@openlup/platform 0.15.0 → 0.16.0

package/dist/identity/managedClientAuthLink.js

@@ -0,0 +1,115 @@
+export function createSupabaseClientAuthLinkStore(rawClient, emailTrustPolicy) {
+    const client = rawClient;
+    return {
+        emailTrustPolicy,
+        async findClientByEmail(email) {
+            const rows = await findManagedContactsByEmail(client, email, true);
+            const row = rows[0];
+            if (!row)
+                return null;
+            return { id: row.id, authUserId: row.auth_user_id ?? null };
+        },
+        async findAuthUserIdByEmail(email) {
+            const perPage = 1000;
+            const maxUsers = 5000;
+            let page = 1;
+            let scanned = 0;
+            while (scanned < maxUsers) {
+                const { data, error } = await client.auth.admin.listUsers({ page, perPage });
+                if (error)
+                    throw error;
+                const users = data.users;
+                const match = users.find((u) => (u.email ?? "").trim().toLowerCase() === email);
+                if (match)
+                    return match.id;
+                scanned += users.length;
+                const nextPage = "nextPage" in data ? data.nextPage : null;
+                if (!nextPage)
+                    return null;
+                page = nextPage;
+            }
+            throw new Error("auth_user_lookup_cap_exceeded");
+        },
+        async findAuthUserEmailById(authUserId) {
+            const { data, error } = await client.auth.admin.getUserById(authUserId);
+            if (error)
+                throw error;
+            return data.user?.email ?? null;
+        },
+        async createAuthUser(email) {
+            const { data, error } = await client.auth.admin.createUser({
+                email,
+                email_confirm: false,
+            });
+            if (error && isAlreadyRegistered(error))
+                return null;
+            if (error)
+                throw error;
+            if (!data.user)
+                throw new Error("createUser returned no user");
+            return data.user.id;
+        },
+        async findAdminIdentity(authUserId) {
+            const { data, error } = await client
+                .from("admin_users")
+                .select("id, is_machine_actor")
+                .eq("id", authUserId)
+                .maybeSingle();
+            if (error)
+                throw error;
+            if (!data)
+                return null;
+            return { isMachineActor: data.is_machine_actor !== false };
+        },
+        async setClientAuthUserId(clientId, authUserId) {
+            const { data, error } = await client
+                .from("clients")
+                .update({ auth_user_id: authUserId })
+                .eq("id", clientId)
+                .is("auth_user_id", null)
+                .select("auth_user_id")
+                .maybeSingle();
+            if (error)
+                throw error;
+            if (data?.auth_user_id === authUserId) {
+                return { ok: true, alreadyLinked: false };
+            }
+            const { data: current, error: currentError } = await client
+                .from("clients")
+                .select("auth_user_id")
+                .eq("id", clientId)
+                .maybeSingle();
+            if (currentError)
+                throw currentError;
+            if (current?.auth_user_id === authUserId) {
+                return { ok: true, alreadyLinked: true };
+            }
+            return {
+                ok: false,
+                code: "CLIENT_AUTH_LINK_CONFLICT",
+                existingAuthUserId: current?.auth_user_id ?? null,
+            };
+        },
+    };
+}
+function isAlreadyRegistered(error) {
+    const failure = (error ?? {});
+    if (failure.code === "email_exists" || failure.code === "user_already_exists")
+        return true;
+    return failure.status === 422 && typeof failure.message === "string"
+        && /already (been )?registered/i.test(failure.message);
+}
+async function findManagedContactsByEmail(client, email, oldestFirst) {
+    const normalized = email.trim().toLowerCase();
+    // Escaping bounds the database prefilter; Unicode regex folding can still
+    // widen it, so only exact normalized addresses may cross this boundary.
+    let query = client.from("clients")
+        .select("id, email, auth_user_id")
+        .filter("email", "imatch", `^${normalized.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&")}$`);
+    if (oldestFirst)
+        query = query.order("created_at", { ascending: true });
+    const { data, error } = await query.limit(10);
+    if (error)
+        throw error;
+    return (data ?? []).filter((row) => row.email?.trim().toLowerCase() === normalized);
+}

