@openlup/platform 0.15.0 → 0.17.0

package/dist/identity/managedAdminUserGateways.d.ts

@@ -0,0 +1,123 @@
+import type { AdminUserInviteRole } from "./inviteAdminUserUseCase.js";
+import type { ManagedOperatorMembershipResult, OperatorInvitationConflict } from "./contracts/operatorInvitations.js";
+import type { InviteAdminUserGateway } from "./inviteAdminUserUseCase.js";
+import type { RemoveAdminUserGateway } from "./removeAdminUserUseCase.js";
+interface InviteAdminUserQuery {
+    insert(row: {
+        id: string;
+        email: string;
+        role: AdminUserInviteRole;
+        membership_state: "active";
+        membership_provenance: "invitation";
+        membership_accepted_at: string;
+    }): PromiseLike<{
+        error: {
+            code?: string;
+            message?: string;
+        } | null;
+    }>;
+    select(columns: string): {
+        eq(column: string, value: string): {
+            maybeSingle(): PromiseLike<{
+                data: {
+                    id: string;
+                    role?: string;
+                    membership_state?: string;
+                    is_machine_actor?: boolean | null;
+                } | null;
+                error?: unknown;
+            }>;
+        };
+    };
+}
+export interface InviteAdminUserClient {
+    auth: {
+        getUser(token: string): PromiseLike<{
+            data: {
+                user: {
+                    id: string;
+                } | null;
+            };
+            error: unknown;
+        }>;
+        admin: {
+            listUsers(options: {
+                page: number;
+                perPage: number;
+            }): PromiseLike<{
+                data: {
+                    users: Array<{
+                        id: string;
+                        email?: string | null;
+                    }>;
+                    nextPage?: number | null;
+                } | null;
+                error: unknown;
+            }>;
+            inviteUserByEmail(email: string, options: {
+                redirectTo: string;
+            }): PromiseLike<{
+                data: {
+                    user: {
+                        id: string;
+                    } | null;
+                };
+                error: {
+                    message: string;
+                } | null;
+            }>;
+        };
+    };
+    from(table: "admin_users"): InviteAdminUserQuery;
+}
+interface RemoveAdminUserQuery {
+    select(columns: string): {
+        eq(column: string, value: string): RemoveAdminUserQueryResult;
+    };
+}
+interface RemoveAdminUserQueryResult {
+    eq(column: string, value: string): RemoveAdminUserQueryResult;
+    maybeSingle(): PromiseLike<{
+        data: {
+            id: string;
+            role: string;
+        } | null;
+        error: {
+            message: string;
+        } | null;
+    }>;
+}
+export interface RemoveAdminUserClient {
+    auth: {
+        getUser(token: string): PromiseLike<{
+            data: {
+                user: {
+                    id: string;
+                } | null;
+            };
+            error: unknown;
+        }>;
+    };
+    from(table: "admin_users"): RemoveAdminUserQuery;
+    rpc(fn: "admin_revoke_admin_user", args: {
+        p_target: string;
+        p_reason: string | null;
+    }): PromiseLike<{
+        error: {
+            message: string;
+        } | null;
+    }>;
+}
+export declare function createInviteAdminUserGateway(clientFactory: () => InviteAdminUserClient): InviteAdminUserGateway & {
+    activateMembership(input: {
+        principalId: string;
+        email: string;
+        role: AdminUserInviteRole;
+    }): Promise<ManagedOperatorMembershipResult | {
+        code: OperatorInvitationConflict;
+    }>;
+};
+export declare function createRemoveAdminUserGateway(clientFactory: () => RemoveAdminUserClient): RemoveAdminUserGateway;
+/** Managed eligibility depends only on active native membership and known roles. */
+export declare function managedOperatorMagicLinkEligibility(rawClient: unknown, email: string): Promise<"eligible" | "not_allowlisted" | "role_not_allowed">;
+export {};

