@marktiderman/genesis-supabase 0.2.0 → 0.3.0

package/functions/genesis-support-intake/contract.ts

@@ -0,0 +1,193 @@
+/**
+ * The Genesis support wire contract: what a support client (the web loader, a
+ * native app, any HTTP caller) and the `genesis-support-intake` Edge Function
+ * say to each other. One file, kept byte-identical in two places:
+ * `@marktiderman/genesis-support` (`src/contract.ts`) and the function template
+ * (`functions/genesis-support-intake/contract.ts`); a test fails when they drift.
+ *
+ * Dependency-free and additive: `CONTRACT_VERSION` changes only with a shape
+ * change, and a reader tolerates fields and widget types it doesn't know, so an
+ * old client keeps working.
+ */
+
+/** Bumped only on a shape change. Old clients must keep working. */
+export const CONTRACT_VERSION = 1 as const;
+
+/** The widget kinds a boot can turn on. */
+export type WidgetType = "feedback" | "roadmap" | "changelog" | "survey" | "messaging";
+
+/** On the wire the type is open: a client switches on the known ones and ignores the rest. */
+export type WidgetTypeWire = WidgetType | (string & {});
+
+/**
+ * How the person is known to the server.
+ * - `genesis-session`: signed in to the app's own Supabase (a user access token). The default.
+ * - `signed`: the app's backend mints a short-lived token for the person (reserved).
+ * - `anonymous`: a device id only (reserved; the database refuses writes without a session).
+ */
+export type IdentityMode = "anonymous" | "signed" | "genesis-session";
+
+export type LauncherPosition = "bottom-right" | "bottom-left" | "top-right" | "top-left";
+
+/** Theme hints a web launcher may use. Genesis apps use their own theme instead. */
+export interface ThemeTokens {
+  colorBg?: string;
+  colorFg?: string;
+  colorPrimary?: string;
+  colorPrimaryFg?: string;
+  radius?: string;
+  fontFamily?: string;
+  launcherLabel?: string;
+  launcherPosition?: LauncherPosition;
+}
+
+/** One enabled widget and its public config (never a secret). */
+export interface WidgetConfig {
+  type: WidgetTypeWire;
+  config: Record<string, unknown>;
+}
+
+/** The boot handshake (`GET`): world-readable, so only public values. */
+export interface BootConfig {
+  contractVersion: number;
+  project: { id: string; name: string };
+  identityMode: IdentityMode;
+  theme: ThemeTokens;
+  widgets: WidgetConfig[];
+  flags: Record<string, boolean>;
+}
+
+export type FeedbackReportType = "bug" | "idea" | "question" | "praise";
+export type FeedbackStatus = "open" | "submitted" | "in_progress" | "addressed" | "wont_fix";
+export type FindingSeverity = "low" | "medium" | "high" | "critical";
+
+export const FEEDBACK_REPORT_TYPES: readonly FeedbackReportType[] = ["bug", "idea", "question", "praise"];
+export const FEEDBACK_STATUSES: readonly FeedbackStatus[] = ["open", "submitted", "in_progress", "addressed", "wont_fix"];
+const SEVERITIES: readonly FindingSeverity[] = ["low", "medium", "high", "critical"];
+
+/** Client to server: open a report. Screenshots go to storage, not in this body. */
+export interface SubmitFeedbackInput {
+  type?: FeedbackReportType;
+  title?: string;
+  body: string;
+  route?: string;
+  appVersion?: string;
+  envType?: string;
+  severity?: FindingSeverity;
+  tags?: string[];
+  /** Small, free-form context (breadcrumbs, a pin on the page). At most 16 KB as JSON. */
+  context?: Record<string, unknown>;
+}
+
+/** Server to client: the report created. `findingId` is the report's id (one finding per report here). */
+export interface SubmitFeedbackResult {
+  reportId: string;
+  findingId: string;
+  status: FeedbackStatus;
+}
+
+/** One of the caller's own reports. */
+export interface FeedbackReportSummary {
+  id: string;
+  type: FeedbackReportType;
+  title: string;
+  status: FeedbackStatus;
+  route: string | null;
+  createdAt: string;
+  findingCount: number;
+}
+
+/** The operations the intake function multiplexes on (`{ op, ...args }`). */