package/dist/identity/managedCustomerMe.d.ts

@@ -0,0 +1,13 @@
+import type { CustomerMeResponse } from "./customerContracts.js";
+import type { CustomerMePort } from "./customerPorts.js";
+type LinkedCustomerRow = {
+    id: string;
+    email: string;
+    first_name: string | null;
+    last_name: string | null;
+    phone: string | null;
+    lifecycle_stage: CustomerMeResponse["lifecycleStage"];
+};
+export declare function readLinkedCustomer(rawClient: unknown, userId: string, includePhone?: boolean): Promise<LinkedCustomerRow | null>;
+export declare function createSupabaseCustomerMePort(rawClient: unknown): CustomerMePort;
+export {};

package/dist/identity/managedCustomerMe.js

@@ -0,0 +1,30 @@
+export async function readLinkedCustomer(rawClient, userId, includePhone = false) {
+    const client = rawClient;
+    const { data, error } = await client
+        .from("clients")
+        .select(includePhone
+        ? "id, email, first_name, last_name, phone, lifecycle_stage"
+        : "id, email, first_name, last_name, lifecycle_stage")
+        .eq("auth_user_id", userId)
+        .maybeSingle();
+    if (error)
+        throw error;
+    return data;
+}
+export function createSupabaseCustomerMePort(rawClient) {
+    const client = rawClient;
+    return {
+        async getCustomerMe(userId) {
+            const data = await readLinkedCustomer(client, userId);
+            if (!data)
+                return null;
+            return {
+                clientId: data.id,
+                email: data.email,
+                firstName: data.first_name,
+                lastName: data.last_name,
+                lifecycleStage: data.lifecycle_stage,
+            };
+        },
+    };
+}

package/dist/identity/managedEmailTrustPolicy.d.ts

@@ -0,0 +1,11 @@
+import type { EmailTrustPolicy } from "./emailTrustPolicy.js";
+/** Server-side assertion by the adopter, never a provider certification. */
+export declare function parseEmailVerifyingProviders(value: string): readonly string[];
+/** One immutable origin/key/allowlist binding; import and construction perform no I/O. */
+export declare function createManagedEmailTrustPolicy(options: {
+    authBaseUrl: string;
+    publicKey: string;
+    emailVerifyingProviders?: readonly string[];
+    fetch?: typeof globalThis.fetch;
+    now?: () => number;
+}): EmailTrustPolicy;

