@mccaskie-labs/workbench-config 0.1.23 → 0.1.25

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @mccaskie-labs/workbench-config
 
+## 0.1.25
+
+### Patch Changes
+
+- Vendor settings baseline: two new Supabase Auth rows. `supabase.auth.signup_skips_email_confirm` keeps "Confirm email" on (`mailer_autoconfirm` false), and `supabase.auth.anonymous_sign_ins` keeps anonymous sign-ins off (`external_anonymous_users_enabled` false). An app that trusts the email in a session is only safe while both hold.
+
+## 0.1.24
+
+### Patch Changes
+
+- The database manifest gains sign-in: `createSessions`, `safeReturnPath` and `sameOrigin` (workbench-supabase 0.3.0), the optional `SESSION_SECRET`, two rules (sign-in through the app's own endpoints; session writes same-origin) and the probes `database.sign-in` and `database.session-cookie`.
+
 ## 0.1.23
 
 ### Patch Changes

package/capabilities/database.json

@@ -12,7 +12,10 @@
       "createServerClient",
       "createUserClient",
       "createServiceClient",
-      "WorkbenchSupabaseError"
+      "WorkbenchSupabaseError",
+      "createSessions",
+      "safeReturnPath",
+      "sameOrigin"
     ],
     "tools": [
       "sb_project_create",
@@ -56,6 +59,17 @@
         "production"
       ],
       "description": "The sb_secret_ key, only for code that must bypass RLS (createServiceClient); written by cf_worker_secret_put source=supabase_secret, always two-step"
+    },
+    {
+      "name": "SESSION_SECRET",
+      "required": false,
+      "secret": true,
+      "environments": [
+        "development",
+        "staging",
+        "production"
+      ],
+      "description": "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in"
     }
   ],
   "actions": [
@@ -142,6 +156,20 @@
       "text": "Keep Supabase's sign-in settings at the Workbench baseline (workbench-config VENDOR_SETTINGS), or record a project's change in vendor-settings.json with a reason. Control applies it with vendor_settings_apply and checks it every day.",
       "enforced_by": "control",
       "probe": "database.vendor-settings"
+    },
+    {
+      "id": "database.sign-in-server-side",
+      "kind": "must",
+      "text": "Sign people in through the app's own endpoints with createSessions: the browser never talks to Supabase Auth and never holds the access token, and codes are typed, never links.",
+      "enforced_by": "review",
+      "probe": "database.sign-in"
+    },
+    {
+      "id": "database.session-writes-same-origin",
+      "kind": "must",
+      "text": "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.",
+      "enforced_by": "review",
+      "probe": "database.session-cookie"
     }
   ],
   "examples": [
@@ -210,6 +238,20 @@
       "smoke": true,
       "cost_hint_usd": 0,
       "note": "plainError and plainAuthError (workbench-supabase) turn a raw database error and an email_exists auth error into plain words that name the app and never say whether an account exists"
+    },
+    {
+      "id": "database.sign-in",
+      "half": "runtime",
+      "expect": "pass",
+      "cost_hint_usd": 0,
+      "note": "Ask for a code, read it from the captured sign-in email, type it, and get a session that reads the user's own rows; a wrong code gets the plain line"
+    },
+    {
+      "id": "database.session-cookie",
+      "half": "runtime",
+      "expect": "pass",
+      "cost_hint_usd": 0,
+      "note": "The session cookie is __Host-, Secure, HttpOnly, SameSite=Lax and sealed; a cross-site write is refused; sign-out clears it with every attribute"
     }
   ]
 }