+export type FeedbackOp = "submit" | "list";
+
+/** Headers a client sends. The person's access token goes in `Authorization: Bearer …`. */
+export const WIDGET_HEADERS = {
+  /** The project's publishable key (an identifier, not a secret). */
+  key: "x-genesis-key",
+  /** `signed` mode: the minted short-lived token. */
+  identity: "x-genesis-identity",
+  /** `anonymous` mode: the device id. */
+  device: "x-genesis-device",
+  /** A proof-of-work or captcha token, for anonymous writes. */
+  challenge: "x-genesis-challenge",
+  /** The contract version the client was built against. */
+  contract: "x-genesis-contract",
+} as const;
+
+/** Text limits, the same as the database's checks. */
+export const LIMITS = { title: 300, body: 20000, route: 2000, appVersion: 200, tag: 60, tags: 50, contextBytes: 16384 } as const;
+
+/** A path segment that names someone or something private: an email, a UUID, a number, a long token. */
+function privateSegment(segment: string): string | null {
+  let s = segment;
+  try {
+    s = decodeURIComponent(segment);
+  } catch {
+    // a malformed escape: judge it as written
+  }
+  if (s.includes("@")) return ":email";
+  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s)) return ":id";
+  if (/^\d+$/.test(s)) return ":id";
+  // A long run of letters and digits with a digit in it reads as a token or a code, not a word.
+  if (s.length >= 16 && /\d/.test(s) && /^[A-Za-z0-9_.~-]+$/.test(s)) return ":token";
+  return null;
+}
+
+/**
+ * A route as a path only, safe to store and send: the query string and
+ * fragment (tokens, codes, emails) are dropped, and path segments that look
+ * private (an email, an id, a long token) become `:email`, `:id` or `:token`
+ * (`/users/jane@x.test/reset/abc123…` → `/users/:email/reset/:token`).
+ */
+export function cleanRoute(route: string | null | undefined): string | undefined {
+  if (typeof route !== "string") return undefined;
+  const path = route.replace(/[?#].*$/, "").trim();
+  if (!path) return undefined;
+  const safe = path
+    .split("/")
+    .map((segment) => (segment ? (privateSegment(segment) ?? segment) : segment))
+    .join("/");
+  return safe.slice(0, LIMITS.route);
+}
+
+export type SubmitValidation =
+  | { ok: true; value: SubmitFeedbackInput }
+  | { ok: false; error: "invalid_args" | "payload_too_large"; field: string };
+
+const byteLength = (s: string) => new TextEncoder().encode(s).length;
+
+/** Checks a `submit` body the way the server does: known keys only, every limit. */
+export function validateSubmitInput(raw: unknown): SubmitValidation {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return { ok: false, error: "invalid_args", field: "body" };
+  const input = raw as Record<string, unknown>;
+  const known = new Set(["type", "title", "body", "route", "appVersion", "envType", "severity", "tags", "context"]);
+  for (const key of Object.keys(input)) if (!known.has(key)) return { ok: false, error: "invalid_args", field: key };
+  const optionalString = (key: string, max: number): boolean => input[key] == null || (typeof input[key] === "string" && (input[key] as string).length <= max);
+  if (typeof input.body !== "string" || !input.body.trim()) return { ok: false, error: "invalid_args", field: "body" };
+  if (input.body.length > LIMITS.body) return { ok: false, error: "payload_too_large", field: "body" };
+  if (input.type != null && !FEEDBACK_REPORT_TYPES.includes(input.type as FeedbackReportType)) return { ok: false, error: "invalid_args", field: "type" };
+  if (input.severity != null && !SEVERITIES.includes(input.severity as FindingSeverity)) return { ok: false, error: "invalid_args", field: "severity" };
+  if (!optionalString("title", LIMITS.title)) return { ok: false, error: "invalid_args", field: "title" };
+  if (!optionalString("route", LIMITS.route)) return { ok: false, error: "invalid_args", field: "route" };