package/dist/identity/managedAdminUserGateways.js

@@ -0,0 +1,127 @@
+export function createInviteAdminUserGateway(clientFactory) {
+    let client = null;
+    const getClient = () => client ??= clientFactory();
+    async function membership(principalId) {
+        const { data, error } = await getClient().from("admin_users").select("id, role, membership_state, is_machine_actor").eq("id", principalId).maybeSingle();
+        if (error)
+            throw error;
+        return data;
+    }
+    function existing(row, role) {
+        if (row.is_machine_actor !== false)
+            return { code: "IDENTITY_CONFLICT" };
+        if (row.membership_state === "revoked")
+            return { code: "MANAGED_REINVITE_UNSUPPORTED" };
+        if (row.membership_state !== "active")
+            return { code: "IDENTITY_CONFLICT" };
+        if (row.role !== role)
+            return { code: "INVITATION_ROLE_CONFLICT" };
+        return { principalId: row.id, role, membershipState: "active", code: "ALREADY_ACTIVE" };
+    }
+    return {
+        async activateMembership(input) {
+            const before = await membership(input.principalId);
+            if (before)
+                return existing(before, input.role);
+            const { error } = await getClient().from("admin_users").insert({ id: input.principalId, email: input.email, role: input.role,
+                membership_state: "active", membership_provenance: "invitation", membership_accepted_at: new Date().toISOString() });
+            if (error) {
+                if (error.code !== "23505")
+                    throw error;
+                const raced = await membership(input.principalId);
+                if (!raced)
+                    throw error;
+                return existing(raced, input.role);
+            }
+            return { principalId: input.principalId, role: input.role, membershipState: "active", code: "MEMBERSHIP_CREATED" };
+        },
+        async getUser(accessToken) {
+            const { data, error } = await getClient().auth.getUser(accessToken);
+            return { user: data?.user ?? null, error };
+        },
+        async findAdminUser(userId) {
+            const { data, error } = await getClient()
+                .from("admin_users")
+                .select("id, role, membership_state, is_machine_actor")
+                .eq("id", userId)
+                .maybeSingle();
+            if (error)
+                throw error;
+            return data && typeof data.role === "string" && typeof data.membership_state === "string" ? { id: data.id, role: data.role, membership_state: data.membership_state, is_machine_actor: data.is_machine_actor !== false } : null;
+        },
+        async findAdminUserByEmail(email) {
+            const { data, error } = await getClient()
+                .from("admin_users")
+                .select("id")
+                .eq("email", email)
+                .maybeSingle();
+            if (error)
+                throw error;
+            return data ? { id: data.id } : null;
+        },
+        async findAuthUserByEmail(email) {
+            const normalizedEmail = email.trim().toLowerCase();
+            const perPage = 1000;
+            const maxUsers = 5000;
+            let page = 1;
+            let scanned = 0;
+            while (scanned < maxUsers) {
+                const { data, error } = await getClient().auth.admin.listUsers({ page, perPage });
+                if (error)
+                    throw error;
+                const users = data?.users ?? [];
+                const match = users.find((user) => (user.email ?? "").trim().toLowerCase() === normalizedEmail);
+                if (match)
+                    return { id: match.id, email: match.email };
+                scanned += users.length;
+                if (!data?.nextPage)
+                    return null;
+                page = data.nextPage;
+            }
+            throw new Error("auth_user_lookup_cap_exceeded");
+        },
+        async inviteAuthUser(input) {
+            const { data, error } = await getClient().auth.admin.inviteUserByEmail(input.email, {
+                redirectTo: input.redirectTo,
+            });
+            return { user: data.user, error };
+        },
+    };
+}
+export function createRemoveAdminUserGateway(clientFactory) {
+    let client = null;
+    const getClient = () => client ??= clientFactory();
+    return {
+        async getUser(accessToken) {
+            const { data, error } = await getClient().auth.getUser(accessToken);
+            return { user: data?.user ?? null, error };
+        },
+        async findAdminUser(userId) {
+            const { data, error } = await getClient()
+                .from("admin_users")
+                .select("id, role")
+                .eq("id", userId)
+                .eq("membership_state", "active")
+                .maybeSingle();
+            if (error)
+                throw error;
+            return data;
+        },
+        async revokeAdminUser(userId) {
+            return await getClient().rpc("admin_revoke_admin_user", {
+                p_target: userId,
+                p_reason: null,
+            });
+        },
+    };
+}
+/** Managed eligibility depends only on active native membership and known roles. */
+export async function managedOperatorMagicLinkEligibility(rawClient, email) {
+    const client = rawClient;
+    const { data, error } = await client.from("admin_users").select("id, role").eq("email", email.trim().toLowerCase()).eq("membership_state", "active").maybeSingle();
+    if (error)
+        throw error;
+    if (!data)
+        return "not_allowlisted";
+    return data.role === "admin" || data.role === "distributor" ? "eligible" : "role_not_allowed";
+}

