@openlup/platform 0.15.0 → 0.16.0

package/dist/identity/inviteAdminUserUseCase.js

@@ -0,0 +1,75 @@
+import { assertOperatorInvitationTtl } from "./operatorInvitationLifecycle.js";
+import { identityMessages } from "./messages.js";
+export const ADMIN_ROLE_NOTIFICATION_LOCALE = "en";
+export async function runInviteAdminUserUseCase(request, deps) {
+    const messages = deps.messages ?? identityMessages.en;
+    try {
+        if ("invitationStore" in deps)
+            assertOperatorInvitationTtl(deps.ttlSeconds);
+        if (!request.accessToken) {
+            return { status: 401, body: { code: "UNAUTHORIZED", error: messages.unauthorized } };
+        }
+        const { user, error: authError } = await deps.gateway.getUser(request.accessToken);
+        if (authError || !user) {
+            return { status: 401, body: { code: "INVALID_TOKEN", error: messages.invalidToken } };
+        }
+        const callerAdmin = await deps.gateway.findAdminUser(user.id);
+        if (!callerAdmin || callerAdmin.role !== "admin" || callerAdmin.membership_state !== "active" || callerAdmin.is_machine_actor !== false) {
+            return { status: 403, body: { code: "INVITE_FORBIDDEN", error: messages.inviteForbidden } };
+        }
+        if (!request.email) {
+            return { status: 400, body: { code: "EMAIL_REQUIRED", error: messages.emailRequired } };
+        }
+        if (!isInviteRole(request.role)) {
+            return { status: 400, body: { code: "INVALID_ROLE", error: messages.invalidRole } };
+        }
+        const role = request.role;
+        const email = request.email.trim().toLowerCase();
+        if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email))
+            return { status: 400, body: { code: "INVALID_EMAIL", error: "Invalid email" } };
+        const existingMembership = await deps.gateway.findAdminUserByEmail(email);
+        let principal = await deps.gateway.findAuthUserByEmail(email);
+        if (existingMembership && existingMembership.id !== principal?.id)
+            return { status: 409, body: { code: "IDENTITY_CONFLICT", error: "IDENTITY_CONFLICT" } };
+        if (!principal) {
+            const invite = await deps.gateway.inviteAuthUser({ email, role, redirectTo: new URL("/admin/auth/callback", deps.siteUrl).toString() });
+            if (invite.error || !invite.user) {
+                // A provider duplicate race reuses the durable identity. Never delete it.
+                principal = await deps.gateway.findAuthUserByEmail(email);
+                if (!principal)
+                    throw new Error("operator_identity_creation_failed");
+            }
+            else
+                principal = invite.user;
+        }
+        const issued = "invitationStore" in deps
+            ? await deps.invitationStore.issue({ actorPrincipalId: user.id, targetPrincipalId: principal.id, email, role, ttlSeconds: deps.ttlSeconds })
+            : await deps.activateMembership({ principalId: principal.id, email, role });
+        if (!("membershipState" in issued))
+            return { status: 409, body: { code: issued.code, error: issued.code } };
+        let delivery = {};
+        if (issued.code !== "ALREADY_INVITED" && issued.code !== "ALREADY_ACTIVE") {
+            try {
+                const notification = await deps.roleNotificationPort.sendRoleGranted({ email, authUserId: principal.id, role, locale: deps.notificationLocale ?? ADMIN_ROLE_NOTIFICATION_LOCALE, ...(issued.membershipState === "invited" ? { invitationId: issued.invitationId, expiresAt: issued.expiresAt } : {}) });
+                if (!notification.ok)
+                    throw new Error("operator_invitation_notification_failed");
+                delivery = { deliveryReference: notification.skipped ? null : notification.providerMessageId, deliveryReferencePresent: !notification.skipped && Boolean(notification.providerMessageId) };
+            }
+            catch {
+                return { status: 503, body: issued.membershipState === "invited"
+                        ? { code: "INVITATION_NOTIFICATION_FAILED", error: "Invitation persisted; notification unavailable", invitationId: issued.invitationId }
+                        : { ...issued, code: "INVITATION_NOTIFICATION_FAILED", error: "Membership active; notification unavailable" } };
+            }
+        }
+        return { status: 200, body: { success: true, ...issued, ...delivery, message: issued.membershipState === "invited" ? `Invitation pending until ${issued.expiresAt}` : "Operator membership active" } };
+    }
+    catch (err) {
+        const failure = err;
+        if (failure.identityCode)
+            return { status: failure.bffCode === "FORBIDDEN" ? 403 : 409, body: { code: failure.identityCode, error: failure.identityCode } };
+        return { status: 503, body: { code: "IDENTITY_ACTION_FAILED", error: String(err) } };
+    }
+}
+function isInviteRole(value) {
+    return value === "admin" || value === "distributor";
+}