+  if (!optionalString("appVersion", LIMITS.appVersion)) return { ok: false, error: "invalid_args", field: "appVersion" };
+  if (!optionalString("envType", 60)) return { ok: false, error: "invalid_args", field: "envType" };
+  if (input.tags != null) {
+    if (!Array.isArray(input.tags) || input.tags.length > LIMITS.tags) return { ok: false, error: "invalid_args", field: "tags" };
+    if (!input.tags.every((t) => typeof t === "string" && t.length <= LIMITS.tag)) return { ok: false, error: "invalid_args", field: "tags" };
+  }
+  if (input.context != null) {
+    if (typeof input.context !== "object" || Array.isArray(input.context)) return { ok: false, error: "invalid_args", field: "context" };
+    if (byteLength(JSON.stringify(input.context)) > LIMITS.contextBytes) return { ok: false, error: "payload_too_large", field: "context" };
+  }
+  const value: SubmitFeedbackInput = { body: input.body };
+  if (input.type != null) value.type = input.type as FeedbackReportType;
+  if (input.title != null) value.title = input.title as string;
+  const route = cleanRoute(input.route as string | undefined);
+  if (route) value.route = route;
+  if (input.appVersion != null) value.appVersion = input.appVersion as string;
+  if (input.envType != null) value.envType = input.envType as string;
+  if (input.severity != null) value.severity = input.severity as FindingSeverity;
+  if (input.tags != null) value.tags = input.tags as string[];
+  if (input.context != null) value.context = input.context as Record<string, unknown>;
+  return { ok: true, value };
+}

package/functions/genesis-support-intake/handler.ts

@@ -0,0 +1,170 @@
+/**
+ * The genesis-support-intake Edge Function's request handling, with its
+ * dependencies passed in (index.ts wires the real ones), so it is tested
+ * without Deno or a database.
+ *
+ *   GET                       the boot handshake: a public BootConfig
+ *   POST { op: "submit", … }  opens a report (SubmitFeedbackInput) as the caller
+ *   POST { op: "list" }       the caller's own reports (FeedbackReportSummary[])
+ *     Authorization: Bearer <the person's access token>
+ *
+ * Every database call runs as the caller (a client made with their token), so
+ * row level security decides, exactly as for the app's own Supabase client:
+ * this function never holds the service role. It exists for clients that
+ * don't run supabase-js (a script-tag loader, another backend).
+ *
+ * Browser origins: only those in GENESIS_SUPPORT_ORIGINS (comma-separated)
+ * get CORS headers, and a request from any other origin is refused. Native
+ * apps send no Origin. Responses carry an `error` code, never a database
+ * message.
+ */
+import {
+  CONTRACT_VERSION,
+  WIDGET_HEADERS,
+  validateSubmitInput,
+  type BootConfig,
+  type FeedbackReportSummary,
+  type FeedbackStatus,
+  type FeedbackReportType,
+  type SubmitFeedbackResult,
+} from "./contract.ts";
+
+/** The slice of a supabase-js client (made with the caller's token) the handler uses. */
+export interface CallerClient {
+  insertReport(row: Record<string, unknown>): Promise<{ id: string; status: string } | { error: string }>;
+  listReports(limit: number): Promise<Array<Record<string, unknown>> | { error: string }>;
+}
+
+export interface IntakeDeps {
+  env: (name: string) => string | undefined;
+  /** A client acting as the person behind this access token. */
+  clientFor(accessToken: string): CallerClient;
+  log: (message: string) => void;
+}
+
+const MAX_BODY_BYTES = 64 * 1024;
+
+function allowedOrigins(env: IntakeDeps["env"]): string[] {
+  return (env("GENESIS_SUPPORT_ORIGINS") ?? "")
+    .split(",")
+    .map((o) => o.trim().replace(/\/$/, ""))
+    .filter(Boolean);
+}
+
+function corsHeaders(origin: string | null, allowed: string[]): Record<string, string> {
+  const headers: Record<string, string> = { Vary: "Origin" };
+  if (origin && allowed.includes(origin)) {
+    headers["Access-Control-Allow-Origin"] = origin;