package/dist/capabilities.gen.d.ts

@@ -1,4 +1,4 @@
-export declare const MANIFEST_VERSION: "7f14dfc78268";
+export declare const MANIFEST_VERSION: "ecc54c728515";
 export declare const capabilities: {
     readonly ai: {
         readonly $schema: "./schema.json";
@@ -422,7 +422,7 @@ export declare const capabilities: {
         readonly status: "built";
         readonly surfaces: {
             readonly tools: readonly ["sb_project_create", "sb_migration_apply", "sb_migration_rollback", "sb_query", "sb_project_delete", "cf_worker_secret_put", "vendor_settings_apply"];
-            readonly package: readonly ["supabaseConfig", "createBrowserClient", "createServerClient", "createUserClient", "createServiceClient", "WorkbenchSupabaseError"];
+            readonly package: readonly ["supabaseConfig", "createBrowserClient", "createServerClient", "createUserClient", "createServiceClient", "WorkbenchSupabaseError", "createSessions", "safeReturnPath", "sameOrigin"];
         };
         readonly config: readonly [{
             readonly name: "SUPABASE_URL";
@@ -442,6 +442,12 @@ export declare const capabilities: {
             readonly secret: true;
             readonly environments: readonly ["staging", "production"];
             readonly description: "The sb_secret_ key, only for code that must bypass RLS (createServiceClient); written by cf_worker_secret_put source=supabase_secret, always two-step";
+        }, {
+            readonly name: "SESSION_SECRET";
+            readonly required: false;
+            readonly secret: true;
+            readonly environments: readonly ["development", "staging", "production"];
+            readonly description: "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in";
         }];
         readonly actions: readonly [{
             readonly tool: "sb_project_create";
@@ -513,6 +519,18 @@ export declare const capabilities: {
             readonly text: "Keep Supabase's sign-in settings at the Workbench baseline (workbench-config VENDOR_SETTINGS), or record a project's change in vendor-settings.json with a reason. Control applies it with vendor_settings_apply and checks it every day.";
             readonly enforced_by: "control";
             readonly probe: "database.vendor-settings";
+        }, {
+            readonly id: "database.sign-in-server-side";
+            readonly kind: "must";
+            readonly text: "Sign people in through the app's own endpoints with createSessions: the browser never talks to Supabase Auth and never holds the access token, and codes are typed, never links.";
+            readonly enforced_by: "review";
+            readonly probe: "database.sign-in";
+        }, {
+            readonly id: "database.session-writes-same-origin";
+            readonly kind: "must";
+            readonly text: "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.";
+            readonly enforced_by: "review";
+            readonly probe: "database.session-cookie";
         }];
         readonly examples: readonly [{
             readonly id: "database.example.user-client";
@@ -570,6 +588,18 @@ export declare const capabilities: {
             readonly smoke: true;
             readonly cost_hint_usd: 0;
             readonly note: "plainError and plainAuthError (workbench-supabase) turn a raw database error and an email_exists auth error into plain words that name the app and never say whether an account exists";
+        }, {
+            readonly id: "database.sign-in";
+            readonly half: "runtime";
+            readonly expect: "pass";
+            readonly cost_hint_usd: 0;
+            readonly note: "Ask for a code, read it from the captured sign-in email, type it, and get a session that reads the user's own rows; a wrong code gets the plain line";
+        }, {
+            readonly id: "database.session-cookie";
+            readonly half: "runtime";
+            readonly expect: "pass";
+            readonly cost_hint_usd: 0;
+            readonly note: "The session cookie is __Host-, Secure, HttpOnly, SameSite=Lax and sealed; a cross-site write is refused; sign-out clears it with every attribute";
         }];
     };
     readonly email: {