package/dist/identity/managedEmailTrustPolicy.js

@@ -0,0 +1,105 @@
+const unavailable = { trusted: false, code: "EMAIL_TRUST_SETTINGS_UNAVAILABLE" };
+const refused = { trusted: false, code: "EMAIL_TRUST_ENVELOPE_REFUSED" };
+const providerId = /^[a-z][a-z0-9_-]*$/;
+/** Server-side assertion by the adopter, never a provider certification. */
+export function parseEmailVerifyingProviders(value) {
+    if (!value.trim())
+        return [];
+    const entries = value.split(",").map(entry => entry.trim().toLowerCase());
+    if (entries.some(entry => !providerId.test(entry)))
+        throw new Error("Invalid email-verifying provider declaration");
+    return [...new Set(entries)].sort();
+}
+/** One immutable origin/key/allowlist binding; import and construction perform no I/O. */
+export function createManagedEmailTrustPolicy(options) {
+    const origin = new URL(options.authBaseUrl);
+    if (!["http:", "https:"].includes(origin.protocol) || origin.username || origin.password
+        || origin.pathname !== "/" || origin.search || origin.hash || !options.publicKey.trim()) {
+        throw new Error("Invalid identity email-trust configuration");
+    }
+    const url = new URL("/auth/v1/settings", origin);
+    const publicKey = options.publicKey;
+    const allowed = new Set(parseEmailVerifyingProviders((options.emailVerifyingProviders ?? []).join(",")));
+    const fetchSettings = options.fetch ?? globalThis.fetch;
+    const now = options.now ?? Date.now;
+    let cached;
+    let inFlight;
+    function decode(value) {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return unavailable;
+        const { mailer_autoconfirm: automatic, external } = value;
+        if (typeof automatic !== "boolean" || !external || typeof external !== "object" || Array.isArray(external))
+            return unavailable;
+        const entries = Object.entries(external);
+        if (entries.some(([key, enabled]) => !providerId.test(key) || typeof enabled !== "boolean"))
+            return unavailable;
+        if (automatic || entries.some(([key, enabled]) => enabled && key !== "email" && !allowed.has(key)))
+            return refused;
+        return { trusted: true };
+    }
+    async function load() {
+        const controller = new AbortController();
+        let timer;
+        const deadline = new Promise((_, reject) => {
+            timer = setTimeout(() => { controller.abort(); reject(new Error("Identity settings deadline")); }, 3000);
+        });
+        async function read() {
+            const response = await fetchSettings(url, {
+                headers: { apikey: publicKey }, redirect: "error", signal: controller.signal,
+            });
+            if (!response.ok || response.redirected || !response.body)
+                return unavailable;
+            const reader = response.body.getReader();
+            let bytes = 0;
+            const chunks = [];
+            try {
+                while (true) {
+                    const chunk = await reader.read();
+                    if (chunk.done)
+                        break;
+                    bytes += chunk.value.byteLength;
+                    if (bytes > 65536) {
+                        controller.abort();
+                        void reader.cancel().catch(() => { });
+                        return unavailable;
+                    }
+                    chunks.push(chunk.value);
+                }
+            }
+            finally {
+                reader.releaseLock();
+            }
+            const body = new Uint8Array(bytes);
+            let offset = 0;
+            for (const chunk of chunks) {
+                body.set(chunk, offset);
+                offset += chunk.byteLength;
+            }
+            return decode(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(body)));
+        }
+        try {
+            return await Promise.race([read(), deadline]);
+        }
+        catch {
+            return unavailable;
+        }
+        finally {
+            controller.abort();
+            clearTimeout(timer);
+        }
+    }
+    return {
+        async assess() {
+            if (cached && now() < cached.expires)
+                return cached.result;
+            if (!inFlight) {
+                inFlight = load().then(result => {
+                    const ttl = !result.trusted && result.code === "EMAIL_TRUST_SETTINGS_UNAVAILABLE" ? 5000 : 60000;
+                    cached = { result, expires: now() + ttl };
+                    return result;
+                }).finally(() => { inFlight = undefined; });
+            }
+            return inFlight;
+        },
+    };
+}

package/dist/identity/managedIdentityVerifier.d.ts

@@ -0,0 +1,2 @@
+import type { IdentityVerifierPort } from "./ports.js";
+export declare function createSupabaseIdentityVerifier(rawClient: unknown): IdentityVerifierPort;

package/dist/identity/managedIdentityVerifier.js

@@ -0,0 +1,16 @@
+export function createSupabaseIdentityVerifier(rawClient) {
+    const client = rawClient;
+    return {
+        async verifyAccessToken(accessToken) {
+            const { data, error } = await client.auth.getUser(accessToken);
+            if (error || !data.user)
+                return null;
+            const user = data.user;
+            return {
+                principalId: user.id,
+                email: user.email ?? null,
+                emailVerified: Boolean(user.email_confirmed_at),
+            };
+        },
+    };
+}

package/dist/identity/managedPrivacy.d.ts

@@ -0,0 +1,4 @@
+import type { ManagedIdentityClient } from "./managedClient.js";
+import { type PrivacyStore } from "./privacyPorts.js";
+/** Reads only committed service projections. No managed write or provider delete is composed. */
+export declare function createManagedPrivacyStore(): PrivacyStore<ManagedIdentityClient>;