package/dist/identity/jwtLibrary.d.ts

@@ -0,0 +1,54 @@
+export interface IdentityJwk {
+    [key: string]: unknown;
+    kty?: string;
+    alg?: string;
+    crv?: string;
+    kid?: string;
+    use?: string;
+    x?: string;
+    y?: string;
+    d?: string;
+}
+type Key = CryptoKey | Uint8Array;
+interface Signer {
+    setProtectedHeader(header: {
+        alg: string;
+        kid: string;
+        typ: string;
+    }): Signer;
+    setSubject(value: string): Signer;
+    setIssuer(value: string): Signer;
+    setAudience(value: string): Signer;
+    setIssuedAt(value: number): Signer;
+    setExpirationTime(value: number): Signer;
+    sign(key: Key): Promise<string>;
+}
+/** The host loads its selected JWT implementation only for the selected adapter. */
+export interface IdentityJwtLibrary {
+    importJWK(jwk: IdentityJwk, alg: string): Promise<Key>;
+    jwtVerify(token: string, key: (header: {
+        alg?: string;
+        kid?: string;
+    }) => Promise<Key>, options: {
+        algorithms: string[];
+        audience: string;
+        issuer: string;
+        currentDate?: Date;
+        clockTolerance?: number;
+    }): Promise<{
+        payload: IdentityJwtClaims;
+    }>;
+    SignJWT: new (payload: Record<string, unknown>) => Signer;
+}
+export type IdentityJwtLibraryLoader = () => Promise<IdentityJwtLibrary>;
+/** Claims returned only after signature verification by the host library. */
+export interface IdentityJwtClaims {
+    [claim: string]: unknown;
+    sub?: string;
+    iss?: string;
+    aud?: string | string[];
+    exp?: number;
+    iat?: number;
+    nbf?: number;
+}
+export {};

package/dist/identity/jwtLibrary.js

@@ -0,0 +1 @@
+export {};

package/dist/identity/machineActorWriteFence.d.ts

@@ -0,0 +1,4 @@
+import type { HttpResponse } from "../http/index.js";
+import { type IdentityResponseOptions } from "./response.js";
+export declare function refusesMachineActorRequest(route: string, method: string | undefined, isMachineActor: boolean | undefined, writeRoutes?: readonly string[]): boolean;
+export declare function sendMachineActorWriteRefused(res: HttpResponse, options?: IdentityResponseOptions): void;

package/dist/identity/machineActorWriteFence.js

@@ -0,0 +1,13 @@
+import { createIdentityResponder } from "./response.js";
+export function refusesMachineActorRequest(route, method, isMachineActor, writeRoutes = []) {
+    if (isMachineActor === false)
+        return false;
+    const verb = (method ?? "").toUpperCase();
+    return verb !== "GET" && verb !== "HEAD" && !writeRoutes.includes(route);
+}
+export function sendMachineActorWriteRefused(res, options = {}) {
+    const { sendBffError } = createIdentityResponder(options);
+    sendBffError(res, "FORBIDDEN", "Human operator required", {
+        details: { reason: "machine_actor_write_refused" },
+    });
+}

package/dist/identity/magicLinkPorts.d.ts

@@ -0,0 +1,28 @@
+export interface MagicLinkAuthClient {
+    auth: {
+        signInWithOtp(input: {
+            email: string;
+            options: {
+                shouldCreateUser: false;
+                emailRedirectTo: string;
+            };
+        }): Promise<{
+            error: {
+                name?: string;
+                message?: string;
+            } | null;
+        }>;
+    };
+}
+export interface MagicLinkRateLimitClient {
+    rpc(fn: string, args: Record<string, unknown>): Promise<{
+        data: unknown;
+        error: {
+            message?: string;
+        } | null;
+    }>;
+}
+export interface MagicLinkDecision {
+    allowed: boolean;
+    reason?: string;
+}

package/dist/identity/magicLinkPorts.js

@@ -0,0 +1 @@
+export {};