package/dist/capabilities.gen.js

@@ -1,6 +1,6 @@
 // Generated by `npm run capabilities:build` from capabilities/*.json. Do not edit.
 // check:capabilities fails in Checks when this file is stale.
-export const MANIFEST_VERSION = "7f14dfc78268";
+export const MANIFEST_VERSION = "ecc54c728515";
 export const capabilities = {
     "ai": {
         "$schema": "./schema.json",
@@ -629,7 +629,10 @@ export const capabilities = {
                 "createServerClient",
                 "createUserClient",
                 "createServiceClient",
-                "WorkbenchSupabaseError"
+                "WorkbenchSupabaseError",
+                "createSessions",
+                "safeReturnPath",
+                "sameOrigin"
             ]
         },
         "config": [
@@ -664,6 +667,17 @@ export const capabilities = {
                     "production"
                 ],
                 "description": "The sb_secret_ key, only for code that must bypass RLS (createServiceClient); written by cf_worker_secret_put source=supabase_secret, always two-step"
+            },
+            {
+                "name": "SESSION_SECRET",
+                "required": false,
+                "secret": true,
+                "environments": [
+                    "development",
+                    "staging",
+                    "production"
+                ],
+                "description": "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in"
             }
         ],
         "actions": [
@@ -750,6 +764,20 @@ export const capabilities = {
                 "text": "Keep Supabase's sign-in settings at the Workbench baseline (workbench-config VENDOR_SETTINGS), or record a project's change in vendor-settings.json with a reason. Control applies it with vendor_settings_apply and checks it every day.",
                 "enforced_by": "control",
                 "probe": "database.vendor-settings"
+            },
+            {
+                "id": "database.sign-in-server-side",
+                "kind": "must",
+                "text": "Sign people in through the app's own endpoints with createSessions: the browser never talks to Supabase Auth and never holds the access token, and codes are typed, never links.",
+                "enforced_by": "review",
+                "probe": "database.sign-in"
+            },
+            {
+                "id": "database.session-writes-same-origin",
+                "kind": "must",
+                "text": "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.",
+                "enforced_by": "review",
+                "probe": "database.session-cookie"
             }
         ],
         "examples": [
@@ -818,6 +846,20 @@ export const capabilities = {
                 "smoke": true,
                 "cost_hint_usd": 0,
                 "note": "plainError and plainAuthError (workbench-supabase) turn a raw database error and an email_exists auth error into plain words that name the app and never say whether an account exists"
+            },
+            {
+                "id": "database.sign-in",
+                "half": "runtime",
+                "expect": "pass",
+                "cost_hint_usd": 0,
+                "note": "Ask for a code, read it from the captured sign-in email, type it, and get a session that reads the user's own rows; a wrong code gets the plain line"
+            },
+            {
+                "id": "database.session-cookie",
+                "half": "runtime",
+                "expect": "pass",
+                "cost_hint_usd": 0,
+                "note": "The session cookie is __Host-, Secure, HttpOnly, SameSite=Lax and sealed; a cross-site write is refused; sign-out clears it with every attribute"
             }
         ]
     },

package/dist/vendor-settings.js

@@ -87,6 +87,26 @@ export const VENDOR_SETTINGS = Object.freeze([
         where: "Supabase: Authentication, Sign In / Providers, Email, Secure email change",
         breaks: "Off: an address change is confirmed from the new address only, so the owner of the old one never hears of it.",
     },
+    {
+        id: "supabase.auth.signup_skips_email_confirm",
+        vendor: "supabase",
+        area: "auth",
+        field: "mailer_autoconfirm",
+        type: "boolean",
+        value: false,
+        where: "Supabase: Authentication, Sign In / Providers, Email, Confirm email (on means this row is false)",
+        breaks: "On: anyone with the publishable key can sign up as any address without owning it. An app that trusts the email in the session (the template's admin claim, invitations) then hands that address's rights to a stranger.",
+    },
+    {
+        id: "supabase.auth.anonymous_sign_ins",
+        vendor: "supabase",
+        area: "auth",
+        field: "external_anonymous_users_enabled",
+        type: "boolean",
+        value: false,
+        where: "Supabase: Authentication, Sign In / Providers, Allow anonymous sign-ins",
+        breaks: "On: anyone with the publishable key gets a signed-in session with no address at all, and can then attach an address it doesn't own. Every \"signed in\" check in the app lets them through.",
+    },
 ]);
 const override = z.strictObject({
     id: z.string().min(1).max(100),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mccaskie-labs/workbench-config",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "description": "Workbench app configuration: WORKBENCH_ENV, typed variables that fail by name, secrets that are never printed, and the capabilities manifest.",
   "license": "UNLICENSED",
   "type": "module",