+    headers["Access-Control-Allow-Headers"] = ["authorization", "content-type", "apikey", ...Object.values(WIDGET_HEADERS)].join(", ");
+    headers["Access-Control-Allow-Methods"] = "GET, POST, OPTIONS";
+    headers["Access-Control-Max-Age"] = "600";
+  }
+  return headers;
+}
+
+function json(status: number, body: unknown, cors: Record<string, string>, extra: Record<string, string> = {}): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { ...cors, "content-type": "application/json", "cache-control": "no-store", ...extra },
+  });
+}
+
+/** The public boot projection. Nothing here is secret: it is readable by anyone. */
+export function bootConfig(env: IntakeDeps["env"]): BootConfig {
+  const widgets = (env("GENESIS_SUPPORT_WIDGETS") ?? "feedback,roadmap")
+    .split(",")
+    .map((w) => w.trim())
+    .filter(Boolean)
+    .map((type) => ({ type, config: {} }));
+  return {
+    contractVersion: CONTRACT_VERSION,
+    project: { id: env("GENESIS_SUPPORT_APP_ID") ?? "app", name: env("GENESIS_SUPPORT_APP_NAME") ?? "" },
+    identityMode: "genesis-session",
+    theme: {},
+    widgets,
+    flags: {},
+  };
+}
+
+function bearer(req: Request): string | null {
+  const header = req.headers.get("authorization") ?? "";
+  const match = /^Bearer\s+(\S+)$/i.exec(header);
+  return match?.[1] ?? null;
+}
+
+export async function handle(req: Request, deps: IntakeDeps): Promise<Response> {
+  const origin = req.headers.get("origin");
+  const allowed = allowedOrigins(deps.env);
+  const cors = corsHeaders(origin, allowed);
+  if (origin && !allowed.includes(origin)) return json(403, { error: "origin_not_allowed" }, cors);
+  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: cors });
+  if (req.method === "GET") return json(200, bootConfig(deps.env), cors, { "cache-control": "public, max-age=60" });
+  if (req.method !== "POST") return json(405, { error: "method_not_allowed" }, cors);
+
+  const text = await req.text();
+  if (new TextEncoder().encode(text).length > MAX_BODY_BYTES) return json(413, { error: "payload_too_large", field: "body" }, cors);
+  let raw: Record<string, unknown>;
+  try {
+    const parsed: unknown = JSON.parse(text);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("not an object");
+    raw = parsed as Record<string, unknown>;
+  } catch {
+    return json(400, { error: "invalid_json" }, cors);
+  }
+  const { op, ...args } = raw;
+
+  const token = bearer(req);
+  if (!token) return json(401, { error: "identity_required" }, cors);
+  const client = deps.clientFor(token);
+
+  try {
+    if (op === "submit") {
+      const checked = validateSubmitInput(args);
+      if (!checked.ok) return json(checked.error === "payload_too_large" ? 413 : 400, { error: checked.error, field: checked.field }, cors);
+      const a = checked.value;
+      const context: Record<string, unknown> = { ...(a.context ?? {}) };
+      if (a.envType) context.envType = a.envType;
+      if (a.severity) context.severity = a.severity;
+      if (a.tags?.length) context.tags = a.tags;
+      const created = await client.insertReport({
+        type: a.type ?? "bug",
+        title: a.title ?? a.body.slice(0, 120),
+        message: a.body,
+        route: a.route ?? null,
+        app_version: a.appVersion ?? null,
+        context,
+      });
+      if ("error" in created) return refusal(created.error, cors, deps);
+      const result: SubmitFeedbackResult = { reportId: created.id, findingId: created.id, status: created.status as FeedbackStatus };
+      return json(200, result, cors);
+    }
+    if (op === "list") {
+      const limit = typeof args.limit === "number" && Number.isInteger(args.limit) ? Math.min(Math.max(args.limit, 1), 100) : 30;
+      const rows = await client.listReports(limit);
+      if (!Array.isArray(rows)) return refusal(rows.error, cors, deps);
+      const summaries: FeedbackReportSummary[] = rows.map((r) => ({
+        id: String(r.id),
+        type: (r.type as FeedbackReportType) ?? "bug",
