@plutocms/supabase 0.10.0 → 0.11.1

package/app/utils/auth-driver.ts

@@ -0,0 +1,110 @@
+// Pure helpers of the supabase auth driver. This file does not use Nuxt
+// auto-imports, so plain Vitest can import it. The `PlutoAuth*` types are
+// global types of the pluto layer.
+/**
+ * The fields of a Supabase user that the driver reads. It fits the JWT claims
+ * (`sub`, `email`, `user_metadata`) and a `User` object (`id`).
+ */
+export interface SupabaseIdentity {
+  sub?: string
+  id?: string
+  email?: string | null
+  user_metadata?: Record<string, unknown> | null
+}
+
+function text(value: unknown): string | undefined {
+  return typeof value === 'string' && value.trim() !== ''
+    ? value.trim()
+    : undefined
+}
+
+/**
+ * Maps a Supabase user to the user of the admin shell. The name follows the
+ * order of the old navbar: display_name, full_name, name. In the JWT claims,
+ * the user id is `sub`. Returns null when there is no id.
+ */
+export function mapSupabaseUser(
+  source: SupabaseIdentity | null | undefined
+): PlutoAuthUser | null {
+  const id = text(source?.sub) ?? text(source?.id)
+
+  if (!source || !id) {
+    return null
+  }
+
+  const meta = source.user_metadata ?? {}
+
+  return {
+    id,
+    name: text(meta.display_name) ?? text(meta.full_name) ?? text(meta.name),
+    username: text(meta.username),
+    email: text(source.email),
+    avatarUrl: text(meta.avatar_url) ?? text(meta.picture),
+  }
+}
+
+/**
+ * The admin paths that a signed-out visitor may open, with what happens to a
+ * signed-in user. `/admin/login` is always public in core.
+ *
+ * - `signup` and `forgot-password` send a signed-in user to the admin home.
+ * - `confirm` and `update-password` stay open: a recovery or confirm link
+ *   signs the user in, and the page must still show.
+ * - `setup` stays open for the auth guard. The setup guard
+ *   (`guard` in `pluto-extension.ts`) blocks it when the setup is done.
+ */
+export const SUPABASE_PUBLIC_PATHS: PlutoAuthPublicPath[] = [
+  { path: '/admin/signup', signedIn: 'redirect' },
+  { path: '/admin/forgot-password', signedIn: 'redirect' },
+  { path: '/admin/confirm', signedIn: 'allow' },
+  { path: '/admin/update-password', signedIn: 'allow' },
+  { path: '/admin/setup', signedIn: 'allow' },
+]
+
+/** The page that opens after a sign-in with no (safe) redirect. */
+export const SUPABASE_SIGN_IN_FALLBACK = '/admin/home'
+
+/** The setup state that the setup guard reads from `/api/settings/first_setup`. */
+export type SetupState = 'pending' | 'done' | 'unknown'
+
+/**
+ * Reads the answer of `/api/settings/first_setup`. A failed call, or a
+ * response with no `is_first_setup` flag, is `unknown`.
+ */
+export function setupStateFromResponse(data: unknown): SetupState {
+  const response = data as
+    | { success?: boolean, is_first_setup?: boolean }
+    | null
+    | undefined
+
+  if (!response?.success) {
+    return 'unknown'
+  }
+
+  return response.is_first_setup ? 'pending' : 'done'
+}
+
+/**
+ * Decides the setup redirect for an admin path. It gives a path to open, or
+ * undefined to go on.
+ *
+ * - `pending` and `unknown` (the state cannot be read): only the setup page
+ *   is open. Every other admin path goes to `/admin/setup`.
+ * - `done`: the setup page is closed, and goes to the sign-in page.
+ *
+ * Keep the `done` redirect, even after layer migrations move to
+ * /admin/migrations. The setup page prompts an unauthenticated visitor for a
+ * raw database connection string, and it is safe only because it is
+ * unreachable once setup is done. Reopening it for a routine layer addition
+ * would let an anonymous visitor submit a connection string to the server.
+ */
+export function setupRedirect(
+  path: string,
+  state: SetupState
+): string | undefined {
+  if (state === 'done') {
+    return path === '/admin/setup' ? '/admin/login' : undefined
+  }
+
+  return path === '/admin/setup' ? undefined : '/admin/setup'
+}

package/i18n/locales/en.json

@@ -28,12 +28,9 @@
       },
       "toasts": {
         "loginFailed": "Could not log in",
-        "loggedOut": "Logged out successfully",
         "resetFailed": "Could not send reset email",
         "updateFailed": "Could not update password",
-        "passwordUpdated": "Password updated successfully",
-        "notLoggedIn": "You are not logged in",
-        "notLoggedInDescription": "Please log in to continue."
+        "passwordUpdated": "Password updated successfully"
       },
       "errors": {
         "unknown": "An unknown error occurred.",
@@ -65,10 +62,7 @@
       },
       "login": {
         "title": "Login",
-        "submit": "Login",
-        "createAccount": "Create Account",
-        "backToHome": "Back to Home",
-        "forgotPassword": "Forgot password?"
+        "submit": "Login"
       },
       "update": {
         "title": "Update Password",
@@ -95,16 +89,6 @@
         "checkSpam": "If you don't see the email, please check your spam folder."
       }
     },
-    "navbar": {
-      "defaultUserName": "User",
-      "github": "Pluto on GitHub",
-      "logout": "Logout",
-      "openNavigation": "Open navigation",
-      "goHome": "Go to dashboard home",
-      "visitSite": "Visit {domain}",
-      "viewSite": "View site",
-      "openUserMenu": "Open user menu"
-    },
     "settings": {
       "general": {
         "title": "General",