package/dist/identity/managedAccountLinkStore.d.ts

@@ -0,0 +1,2 @@
+import type { AccountLinkStore } from "./ports.js";
+export declare function createSupabaseAccountLinkStore(rawClient: unknown): AccountLinkStore;

package/dist/identity/managedAccountLinkStore.js

@@ -0,0 +1,93 @@
+export function createSupabaseAccountLinkStore(rawClient) {
+    const client = rawClient;
+    return {
+        async findAccountByPrincipalId(principalId) {
+            const { data, error } = await client
+                .from("clients")
+                .select("id, email, auth_user_id")
+                .eq("auth_user_id", principalId)
+                .maybeSingle();
+            if (error)
+                throw error;
+            if (!data)
+                return null;
+            return { id: data.id, email: data.email ?? null, principalId: data.auth_user_id ?? null };
+        },
+        async findAccountByEmail(email) {
+            const rows = await findManagedContactsByEmail(client, email, false);
+            if (rows.length > 1) {
+                throw Object.assign(new Error("multiple rows returned"), { code: "PGRST116" });
+            }
+            const data = rows[0];
+            if (!data)
+                return null;
+            return { id: data.id, email: data.email ?? null, principalId: data.auth_user_id ?? null };
+        },
+        async isReservedPrincipal(principalId) {
+            const { data, error } = await client
+                .from("admin_users")
+                .select("id, is_machine_actor")
+                .eq("id", principalId)
+                .maybeSingle();
+            if (error)
+                throw error;
+            if (!data)
+                return false;
+            return data.is_machine_actor !== false;
+        },
+        async linkPrincipalToAccount(accountId, principalId) {
+            const { data, error } = await client
+                .from("clients")
+                .update({ auth_user_id: principalId })
+                .eq("id", accountId)
+                .is("auth_user_id", null)
+                .select("auth_user_id")
+                .maybeSingle();
+            if (error)
+                throw error;
+            if (data?.auth_user_id === principalId) {
+                return { ok: true, alreadyLinked: false };
+            }
+            const { data: current, error: currentError } = await client
+                .from("clients")
+                .select("auth_user_id")
+                .eq("id", accountId)
+                .maybeSingle();
+            if (currentError)
+                throw currentError;
+            if (current?.auth_user_id === principalId) {
+                return { ok: true, alreadyLinked: true };
+            }
+            return { ok: false, existingPrincipalId: current?.auth_user_id ?? null };
+        },
+        async createAccount(input) {
+            const { data, error } = await client
+                .from("clients")
+                .insert({
+                email: input.email,
+                auth_user_id: input.principalId,
+                acquisition_source: input.acquisitionSource,
+                lifecycle_stage: input.lifecycleStage,
+            })
+                .select("id")
+                .single();
+            if (error)
+                throw error;
+            return { id: data.id };
+        },
+    };
+}
+async function findManagedContactsByEmail(client, email, oldestFirst) {
+    const normalized = email.trim().toLowerCase();
+    // Escaping bounds the database prefilter; Unicode regex folding can still
+    // widen it, so only exact normalized addresses may cross this boundary.
+    let query = client.from("clients")
+        .select("id, email, auth_user_id")
+        .filter("email", "imatch", `^${normalized.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&")}$`);
+    if (oldestFirst)
+        query = query.order("created_at", { ascending: true });
+    const { data, error } = await query.limit(10);
+    if (error)
+        throw error;
+    return (data ?? []).filter((row) => row.email?.trim().toLowerCase() === normalized);
+}

package/dist/identity/managedAdminAuthVerifier.d.ts

@@ -0,0 +1,7 @@
+import type { SupabaseCreateClient } from "../data/index.js";
+import type { AdminAuthPort } from "./ports.js";
+export declare function createSupabaseAdminAuth(rawClient: unknown): AdminAuthPort;
+export declare function createSupabaseAdminAuthFromEnv(env: {
+    url: string;
+    anonKey: string;
+}, accessToken: string | null, createClient: SupabaseCreateClient): AdminAuthPort;