+        title: typeof r.title === "string" && r.title ? r.title : String(r.message ?? "").slice(0, 120),
+        status: (r.status as FeedbackStatus) ?? "open",
+        route: (r.route as string | null) ?? null,
+        createdAt: String(r.created_at),
+        findingCount: 1,
+      }));
+      return json(200, summaries, cors);
+    }
+    return json(400, { error: "unknown_op" }, cors);
+  } catch (error) {
+    deps.log(`[genesis-support-intake] ${error instanceof Error ? error.message : String(error)}`);
+    return json(500, { error: "internal" }, cors);
+  }
+}
+
+/** A database refusal as a code the client can act on. The database's message is logged, never returned. */
+function refusal(code: string, cors: Record<string, string>, deps: IntakeDeps): Response {
+  if (code === "GS429") return json(429, { error: "rate_limited" }, cors);
+  if (code === "42501" || code === "PGRST301" || code === "PGRST303") return json(401, { error: "identity_required" }, cors);
+  if (code === "23514") return json(400, { error: "invalid_args" }, cors);
+  deps.log(`[genesis-support-intake] database refused: ${code}`);
+  return json(500, { error: "submit_failed" }, cors);
+}

package/functions/genesis-support-intake/index.ts

@@ -0,0 +1,47 @@
+// genesis-support-intake: the support wire contract over HTTP (boot, submit, list)
+// for clients that don't run supabase-js, such as a script-tag web loader.
+// A template from @marktiderman/genesis-supabase: copy this folder to your app's
+// `supabase/functions/`, beside migration 0006 (see the package README).
+//
+// It acts as the caller: every query runs with the person's access token and the
+// publishable key, so row level security decides. It never uses the service role.
+//
+// Settings (`supabase secrets set …`, all optional): GENESIS_SUPPORT_ORIGINS (the web
+// origins allowed to call it, comma-separated; none means browsers can't),
+// GENESIS_SUPPORT_WIDGETS (default "feedback,roadmap"), GENESIS_SUPPORT_APP_ID and
+// GENESIS_SUPPORT_APP_NAME (shown in the boot handshake). SUPABASE_URL and
+// SUPABASE_ANON_KEY are set by Supabase. Deploy with the gateway's JWT check off
+// (`verify_jwt = false`): the boot handshake has no caller, and submit and list
+// check the caller's token through the database.
+import { createClient } from "npm:@supabase/supabase-js@2.118.0";
+import { handle, type CallerClient } from "./handler.ts";
+
+const url = Deno.env.get("SUPABASE_URL") ?? "";
+const publishableKey = Deno.env.get("SUPABASE_ANON_KEY") ?? "";
+
+function clientFor(accessToken: string): CallerClient {
+  const db = createClient(url, publishableKey, {
+    auth: { persistSession: false, autoRefreshToken: false },
+    global: { headers: { Authorization: `Bearer ${accessToken}` } },
+  });
+  return {
+    async insertReport(row) {
+      const { data, error } = await db.from("support_reports").insert(row).select("id, status").single();
+      return error ? { error: error.code ?? "unknown" } : (data as { id: string; status: string });
+    },
+    async listReports(limit) {
+      // The caller's own reports only, even when the caller is staff (who can read everyone's).
+      const { data: user, error: userError } = await db.auth.getUser(accessToken);
+      if (userError || !user.user) return { error: "42501" };
+      const { data, error } = await db
+        .from("support_reports")
+        .select("id, type, title, message, status, route, created_at")
+        .eq("user_id", user.user.id)
+        .order("created_at", { ascending: false })
+        .limit(limit);
+      return error ? { error: error.code ?? "unknown" } : (data ?? []);
+    },
+  };
+}
+
+Deno.serve((req) => handle(req, { env: (name) => Deno.env.get(name), clientFor, log: (message) => console.error(message) }));

package/functions/genesis-support-notify/handler.ts

@@ -0,0 +1,167 @@
+/**
+ * The genesis-support-notify Edge Function's request handling, with its
+ * dependencies passed in, so it is tested without Deno.
