@mccaskie-labs/workbench-supabase 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # @mccaskie-labs/workbench-supabase
 
+## 0.2.0
+
+- `plainError(error, { appName })`: raw Postgres and PostgREST wording (permission denied, row-level security, missing relation, PGRST codes and so on) becomes one plain line naming the app, and the full message is logged. The app's own words pass unchanged. From Imprint's `plain-error.ts` (sign-in kit, 11 November 2026).
+- `plainAuthError(error, { appName })`: a plain line for each common Supabase Auth error code. None says whether an account exists for an address.
+
 ## 0.1.0
 
 - First version (step 4.11): `supabaseConfig`, `createBrowserClient`, `createServerClient`, `createUserClient`, `createServiceClient` (logs its reason once per isolate), `WorkbenchSupabaseError`, and the CLI's `check:migrations`, `check:prod-schema` and `prod-schema-sql` (`docs/spec.md` §3).

package/README.md

@@ -22,6 +22,8 @@ const admin = createServiceClient({ url: cfg.url, secretKey: workerSecret(env, '
 | `createServerClient({ ...cfg, cookies })` | On the server, as the signed-in user from the request's cookies. `cookies` is `{ getAll, setAll }` |
 | `createUserClient({ ...cfg, accessToken })` | As the caller, with the token they sent (audit F7). No session is stored or refreshed |
 | `createServiceClient({ url, secretKey, reason })` | The `sb_secret_` key: **bypasses RLS**. `reason` (one line) is logged once per isolate: `[workbench-supabase] service client (bypasses RLS): <reason>`. Refused in a browser and for a publishable key |
+| `plainError(error, { appName, log? })` | The message to show a person: the app's own words unchanged, or for raw Postgres or PostgREST wording ("permission denied for function …", RLS, missing relation, `PGRST116`) one plain line, "Something went wrong on <app>'s side …". The full message is logged |
+| `plainAuthError(error, { appName, log? })` | A plain line for a Supabase Auth error by its `code` (`otp_expired`, `invalid_credentials`, rate limits, `weak_password` …). None says whether an account exists; an unknown code gets the plain line and is logged |
 | `WorkbenchSupabaseError` | A client built wrongly: `code` is `invalid_config` or `forbidden`. Never holds a key, URL or token |
 
 Every client takes an optional `fetch`, for tests against a fake Supabase.

package/dist/index.d.ts

@@ -5,3 +5,4 @@ export { migrationProblems, type MigrationProblem } from "./migrations.ts";
 export { PRODUCTION_SCHEMA_SQL, createdBy, missingOnProduction, findUses, unusedAllows, parseProductionSchema, parseAllow, type ProductionSchema, type AllowEntry, type MissingName, type Use, } from "./prod-schema.ts";
 export { stringPieces, type StringPiece } from "./strings.ts";
 export type { SupabaseClient } from "@supabase/supabase-js";
+export { plainError, plainAuthError, plainServerError, isRawDbError, type PlainErrorOptions } from "./plain-error.ts";

package/dist/index.js

@@ -4,3 +4,4 @@ export { WorkbenchSupabaseError } from "./errors.js";
 export { migrationProblems } from "./migrations.js";
 export { PRODUCTION_SCHEMA_SQL, createdBy, missingOnProduction, findUses, unusedAllows, parseProductionSchema, parseAllow, } from "./prod-schema.js";
 export { stringPieces } from "./strings.js";
+export { plainError, plainAuthError, plainServerError, isRawDbError } from "./plain-error.js";

package/dist/plain-error.d.ts

@@ -0,0 +1,21 @@
+export interface PlainErrorOptions {
+    /** The app's name as people see it (brand.json `name`). */
+    appName: string;
+    /** Where the full message is logged. Defaults to console.error. */
+    log?: (line: string) => void;
+}
+/** True for wording from Postgres or PostgREST that a person shouldn't see. */
+export declare function isRawDbError(message: string): boolean;
+/** The line shown in place of a raw error. */
+export declare function plainServerError(appName: string): string;
+/**
+ * The message to show: as it is, or the plain line for a raw database error
+ * (logged in full). Takes a string, an Error or a Supabase/PostgREST error
+ * object; anything without a message is treated as raw.
+ */
+export declare function plainError(error: unknown, opts: PlainErrorOptions): string;
+/**
+ * A plain line for a Supabase Auth error, by its code. An unknown code (or
+ * none) gets the app's plain server line, and the error is logged in full.
+ */
+export declare function plainAuthError(error: unknown, opts: PlainErrorOptions): string;