package/dist/identity/managedClient.d.ts

@@ -0,0 +1,90 @@
+import type { SupabaseCreateClient } from "../data/index.js";
+export interface ManagedIdentityUser {
+    id: string;
+    email?: string | null;
+    email_confirmed_at?: string | null;
+    user_metadata?: Record<string, unknown> | null;
+}
+export interface ManagedIdentityRow {
+    id: string;
+    email?: string | null;
+    auth_user_id?: string | null;
+    role?: string | null;
+    is_machine_actor?: boolean | null;
+    membership_state?: string;
+}
+export interface ManagedIdentityQuery extends PromiseLike<{
+    data: ManagedIdentityRow[] | null;
+    error: unknown;
+}> {
+    select(columns: string): ManagedIdentityQuery;
+    eq(column: string, value: string): ManagedIdentityQuery;
+    filter(column: string, operator: "imatch", value: string): ManagedIdentityQuery;
+    is(column: string, value: null): ManagedIdentityQuery;
+    order(column: string, options: {
+        ascending: boolean;
+    }): ManagedIdentityQuery;
+    limit(count: number): ManagedIdentityQuery;
+    maybeSingle(): PromiseLike<{
+        data: ManagedIdentityRow | null;
+        error: unknown;
+    }>;
+    single(): PromiseLike<{
+        data: ManagedIdentityRow | null;
+        error: unknown;
+    }>;
+}
+export interface ManagedIdentityTable {
+    select(columns: string): ManagedIdentityQuery;
+    update(value: Record<string, unknown>): ManagedIdentityQuery;
+    insert(value: Record<string, unknown>): ManagedIdentityQuery;
+}
+/** Only the methods consumed by the identity adapters; the host owns the SDK. */
+export interface ManagedIdentityClient {
+    from(table: string): ManagedIdentityTable;
+    auth: {
+        getUser(token: string): PromiseLike<{
+            data: {
+                user: ManagedIdentityUser | null;
+            };
+            error: unknown;
+        }>;
+        admin: {
+            listUsers(options: {
+                page: number;
+                perPage: number;
+            }): PromiseLike<{
+                data: {
+                    users: ManagedIdentityUser[];
+                    nextPage?: number | null;
+                };
+                error: unknown;
+            }>;
+            getUserById(id: string): PromiseLike<{
+                data: {
+                    user: ManagedIdentityUser | null;
+                };
+                error: unknown;
+            }>;
+            createUser(input: {
+                email: string;
+                email_confirm: boolean;
+            }): PromiseLike<{
+                data: {
+                    user: ManagedIdentityUser | null;
+                };
+                error: unknown;
+            }>;
+        };
+    };
+}
+export declare function createManagedIdentityClients(createClient: SupabaseCreateClient): {
+    actor: (env: {
+        url: string;
+        anonKey: string;
+    }, accessToken: string | null) => ManagedIdentityClient;
+    service: (env: {
+        url: string;
+        serviceRoleKey: string;
+    }) => ManagedIdentityClient;
+};

package/dist/identity/managedClient.js

@@ -0,0 +1,10 @@
+export function createManagedIdentityClients(createClient) {
+    const actor = (env, accessToken) => createClient(env.url, env.anonKey, {
+        auth: { persistSession: false, autoRefreshToken: false },
+        global: { headers: accessToken ? { Authorization: `Bearer ${accessToken}` } : {} },
+    });
+    const service = (env) => createClient(env.url, env.serviceRoleKey, {
+        auth: { persistSession: false, autoRefreshToken: false },
+    });
+    return { actor, service };
+}