+ *
+ * A Supabase Database Webhook calls it on INSERT into public.support_reports
+ * (Dashboard → Database → Webhooks, or `supabase_functions.http_request` in a
+ * migration of your own), with the header `x-genesis-support-secret: <secret>`.
+ * It forwards a summary to the sinks that are configured:
+ *
+ *   - a GitHub issue per report: GITHUB_TOKEN (fine-grained, Issues: write on
+ *     one repository) and GITHUB_REPO ("owner/name"); GITHUB_LABELS optional;
+ *   - a webhook: SUPPORT_WEBHOOK_URL, the body signed with
+ *     SUPPORT_WEBHOOK_SIGNING_SECRET as `x-genesis-signature: sha256=<hex>`.
+ *
+ * What leaves the database is the summary only: the report id, type, title,
+ * message (cut to 2000 characters), route, app version, platform and time.
+ * Never the person's id or email, the device or context bags, or a
+ * screenshot. The message is what the person typed and may still name
+ * someone, so point the GitHub sink at a private repository.
+ */
+
+export interface ReportRecord {
+  id: string;
+  type?: string;
+  title?: string | null;
+  message?: string;
+  route?: string | null;
+  app_version?: string | null;
+  platform?: string | null;
+  created_at?: string;
+}
+
+export interface ReportSummary {
+  id: string;
+  type: string;
+  title: string;
+  message: string;
+  route: string | null;
+  appVersion: string | null;
+  platform: string | null;
+  createdAt: string | null;
+}
+
+export interface NotifyDeps {
+  env: (name: string) => string | undefined;
+  fetch: typeof fetch;
+  log: (message: string) => void;
+}
+
+const MESSAGE_CAP = 2000;
+
+/** The only fields a sink ever sees. */
+export function summarize(record: ReportRecord): ReportSummary {
+  const message = String(record.message ?? "");
+  return {
+    id: String(record.id),
+    type: String(record.type ?? "bug"),
+    title: (record.title ?? "").trim() || message.slice(0, 120),
+    message: message.length > MESSAGE_CAP ? `${message.slice(0, MESSAGE_CAP)}…` : message,
+    route: record.route ?? null,
+    appVersion: record.app_version ?? null,
+    platform: record.platform ?? null,
+    createdAt: record.created_at ?? null,
+  };
+}
+
+/** A constant-time comparison, so the secret can't be guessed a byte at a time. */
+export function sameSecret(a: string, b: string): boolean {
+  const x = new TextEncoder().encode(a);
+  const y = new TextEncoder().encode(b);
+  let diff = x.length ^ y.length;
+  for (let i = 0; i < Math.max(x.length, y.length); i++) diff |= (x[i] ?? 0) ^ (y[i] ?? 0);
+  return diff === 0;
+}
+
+export async function hmacHex(secret: string, body: string): Promise<string> {
+  const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const sig = new Uint8Array(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(body)));
+  return Array.from(sig, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+function json(status: number, body: Record<string, unknown>): Response {
+  return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json", "cache-control": "no-store" } });
+}
+
+/** Markdown for the issue body; the person's text is fenced so it can't mention or link anyone. */
+export function issueBody(s: ReportSummary): string {
+  const fence = "````";
+  return [
+    `**${s.type}** from the app${s.platform ? ` (${s.platform})` : ""}`,
+    "",
+    fence,
+    s.message.replaceAll(fence, "``` `"),
+    fence,
+    "",
+    `- Route: ${s.route ? `\`${s.route.replaceAll("`", "")}\`` : "none"}`,
+    `- Version: ${s.appVersion ? `\`${s.appVersion.replaceAll("`", "")}\`` : "unknown"}`,
+    `- Report: \`${s.id}\``,
+  ].join("\n");
+}
+
+export async function handle(req: Request, deps: NotifyDeps): Promise<Response> {
+  if (req.method !== "POST") return json(405, { error: "method_not_allowed" });
+  const secret = deps.env("GENESIS_SUPPORT_WEBHOOK_SECRET") ?? "";
+  if (!secret) {
+    deps.log("[genesis-support-notify] GENESIS_SUPPORT_WEBHOOK_SECRET is not set; refusing every call");