package/dist/plain-error.js

@@ -0,0 +1,76 @@
+// Raw database and Auth errors never reach a person's screen. Carried across
+// from Imprint's apps/admin/lib/plain-error.ts (sign-in kit, agreed
+// 11 November 2026): a technical message is logged in full for us and
+// replaced with one plain line naming the app. The app's own refusals,
+// including its database functions' own words, pass unchanged.
+/** Postgres and PostgREST wording that only makes sense to a developer. */
+const RAW_DB = /permission denied for|violates (row-level security|foreign key|check|not-null|unique|exclusion)|duplicate key value|(relation|column|function|schema|type) "?[\w.]+(\([^)]*\))?"? does not exist|invalid input (syntax|value) for|syntax error at or near|could not serialize access|deadlock detected|null value in column|value too long for type|\bPGRST\d{3}\b|\bJWT\b|42501|23505|23503|42883|42P01/i;
+/** True for wording from Postgres or PostgREST that a person shouldn't see. */
+export function isRawDbError(message) {
+    return RAW_DB.test(message);
+}
+/** The line shown in place of a raw error. */
+export function plainServerError(appName) {
+    return `Something went wrong on ${appName}’s side. Try again, and if it happens again, tell ${appName} support.`;
+}
+function messageOf(error) {
+    if (typeof error === "string")
+        return error;
+    if (error && typeof error === "object" && typeof error.message === "string") {
+        return error.message;
+    }
+    return "";
+}
+/**
+ * The message to show: as it is, or the plain line for a raw database error
+ * (logged in full). Takes a string, an Error or a Supabase/PostgREST error
+ * object; anything without a message is treated as raw.
+ */
+export function plainError(error, opts) {
+    const message = messageOf(error);
+    if (message !== "" && !isRawDbError(message))
+        return message;
+    (opts.log ?? console.error)(`[error shown as plain] ${message || String(error)}`);
+    return plainServerError(opts.appName);
+}
+/**
+ * Supabase Auth error codes (`AuthError.code`) and the plain line for each.
+ * None says whether an account exists for an address, so a sign-in form
+ * can't be used to find out who has an account.
+ */
+const AUTH_LINES = {
+    invalid_credentials: "That email address and password don't match. Check them and try again.",
+    otp_expired: "That code has expired or was already used. Ask for a new one.",
+    otp_disabled: "Signing in with a code isn't turned on.",
+    over_email_send_rate_limit: "Too many emails were sent to this address. Wait a few minutes, then try again.",
+    over_request_rate_limit: "Too many tries. Wait a few minutes, then try again.",
+    over_sms_send_rate_limit: "Too many messages were sent. Wait a few minutes, then try again.",
+    weak_password: "Choose a longer password that's harder to guess.",
+    same_password: "Choose a password different from your current one.",
+    reauthentication_needed: "For your safety, confirm it's you first. We'll send you a code.",
+    reauthentication_not_valid: "That code isn't right or has expired. Ask for a new one.",
+    mfa_verification_failed: "That code isn't right. Check your authenticator app and try again.",
+    mfa_challenge_expired: "That took too long. Start signing in again.",
+    session_expired: "You've been signed out. Sign in again.",
+    session_not_found: "You've been signed out. Sign in again.",
+    refresh_token_not_found: "You've been signed out. Sign in again.",
+    user_banned: "This login can't be used. Contact support.",
+    signup_disabled: "New accounts can't be made here. Ask the person who runs it for an invite.",
+    // These would say an account exists: the same neutral line as a new sign-up.
+    email_exists: "Check your email for a code to carry on.",
+    user_already_exists: "Check your email for a code to carry on.",
+    // An address Supabase won't take, said without saying why.
+    email_address_invalid: "Check the email address and try again.",
+    email_address_not_authorized: "Check the email address and try again.",
+};
+/**
+ * A plain line for a Supabase Auth error, by its code. An unknown code (or
+ * none) gets the app's plain server line, and the error is logged in full.
+ */
+export function plainAuthError(error, opts) {
+    const code = error && typeof error === "object" ? error.code : undefined;
+    if (typeof code === "string" && Object.hasOwn(AUTH_LINES, code))
+        return AUTH_LINES[code];
+    (opts.log ?? console.error)(`[auth error shown as plain] ${typeof code === "string" ? `${code}: ` : ""}${messageOf(error) || String(error)}`);
+    return plainServerError(opts.appName);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mccaskie-labs/workbench-supabase",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Supabase clients for Workbench apps (browser, server, the caller's own token, and a service client that logs its reason), plus check:migrations and check:prod-schema.",
   "license": "UNLICENSED",
   "type": "module",