package/dist/identity/managedClientAuthLink.d.ts

@@ -0,0 +1,3 @@
+import type { EmailTrustPolicy } from "./emailTrustPolicy.js";
+import type { ClientAuthLinkStore } from "./ports.js";
+export declare function createSupabaseClientAuthLinkStore(rawClient: unknown, emailTrustPolicy: EmailTrustPolicy): ClientAuthLinkStore;

package/dist/identity/managedClientAuthLink.js

@@ -0,0 +1,115 @@
+export function createSupabaseClientAuthLinkStore(rawClient, emailTrustPolicy) {
+    const client = rawClient;
+    return {
+        emailTrustPolicy,
+        async findClientByEmail(email) {
+            const rows = await findManagedContactsByEmail(client, email, true);
+            const row = rows[0];
+            if (!row)
+                return null;
+            return { id: row.id, authUserId: row.auth_user_id ?? null };
+        },
+        async findAuthUserIdByEmail(email) {
+            const perPage = 1000;
+            const maxUsers = 5000;
+            let page = 1;
+            let scanned = 0;
+            while (scanned < maxUsers) {
+                const { data, error } = await client.auth.admin.listUsers({ page, perPage });
+                if (error)
+                    throw error;
+                const users = data.users;
+                const match = users.find((u) => (u.email ?? "").trim().toLowerCase() === email);
+                if (match)
+                    return match.id;
+                scanned += users.length;
+                const nextPage = "nextPage" in data ? data.nextPage : null;
+                if (!nextPage)
+                    return null;
+                page = nextPage;
+            }
+            throw new Error("auth_user_lookup_cap_exceeded");
+        },
+        async findAuthUserEmailById(authUserId) {
+            const { data, error } = await client.auth.admin.getUserById(authUserId);
+            if (error)
+                throw error;
+            return data.user?.email ?? null;
+        },
+        async createAuthUser(email) {
+            const { data, error } = await client.auth.admin.createUser({
+                email,
+                email_confirm: false,
+            });
+            if (error && isAlreadyRegistered(error))
+                return null;
+            if (error)
+                throw error;
+            if (!data.user)
+                throw new Error("createUser returned no user");
+            return data.user.id;
+        },
+        async findAdminIdentity(authUserId) {
+            const { data, error } = await client
+                .from("admin_users")
+                .select("id, is_machine_actor")
+                .eq("id", authUserId)
+                .maybeSingle();
+            if (error)
+                throw error;
+            if (!data)
+                return null;
+            return { isMachineActor: data.is_machine_actor !== false };
+        },
+        async setClientAuthUserId(clientId, authUserId) {
+            const { data, error } = await client
+                .from("clients")
+                .update({ auth_user_id: authUserId })
+                .eq("id", clientId)
+                .is("auth_user_id", null)
+                .select("auth_user_id")
+                .maybeSingle();
+            if (error)
+                throw error;
+            if (data?.auth_user_id === authUserId) {
+                return { ok: true, alreadyLinked: false };
+            }
+            const { data: current, error: currentError } = await client
+                .from("clients")
+                .select("auth_user_id")
+                .eq("id", clientId)
+                .maybeSingle();
+            if (currentError)
+                throw currentError;
+            if (current?.auth_user_id === authUserId) {
+                return { ok: true, alreadyLinked: true };
+            }
+            return {
+                ok: false,
+                code: "CLIENT_AUTH_LINK_CONFLICT",
+                existingAuthUserId: current?.auth_user_id ?? null,
+            };
+        },
+    };
+}
+function isAlreadyRegistered(error) {
+    const failure = (error ?? {});
+    if (failure.code === "email_exists" || failure.code === "user_already_exists")
+        return true;
+    return failure.status === 422 && typeof failure.message === "string"
+        && /already (been )?registered/i.test(failure.message);
+}
+async function findManagedContactsByEmail(client, email, oldestFirst) {
+    const normalized = email.trim().toLowerCase();
+    // Escaping bounds the database prefilter; Unicode regex folding can still
+    // widen it, so only exact normalized addresses may cross this boundary.
+    let query = client.from("clients")
+        .select("id, email, auth_user_id")
+        .filter("email", "imatch", `^${normalized.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&")}$`);
+    if (oldestFirst)
+        query = query.order("created_at", { ascending: true });
+    const { data, error } = await query.limit(10);
+    if (error)
+        throw error;
+    return (data ?? []).filter((row) => row.email?.trim().toLowerCase() === normalized);
+}