+    return json(500, { error: "not_configured" });
+  }
+  if (!sameSecret(req.headers.get("x-genesis-support-secret") ?? "", secret)) return json(401, { error: "unauthorized" });
+
+  let payload: { type?: string; table?: string; schema?: string; record?: ReportRecord };
+  try {
+    payload = await req.json();
+  } catch {
+    return json(400, { error: "invalid_json" });
+  }
+  if (payload.type !== "INSERT" || payload.table !== "support_reports" || !payload.record?.id) {
+    return json(200, { ok: true, skipped: true });
+  }
+  const summary = summarize(payload.record);
+  const sent: string[] = [];
+  const failed: string[] = [];
+
+  const repo = deps.env("GITHUB_REPO");
+  const token = deps.env("GITHUB_TOKEN");
+  if (repo && token) {
+    if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) {
+      deps.log("[genesis-support-notify] GITHUB_REPO must be owner/name");
+      failed.push("github");
+    } else {
+      const labels = (deps.env("GITHUB_LABELS") ?? "feedback").split(",").map((l) => l.trim()).filter(Boolean);
+      const res = await deps.fetch(`https://api.github.com/repos/${repo}/issues`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${token}`, accept: "application/vnd.github+json", "content-type": "application/json", "user-agent": "genesis-support-notify" },
+        body: JSON.stringify({ title: `[${summary.type}] ${summary.title}`.slice(0, 256), body: issueBody(summary), labels: [...labels, summary.type] }),
+      });
+      if (res.ok) sent.push("github");
+      else {
+        deps.log(`[genesis-support-notify] GitHub answered ${res.status}`);
+        failed.push("github");
+      }
+    }
+  }
+
+  const hook = deps.env("SUPPORT_WEBHOOK_URL");
+  if (hook) {
+    if (!hook.startsWith("https://")) {
+      deps.log("[genesis-support-notify] SUPPORT_WEBHOOK_URL must be https");
+      failed.push("webhook");
+    } else {
+      const body = JSON.stringify({ event: "support.report.created", report: summary });
+      const signing = deps.env("SUPPORT_WEBHOOK_SIGNING_SECRET");
+      const headers: Record<string, string> = { "content-type": "application/json" };
+      if (signing) headers["x-genesis-signature"] = `sha256=${await hmacHex(signing, body)}`;
+      const res = await deps.fetch(hook, { method: "POST", headers, body });
+      if (res.ok) sent.push("webhook");
+      else {
+        deps.log(`[genesis-support-notify] the webhook answered ${res.status}`);
+        failed.push("webhook");
+      }
+    }
+  }
+
+  if (!sent.length && !failed.length) deps.log("[genesis-support-notify] no sink is configured (GITHUB_REPO + GITHUB_TOKEN, or SUPPORT_WEBHOOK_URL)");
+  // 502 when a sink failed, so the database webhook's log shows it.
+  return json(failed.length ? 502 : 200, { ok: failed.length === 0, sent, failed });
+}

package/functions/genesis-support-notify/index.ts

@@ -0,0 +1,15 @@
+// genesis-support-notify: an optional server-side sink for new support reports.
+// A Database Webhook on INSERT into public.support_reports calls it; it opens a
+// GitHub issue per report and/or posts a signed webhook, with a summary only
+// (no person id, email, device, context or screenshot). See handler.ts.
+// A template from @marktiderman/genesis-supabase: copy this folder to your app's
+// `supabase/functions/`, beside migration 0006 (see the package README).
+//
+// Secrets (`supabase secrets set …`): GENESIS_SUPPORT_WEBHOOK_SECRET (required; the
+// database webhook sends it as `x-genesis-support-secret`), and for each sink you
+// want: GITHUB_TOKEN + GITHUB_REPO (+ GITHUB_LABELS), SUPPORT_WEBHOOK_URL
+// (+ SUPPORT_WEBHOOK_SIGNING_SECRET). Deploy with `verify_jwt = false`: the
+// webhook secret is the check.
+import { handle } from "./handler.ts";
+
+Deno.serve((req) => handle(req, { env: (name) => Deno.env.get(name), fetch, log: (message) => console.error(message) }));