package/dist/identity/managedAdminAuthVerifier.js

@@ -0,0 +1,27 @@
+import { authorizeAdminWithUser } from "./adminAuthorization.js";
+export function createSupabaseAdminAuth(rawClient) {
+    const client = rawClient;
+    return {
+        async authorize(accessToken, options) {
+            const authz = await authorizeAdminWithUser(client, accessToken, options);
+            if (authz.ok === false) {
+                return { ok: false, code: authz.code, message: authz.message };
+            }
+            return {
+                ok: true,
+                principalId: authz.userId,
+                role: authz.role,
+                isMachineActor: authz.isMachineActor,
+            };
+        },
+    };
+}
+export function createSupabaseAdminAuthFromEnv(env, accessToken, createClient) {
+    const client = createClient(env.url, env.anonKey, {
+        auth: { persistSession: false, autoRefreshToken: false },
+        global: {
+            headers: accessToken ? { Authorization: `Bearer ${accessToken}` } : {},
+        },
+    });
+    return createSupabaseAdminAuth(client);
+}

package/dist/identity/managedAdminUserGateways.d.ts

@@ -0,0 +1,123 @@
+import type { AdminUserInviteRole } from "./inviteAdminUserUseCase.js";
+import type { ManagedOperatorMembershipResult, OperatorInvitationConflict } from "./contracts/operatorInvitations.js";
+import type { InviteAdminUserGateway } from "./inviteAdminUserUseCase.js";
+import type { RemoveAdminUserGateway } from "./removeAdminUserUseCase.js";
+interface InviteAdminUserQuery {
+    insert(row: {
+        id: string;
+        email: string;
+        role: AdminUserInviteRole;
+        membership_state: "active";
+        membership_provenance: "invitation";
+        membership_accepted_at: string;
+    }): PromiseLike<{
+        error: {
+            code?: string;
+            message?: string;
+        } | null;
+    }>;
+    select(columns: string): {
+        eq(column: string, value: string): {
+            maybeSingle(): PromiseLike<{
+                data: {
+                    id: string;
+                    role?: string;
+                    membership_state?: string;
+                    is_machine_actor?: boolean | null;
+                } | null;
+                error?: unknown;
+            }>;
+        };
+    };
+}
+export interface InviteAdminUserClient {
+    auth: {
+        getUser(token: string): PromiseLike<{
+            data: {
+                user: {
+                    id: string;
+                } | null;
+            };
+            error: unknown;
+        }>;
+        admin: {
+            listUsers(options: {
+                page: number;
+                perPage: number;
+            }): PromiseLike<{
+                data: {
+                    users: Array<{
+                        id: string;
+                        email?: string | null;
+                    }>;
+                    nextPage?: number | null;
+                } | null;
+                error: unknown;
+            }>;
+            inviteUserByEmail(email: string, options: {
+                redirectTo: string;
+            }): PromiseLike<{
+                data: {
+                    user: {
+                        id: string;
+                    } | null;
+                };
+                error: {
+                    message: string;
+                } | null;
+            }>;
+        };
+    };
+    from(table: "admin_users"): InviteAdminUserQuery;
+}
+interface RemoveAdminUserQuery {
+    select(columns: string): {
+        eq(column: string, value: string): RemoveAdminUserQueryResult;
+    };
+}
+interface RemoveAdminUserQueryResult {
+    eq(column: string, value: string): RemoveAdminUserQueryResult;
+    maybeSingle(): PromiseLike<{
+        data: {
+            id: string;
+            role: string;
+        } | null;
+        error: {
+            message: string;
+        } | null;
+    }>;
+}
+export interface RemoveAdminUserClient {
+    auth: {
+        getUser(token: string): PromiseLike<{
+            data: {
+                user: {
+                    id: string;
+                } | null;
+            };
+            error: unknown;
+        }>;
+    };
+    from(table: "admin_users"): RemoveAdminUserQuery;
+    rpc(fn: "admin_revoke_admin_user", args: {
+        p_target: string;
+        p_reason: string | null;
+    }): PromiseLike<{
+        error: {
+            message: string;
+        } | null;
+    }>;
+}
+export declare function createInviteAdminUserGateway(clientFactory: () => InviteAdminUserClient): InviteAdminUserGateway & {
+    activateMembership(input: {
+        principalId: string;
+        email: string;
+        role: AdminUserInviteRole;
+    }): Promise<ManagedOperatorMembershipResult | {
+        code: OperatorInvitationConflict;
+    }>;
+};
+export declare function createRemoveAdminUserGateway(clientFactory: () => RemoveAdminUserClient): RemoveAdminUserGateway;
+/** Managed eligibility depends only on active native membership and known roles. */
+export declare function managedOperatorMagicLinkEligibility(rawClient: unknown, email: string): Promise<"eligible" | "not_allowlisted" | "role_not_allowed">;
+export {};