package/dist/identity/managedPrivacy.js

@@ -0,0 +1,39 @@
+import { PrivacyRefusal } from "./privacyPorts.js";
+/** Reads only committed service projections. No managed write or provider delete is composed. */
+export function createManagedPrivacyStore() {
+    const refuse = async () => { throw new PrivacyRefusal("MANAGED_PRIVACY_ERASURE_UNAVAILABLE"); };
+    return {
+        erasureSupported: false, prepareErasure: refuse, authorizeErasure: refuse, eraseIdentity: refuse, saveReceipt: refuse,
+        async findReceipt() { return null; },
+        async resolve(client, ref) {
+            const query = client.from("clients").select("id, email, auth_user_id, first_name, last_name, phone");
+            const { data: contact, error } = await query.eq(ref.kind === "contact" ? "id" : "auth_user_id", ref.kind === "contact" ? ref.contactId : ref.principalId).maybeSingle();
+            if (error)
+                throw new PrivacyRefusal("PRIVACY_ASSESSMENT_UNAVAILABLE");
+            const principalId = ref.kind === "principal" ? ref.principalId : contact?.auth_user_id ?? null;
+            let principal = null;
+            let membership = null;
+            if (principalId) {
+                const result = await client.auth.admin.getUserById(principalId);
+                if (result.error) {
+                    const failure = result.error;
+                    if (!contact && (failure.status === 404 || failure.code === "user_not_found"))
+                        return null;
+                    throw new PrivacyRefusal("PRIVACY_ASSESSMENT_UNAVAILABLE");
+                }
+                if (result.data.user)
+                    principal = { principal_id: result.data.user.id, email: result.data.user.email ?? null, email_confirmed_at: result.data.user.email_confirmed_at ?? null };
+                const read = await client.from("admin_users").select("id, membership_state, role, is_machine_actor").eq("id", principalId).maybeSingle();
+                if (read.error)
+                    throw new PrivacyRefusal("PRIVACY_ASSESSMENT_UNAVAILABLE");
+                membership = read.data ? JSON.parse(JSON.stringify(read.data)) : null;
+            }
+            if (!contact && !principal)
+                return null;
+            return { contactId: contact?.id ?? null, principalId, identity: {
+                    contact: contact ? JSON.parse(JSON.stringify(contact)) : null, principal, membership,
+                    unavailable: ["contact.country", "identity.audit-history", "identity.invitation-history", "identity.erasure-receipts"],
+                } };
+        },
+    };
+}

package/dist/identity/messages.d.ts

@@ -0,0 +1,29 @@
+type Role = "admin" | "distributor";
+declare const en: {
+    unauthorized: string;
+    invalidToken: string;
+    inviteForbidden: string;
+    emailRequired: string;
+    invalidRole: string;
+    alreadyAdded: string;
+    addFailed: (detail: string) => string;
+    notificationFailed: (detail: string) => string;
+    roleAddedDisabled: (email: string, role: Role) => string;
+    roleAddedSuppressed: (email: string, role: Role) => string;
+    roleAdded: (email: string, role: Role) => string;
+    inviteFailed: (detail: string) => string;
+    roleInsertFailed: (detail: string) => string;
+    invited: (email: string, role: Role) => string;
+    removeForbidden: string;
+    userIdRequired: string;
+    selfRemoveForbidden: string;
+    lastAdmin: string;
+    selfRevoke: string;
+    machineRevoke: string;
+    adminNotFound: string;
+    adminRequired: string;
+    revokeFailed: (detail: string) => string;
+};
+export type IdentityMessages = typeof en;
+export declare const identityMessages: Readonly<Record<"en" | "pl", IdentityMessages>>;
+export {};