package/dist/identity/managedCustomerMe.d.ts

@@ -0,0 +1,13 @@
+import type { CustomerMeResponse } from "./customerContracts.js";
+import type { CustomerMePort } from "./customerPorts.js";
+type LinkedCustomerRow = {
+    id: string;
+    email: string;
+    first_name: string | null;
+    last_name: string | null;
+    phone: string | null;
+    lifecycle_stage: CustomerMeResponse["lifecycleStage"];
+};
+export declare function readLinkedCustomer(rawClient: unknown, userId: string, includePhone?: boolean): Promise<LinkedCustomerRow | null>;
+export declare function createSupabaseCustomerMePort(rawClient: unknown): CustomerMePort;
+export {};

package/dist/identity/managedCustomerMe.js

@@ -0,0 +1,30 @@
+export async function readLinkedCustomer(rawClient, userId, includePhone = false) {
+    const client = rawClient;
+    const { data, error } = await client
+        .from("clients")
+        .select(includePhone
+        ? "id, email, first_name, last_name, phone, lifecycle_stage"
+        : "id, email, first_name, last_name, lifecycle_stage")
+        .eq("auth_user_id", userId)
+        .maybeSingle();
+    if (error)
+        throw error;
+    return data;
+}
+export function createSupabaseCustomerMePort(rawClient) {
+    const client = rawClient;
+    return {
+        async getCustomerMe(userId) {
+            const data = await readLinkedCustomer(client, userId);
+            if (!data)
+                return null;
+            return {
+                clientId: data.id,
+                email: data.email,
+                firstName: data.first_name,
+                lastName: data.last_name,
+                lifecycleStage: data.lifecycle_stage,
+            };
+        },
+    };
+}

package/dist/identity/managedEmailTrustPolicy.d.ts

@@ -0,0 +1,11 @@
+import type { EmailTrustPolicy } from "./emailTrustPolicy.js";
+/** Server-side assertion by the adopter, never a provider certification. */
+export declare function parseEmailVerifyingProviders(value: string): readonly string[];
+/** One immutable origin/key/allowlist binding; import and construction perform no I/O. */
+export declare function createManagedEmailTrustPolicy(options: {
+    authBaseUrl: string;
+    publicKey: string;
+    emailVerifyingProviders?: readonly string[];
+    fetch?: typeof globalThis.fetch;
+    now?: () => number;
+}): EmailTrustPolicy;