package/dist/identity/managedAdminUserGateways.js

@@ -0,0 +1,127 @@
+export function createInviteAdminUserGateway(clientFactory) {
+    let client = null;
+    const getClient = () => client ??= clientFactory();
+    async function membership(principalId) {
+        const { data, error } = await getClient().from("admin_users").select("id, role, membership_state, is_machine_actor").eq("id", principalId).maybeSingle();
+        if (error)
+            throw error;
+        return data;
+    }
+    function existing(row, role) {
+        if (row.is_machine_actor !== false)
+            return { code: "IDENTITY_CONFLICT" };
+        if (row.membership_state === "revoked")
+            return { code: "MANAGED_REINVITE_UNSUPPORTED" };
+        if (row.membership_state !== "active")
+            return { code: "IDENTITY_CONFLICT" };
+        if (row.role !== role)
+            return { code: "INVITATION_ROLE_CONFLICT" };
+        return { principalId: row.id, role, membershipState: "active", code: "ALREADY_ACTIVE" };
+    }
+    return {
+        async activateMembership(input) {
+            const before = await membership(input.principalId);
+            if (before)
+                return existing(before, input.role);
+            const { error } = await getClient().from("admin_users").insert({ id: input.principalId, email: input.email, role: input.role,
+                membership_state: "active", membership_provenance: "invitation", membership_accepted_at: new Date().toISOString() });
+            if (error) {
+                if (error.code !== "23505")
+                    throw error;
+                const raced = await membership(input.principalId);
+                if (!raced)
+                    throw error;
+                return existing(raced, input.role);
+            }
+            return { principalId: input.principalId, role: input.role, membershipState: "active", code: "MEMBERSHIP_CREATED" };
+        },
+        async getUser(accessToken) {
+            const { data, error } = await getClient().auth.getUser(accessToken);
+            return { user: data?.user ?? null, error };
+        },
+        async findAdminUser(userId) {
+            const { data, error } = await getClient()
+                .from("admin_users")
+                .select("id, role, membership_state, is_machine_actor")
+                .eq("id", userId)
+                .maybeSingle();
+            if (error)
+                throw error;
+            return data && typeof data.role === "string" && typeof data.membership_state === "string" ? { id: data.id, role: data.role, membership_state: data.membership_state, is_machine_actor: data.is_machine_actor !== false } : null;
+        },
+        async findAdminUserByEmail(email) {
+            const { data, error } = await getClient()
+                .from("admin_users")
+                .select("id")
+                .eq("email", email)
+                .maybeSingle();
+            if (error)
+                throw error;
+            return data ? { id: data.id } : null;
+        },
+        async findAuthUserByEmail(email) {
+            const normalizedEmail = email.trim().toLowerCase();
+            const perPage = 1000;
+            const maxUsers = 5000;
+            let page = 1;
+            let scanned = 0;
+            while (scanned < maxUsers) {
+                const { data, error } = await getClient().auth.admin.listUsers({ page, perPage });
+                if (error)
+                    throw error;
+                const users = data?.users ?? [];
+                const match = users.find((user) => (user.email ?? "").trim().toLowerCase() === normalizedEmail);
+                if (match)
+                    return { id: match.id, email: match.email };
+                scanned += users.length;
+                if (!data?.nextPage)
+                    return null;
+                page = data.nextPage;
+            }
+            throw new Error("auth_user_lookup_cap_exceeded");
+        },
+        async inviteAuthUser(input) {
+            const { data, error } = await getClient().auth.admin.inviteUserByEmail(input.email, {
+                redirectTo: input.redirectTo,
+            });
+            return { user: data.user, error };
+        },
+    };
+}
+export function createRemoveAdminUserGateway(clientFactory) {
+    let client = null;
+    const getClient = () => client ??= clientFactory();
+    return {
+        async getUser(accessToken) {
+            const { data, error } = await getClient().auth.getUser(accessToken);
+            return { user: data?.user ?? null, error };
+        },
+        async findAdminUser(userId) {
+            const { data, error } = await getClient()
+                .from("admin_users")
+                .select("id, role")
+                .eq("id", userId)
+                .eq("membership_state", "active")
+                .maybeSingle();
+            if (error)
+                throw error;
+            return data;
+        },
+        async revokeAdminUser(userId) {
+            return await getClient().rpc("admin_revoke_admin_user", {
+                p_target: userId,
+                p_reason: null,
+            });
+        },
+    };
+}
+/** Managed eligibility depends only on active native membership and known roles. */
+export async function managedOperatorMagicLinkEligibility(rawClient, email) {
+    const client = rawClient;
+    const { data, error } = await client.from("admin_users").select("id, role").eq("email", email.trim().toLowerCase()).eq("membership_state", "active").maybeSingle();
+    if (error)
+        throw error;
+    if (!data)
+        return "not_allowlisted";
+    return data.role === "admin" || data.role === "distributor" ? "eligible" : "role_not_allowed";
+}

