. */
+function refusal(code: string, cors: Record<string, string>, deps: IntakeDeps): Response {
+  if (code === "GS429") return json(429, { error: "rate_limited" }, cors);
+  if (code === "42501" || code === "PGRST301" || code === "PGRST303") return json(401, { error: "identity_required" }, cors);
+  if (code === "23514") return json(400, { error: "invalid_args" }, cors);
+  deps.log(`[genesis-support-intake] database refused: ${code}`);
+  return json(500, { error: "submit_failed" }, cors);
+}

package/functions/genesis-support-intake/index.ts

@@ -0,0 +1,47 @@
+// genesis-support-intake: the support wire contract over HTTP (boot, submit, list)
+// for clients that don't run supabase-js, such as a script-tag web loader.
+// A template from @marktiderman/genesis-supabase: copy this folder to your app's
+// `supabase/functions/`, beside migration 0006 (see the package README).
+//
+// It acts as the caller: every query runs with the person's access token and the
+// publishable key, so row level security decides. It never uses the service role.
+//
+// Settings (`supabase secrets set …`, all optional): GENESIS_SUPPORT_ORIGINS (the web
+// origins allowed to call it, comma-separated; none means browsers can't),
+// GENESIS_SUPPORT_WIDGETS (default "feedback,roadmap"), GENESIS_SUPPORT_APP_ID and
+// GENESIS_SUPPORT_APP_NAME (shown in the boot handshake). SUPABASE_URL and
+// SUPABASE_ANON_KEY are set by Supabase. Deploy with the gateway's JWT check off
+// (`verify_jwt = false`): the boot handshake has no caller, and submit and list
+// check the caller's token through the database.
+import { createClient } from "npm:@supabase/supabase-js@2.118.0";
+import { handle, type CallerClient } from "./handler.ts";
+
+const url = Deno.env.get("SUPABASE_URL") ?? "";
+const publishableKey = Deno.env.get("SUPABASE_ANON_KEY") ?? "";
+
+function clientFor(accessToken: string): CallerClient {
+  const db = createClient(url, publishableKey, {
+    auth: { persistSession: false, autoRefreshToken: false },
+    global: { headers: { Authorization: `Bearer ${accessToken}` } },
+  });
+  return {
+    async insertReport(row) {
+      const { data, error } = await db.from("support_reports").insert(row).select("id, status").single();
+      return error ? { error: error.code ?? "unknown" } : (data as { id: string; status: string });
+    },
+    async listReports(limit) {
+      // The caller's own reports only, even when the caller is staff (who can read everyone's).
+      const { data: user, error: userError } = await db.auth.getUser(accessToken);
+      if (userError || !user.user) return { error: "42501" };
+      const { data, error } = await db
+        .from("support_reports")
+        .select("id, type, title, message, status, route, created_at")
+        .eq("user_id", user.user.id)
+        .order("created_at", { ascending: false })
+        .limit(limit);
+      return error ? { error: error.code ?? "unknown" } : (data ?? []);
+    },
+  };
+}
+
+Deno.serve((req) => handle(req, { env: (name) => Deno.env.get(name), clientFor, log: (message) => console.error(message) }));