package/dist/identity/managedEmailTrustPolicy.js

@@ -0,0 +1,105 @@
+const unavailable = { trusted: false, code: "EMAIL_TRUST_SETTINGS_UNAVAILABLE" };
+const refused = { trusted: false, code: "EMAIL_TRUST_ENVELOPE_REFUSED" };
+const providerId = /^[a-z][a-z0-9_-]*$/;
+/** Server-side assertion by the adopter, never a provider certification. */
+export function parseEmailVerifyingProviders(value) {
+    if (!value.trim())
+        return [];
+    const entries = value.split(",").map(entry => entry.trim().toLowerCase());
+    if (entries.some(entry => !providerId.test(entry)))
+        throw new Error("Invalid email-verifying provider declaration");
+    return [...new Set(entries)].sort();
+}
+/** One immutable origin/key/allowlist binding; import and construction perform no I/O. */
+export function createManagedEmailTrustPolicy(options) {
+    const origin = new URL(options.authBaseUrl);
+    if (!["http:", "https:"].includes(origin.protocol) || origin.username || origin.password
+        || origin.pathname !== "/" || origin.search || origin.hash || !options.publicKey.trim()) {
+        throw new Error("Invalid identity email-trust configuration");
+    }
+    const url = new URL("/auth/v1/settings", origin);
+    const publicKey = options.publicKey;
+    const allowed = new Set(parseEmailVerifyingProviders((options.emailVerifyingProviders ?? []).join(",")));
+    const fetchSettings = options.fetch ?? globalThis.fetch;
+    const now = options.now ?? Date.now;
+    let cached;
+    let inFlight;
+    function decode(value) {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return unavailable;
+        const { mailer_autoconfirm: automatic, external } = value;
+        if (typeof automatic !== "boolean" || !external || typeof external !== "object" || Array.isArray(external))
+            return unavailable;
+        const entries = Object.entries(external);
+        if (entries.some(([key, enabled]) => !providerId.test(key) || typeof enabled !== "boolean"))
+            return unavailable;
+        if (automatic || entries.some(([key, enabled]) => enabled && key !== "email" && !allowed.has(key)))
+            return refused;
+        return { trusted: true };
+    }
+    async function load() {
+        const controller = new AbortController();
+        let timer;
+        const deadline = new Promise((_, reject) => {
+            timer = setTimeout(() => { controller.abort(); reject(new Error("Identity settings deadline")); }, 3000);
+        });
+        async function read() {
+            const response = await fetchSettings(url, {
+                headers: { apikey: publicKey }, redirect: "error", signal: controller.signal,
+            });
+            if (!response.ok || response.redirected || !response.body)
+                return unavailable;
+            const reader = response.body.getReader();
+            let bytes = 0;
+            const chunks = [];
+            try {
+                while (true) {
+                    const chunk = await reader.read();
+                    if (chunk.done)
+                        break;
+                    bytes += chunk.value.byteLength;
+                    if (bytes > 65536) {
+                        controller.abort();
+                        void reader.cancel().catch(() => { });
+                        return unavailable;
+                    }
+                    chunks.push(chunk.value);
+                }
+            }
+            finally {
+                reader.releaseLock();
+            }
+            const body = new Uint8Array(bytes);
+            let offset = 0;
+            for (const chunk of chunks) {
+                body.set(chunk, offset);
+                offset += chunk.byteLength;
+            }
+            return decode(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(body)));
+        }
+        try {
+            return await Promise.race([read(), deadline]);
+        }
+        catch {
+            return unavailable;
+        }
+        finally {
+            controller.abort();
+            clearTimeout(timer);
+        }
+    }
+    return {
+        async assess() {
+            if (cached && now() < cached.expires)
+                return cached.result;
+            if (!inFlight) {
+                inFlight = load().then(result => {
+                    const ttl = !result.trusted && result.code === "EMAIL_TRUST_SETTINGS_UNAVAILABLE" ? 5000 : 60000;
+                    cached = { result, expires: now() + ttl };
+                    return result;
+                }).finally(() => { inFlight = undefined; });
+            }
+            return inFlight;
+        },
+    };
+}

package/dist/identity/managedIdentityVerifier.d.ts

@@ -0,0 +1,2 @@
+import type { IdentityVerifierPort } from "./ports.js";
+export declare function createSupabaseIdentityVerifier(rawClient: unknown): IdentityVerifierPort;

package/dist/identity/managedIdentityVerifier.js

@@ -0,0 +1,16 @@
+export function createSupabaseIdentityVerifier(rawClient) {
+    const client = rawClient;
+    return {
+        async verifyAccessToken(accessToken) {
+            const { data, error } = await client.auth.getUser(accessToken);
+            if (error || !data.user)
+                return null;
+            const user = data.user;
+            return {
+                principalId: user.id,
+                email: user.email ?? null,
+                emailVerified: Boolean(user.email_confirmed_at),
+            };
+        },
+    };
+}

package/dist/identity/managedPrivacy.d.ts

@@ -0,0 +1,4 @@
+import type { ManagedIdentityClient } from "./managedClient.js";
+import { type PrivacyStore } from "./privacyPorts.js";
+/** Reads only committed service projections. No managed write or provider delete is composed. */
+export declare function createManagedPrivacyStore(): PrivacyStore<ManagedIdentityClient>;