package/dist/identity/managedClient.d.ts

@@ -0,0 +1,90 @@
+import type { SupabaseCreateClient } from "../data/index.js";
+export interface ManagedIdentityUser {
+    id: string;
+    email?: string | null;
+    email_confirmed_at?: string | null;
+    user_metadata?: Record<string, unknown> | null;
+}
+export interface ManagedIdentityRow {
+    id: string;
+    email?: string | null;
+    auth_user_id?: string | null;
+    role?: string | null;
+    is_machine_actor?: boolean | null;
+    membership_state?: string;
+}
+export interface ManagedIdentityQuery extends PromiseLike<{
+    data: ManagedIdentityRow[] | null;
+    error: unknown;
+}> {
+    select(columns: string): ManagedIdentityQuery;
+    eq(column: string, value: string): ManagedIdentityQuery;
+    filter(column: string, operator: "imatch", value: string): ManagedIdentityQuery;
+    is(column: string, value: null): ManagedIdentityQuery;
+    order(column: string, options: {
+        ascending: boolean;
+    }): ManagedIdentityQuery;
+    limit(count: number): ManagedIdentityQuery;
+    maybeSingle(): PromiseLike<{
+        data: ManagedIdentityRow | null;
+        error: unknown;
+    }>;
+    single(): PromiseLike<{
+        data: ManagedIdentityRow | null;
+        error: unknown;
+    }>;
+}
+export interface ManagedIdentityTable {
+    select(columns: string): ManagedIdentityQuery;
+    update(value: Record<string, unknown>): ManagedIdentityQuery;
+    insert(value: Record<string, unknown>): ManagedIdentityQuery;
+}
+/** Only the methods consumed by the identity adapters; the host owns the SDK. */
+export interface ManagedIdentityClient {
+    from(table: string): ManagedIdentityTable;
+    auth: {
+        getUser(token: string): PromiseLike<{
+            data: {
+                user: ManagedIdentityUser | null;
+            };
+            error: unknown;
+        }>;
+        admin: {
+            listUsers(options: {
+                page: number;
+                perPage: number;
+            }): PromiseLike<{
+                data: {
+                    users: ManagedIdentityUser[];
+                    nextPage?: number | null;
+                };
+                error: unknown;
+            }>;
+            getUserById(id: string): PromiseLike<{
+                data: {
+                    user: ManagedIdentityUser | null;
+                };
+                error: unknown;
+            }>;
+            createUser(input: {
+                email: string;
+                email_confirm: boolean;
+            }): PromiseLike<{
+                data: {
+                    user: ManagedIdentityUser | null;
+                };
+                error: unknown;
+            }>;
+        };
+    };
+}
+export declare function createManagedIdentityClients(createClient: SupabaseCreateClient): {
+    actor: (env: {
+        url: string;
+        anonKey: string;
+    }, accessToken: string | null) => ManagedIdentityClient;
+    service: (env: {
+        url: string;
+        serviceRoleKey: string;
+    }) => ManagedIdentityClient;
+};

package/dist/identity/managedClient.js

@@ -0,0 +1,10 @@
+export function createManagedIdentityClients(createClient) {
+    const actor = (env, accessToken) => createClient(env.url, env.anonKey, {
+        auth: { persistSession: false, autoRefreshToken: false },
+        global: { headers: accessToken ? { Authorization: `Bearer ${accessToken}` } : {} },
+    });
+    const service = (env) => createClient(env.url, env.serviceRoleKey, {
+        auth: { persistSession: false, autoRefreshToken: false },
+    });
+    return { actor, service };
+}

package/dist/identity/managedClientAuthLink.d.ts

@@ -0,0 +1,3 @@
+import type { EmailTrustPolicy } from "./emailTrustPolicy.js";
+import type { ClientAuthLinkStore } from "./ports.js";
+export declare function createSupabaseClientAuthLinkStore(rawClient: unknown, emailTrustPolicy: EmailTrustPolicy): ClientAuthLinkStore;