package/dist/identity/messages.js

@@ -0,0 +1,39 @@
+const roleName = (role) => role === "admin" ? "Admin" : "Dystrybutor";
+const en = {
+    unauthorized: "Unauthorized", invalidToken: "Invalid token",
+    inviteForbidden: "Only admins may invite users", emailRequired: "Email required",
+    invalidRole: "Invalid role", alreadyAdded: "This user is already added",
+    addFailed: (detail) => `Adding user failed: ${detail}`,
+    notificationFailed: (detail) => `Role added, but notification failed: ${detail}`,
+    roleAddedDisabled: (email, role) => `User ${email} already had an account; added role ${role}, but notification was disabled and not sent.`,
+    roleAddedSuppressed: (email, role) => `User ${email} already had an account; added role ${role}, but notification was suppressed and not sent.`,
+    roleAdded: (email, role) => `User ${email} already had an account; added role ${role} and sent a notification.`,
+    inviteFailed: (detail) => `Invitation failed: ${detail}`,
+    roleInsertFailed: (detail) => `Account created, but adding role failed: ${detail}`,
+    invited: (email, role) => `Invitation with role ${role} sent to ${email}`,
+    removeForbidden: "Only admins may revoke user access", userIdRequired: "User ID required",
+    selfRemoveForbidden: "You cannot revoke your own access",
+    lastAdmin: "At least one active human admin must remain.",
+    selfRevoke: "You cannot revoke your own access.",
+    machineRevoke: "Machine actors cannot be revoked through this route.",
+    adminNotFound: "Admin user not found.", adminRequired: "Admin role required.",
+    revokeFailed: (detail) => `Admin access revoke failed: ${detail}`,
+};
+export const identityMessages = {
+    en,
+    pl: {
+        ...en,
+        inviteForbidden: "Tylko admini mogą zapraszać użytkowników", emailRequired: "Brak emaila",
+        invalidRole: "Nieprawidłowa rola", alreadyAdded: "Ten użytkownik jest już dodany",
+        addFailed: (detail) => `Błąd dodawania: ${detail}`,
+        notificationFailed: (detail) => `Rola dodana, ale nie udało się wysłać powiadomienia: ${detail}`,
+        roleAddedDisabled: (email, role) => `Użytkownik ${email} już miał konto — dodano rolę ${roleName(role)}, ale powiadomienie było wyłączone i nie zostało wysłane.`,
+        roleAddedSuppressed: (email, role) => `Użytkownik ${email} już miał konto — dodano rolę ${roleName(role)}, ale wysłanie powiadomienia zostało zablokowane i nie zostało wysłane.`,
+        roleAdded: (email, role) => `Użytkownik ${email} już miał konto — dodano rolę ${roleName(role)} i wysłano powiadomienie.`,
+        inviteFailed: (detail) => `Błąd zaproszenia: ${detail}`,
+        roleInsertFailed: (detail) => `Konto utworzone, ale błąd dodawania roli: ${detail}`,
+        invited: (email, role) => `Zaproszenie z rolą ${roleName(role)} wysłane na ${email}`,
+        removeForbidden: "Tylko administratorzy mogą odbierać dostęp użytkownikom",
+        userIdRequired: "Brak ID użytkownika", selfRemoveForbidden: "Nie możesz odebrać sobie dostępu",
+    },
+};

package/dist/identity/oidcIdentityVerifier.d.ts

@@ -0,0 +1,45 @@
+import type { IdentityJwtLibraryLoader } from "./jwtLibrary.js";
+import type { IdentityVerifierPort, VerifiedPrincipal } from "./ports.js";
+import type { OidcFailureCode } from "./contracts/oidc.js";
+export interface OidcIdentityVerifierConfig {
+    issuer: string;
+    audience: string;
+    algorithms: readonly ("RS256" | "ES256")[];
+    maxTokenLifetimeSeconds: number;
+    requireSingleAudience?: boolean;
+    /** Conformance only: literal loopback addresses, never arbitrary HTTP hosts. */
+    allowLoopbackHttp?: boolean;
+}
+export type OidcVerificationResult = {
+    ok: true;
+    principal: VerifiedPrincipal;
+    expiresAt: string;
+} | {
+    ok: false;
+    code: OidcFailureCode;
+};
+export interface OidcReadinessReport {
+    state: "ready" | "unknown" | "unsatisfied";
+    discovery: {
+        reachable: boolean;
+        valid: boolean;
+        checkedAt: string | null;
+        expiresAt: string | null;
+    };
+    jwks: {
+        loaded: boolean;
+        checkedAt: string | null;
+        expiresAt: string | null;
+    };
+    code?: OidcFailureCode;
+}
+export interface OidcIdentityVerifier extends IdentityVerifierPort {
+    verifyToken(token: string): Promise<OidcVerificationResult>;
+    readiness(): Promise<OidcReadinessReport>;
+}
+/** One binding per host/configuration. Imports and construction perform no I/O or JWT loading. */
+export declare function createOidcIdentityVerifier(config: OidcIdentityVerifierConfig, dependencies: {
+    loadJwt: IdentityJwtLibraryLoader;
+    fetch?: typeof globalThis.fetch;
+    now?: () => number;
+}): OidcIdentityVerifier;