package/i18n/locales/pt-BR.json

@@ -28,12 +28,9 @@
       },
       "toasts": {
         "loginFailed": "Não foi possível entrar",
-        "loggedOut": "Sessão encerrada com sucesso",
         "resetFailed": "Não foi possível enviar o e-mail de redefinição",
         "updateFailed": "Não foi possível atualizar a senha",
-        "passwordUpdated": "Senha atualizada com sucesso",
-        "notLoggedIn": "Você não está conectado",
-        "notLoggedInDescription": "Entre na sua conta para continuar."
+        "passwordUpdated": "Senha atualizada com sucesso"
       },
       "errors": {
         "unknown": "Ocorreu um erro desconhecido.",
@@ -65,10 +62,7 @@
       },
       "login": {
         "title": "Entrar",
-        "submit": "Entrar",
-        "createAccount": "Criar conta",
-        "backToHome": "Voltar para o início",
-        "forgotPassword": "Esqueceu a senha?"
+        "submit": "Entrar"
       },
       "update": {
         "title": "Atualizar senha",
@@ -95,16 +89,6 @@
         "checkSpam": "Se você não encontrar o e-mail, verifique sua pasta de spam."
       }
     },
-    "navbar": {
-      "defaultUserName": "Usuário",
-      "github": "Pluto no GitHub",
-      "logout": "Sair",
-      "openNavigation": "Abrir navegação",
-      "goHome": "Ir para o início do painel",
-      "visitSite": "Visitar {domain}",
-      "viewSite": "Ver site",
-      "openUserMenu": "Abrir menu do usuário"
-    },
     "settings": {
       "general": {
         "title": "Geral",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@plutocms/supabase",
   "type": "module",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "trustedDependencies": [
     "@parcel/watcher",
     "@plutocms/pluto",
@@ -39,7 +39,7 @@
     "@nuxt/eslint": "^1.17.0",
     "@nuxt/ui": "^4.12.0",
     "@nuxtjs/supabase": "^2.1.0",
-    "@plutocms/pluto": "^0.14.0",
+    "@plutocms/pluto": "^0.17.0",
     "@plutocms/utils": "^0.2.1",
     "postgres": "^3.4.9",
     "supabase": "^2.121.0",

package/server/utils/typegen.ts

@@ -1,6 +1,8 @@
 import { execFile } from 'node:child_process'
 import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
 import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
 import { promisify } from 'node:util'
 
 const execFileAsync = promisify(execFile)
@@ -17,6 +19,63 @@ function resolveSupabaseBin(rootDir: string): string {
   return existsSync(localBin) ? localBin : 'supabase'
 }
 
+// The block, with its leading comment lines. The block has no nested braces.
+const INTERNAL_BLOCK = /(?:^[ \t]*\/\/[^\n]*\n)*^[ \t]*__InternalSupabase:\s*\{[^{}]*\}[ \t]*\n/m
+const DATABASE_OPEN = /^export type Database = \{[ \t]*\n/m
+
+/**
+ * Keeps the `__InternalSupabase` block of the existing types file.
+ *
+ * The `--db-url` mode of the Supabase CLI does not write this block. It
+ * holds the PostgREST version that supabase-js reads for its typings. When
+ * the new output has no block and the existing file has one, this function
+ * copies the existing block into the new output. In every other case it
+ * returns the new output as it is.
+ */
+export function keepInternalSupabase(
+  next: string,
+  existing: string | null
+): string {
+  if (!existing || next.includes('__InternalSupabase')) {
+    return next
+  }
+
+  const block = existing.match(INTERNAL_BLOCK)?.[0]
+  const open = next.match(DATABASE_OPEN)
+
+  if (!block || !open || open.index === undefined) {
+    return next
+  }
+
+  const at = open.index + open[0].length
+
+  return next.slice(0, at) + block + next.slice(at)
+}
+
+/**
+ * Formats the text with the Prettier of the app. It resolves Prettier from
+ * `rootDir`. It returns the text unchanged when the app has no Prettier or
+ * when the format fails.
+ */
+async function formatWithAppPrettier(
+  rootDir: string,
+  filePath: string,
+  text: string
+): Promise<string> {
+  try {
+    const entry = createRequire(join(rootDir, 'package.json')).resolve(
+      'prettier'
+    )
+    const prettier = await import(pathToFileURL(entry).href)
+    const api = prettier.default ?? prettier
+    const options = (await api.resolveConfig(filePath)) ?? {}
+
+    return await api.format(text, { ...options, filepath: filePath })
+  } catch {
+    return text
+  }
+}
+
 /**
  * Regenerates the Supabase `Database` types from the live database schema
  * and writes them to <rootDir>/shared/types/supabase.ts, only touching the
@@ -56,11 +115,17 @@ export async function regenerateSupabaseTypes(
       ? readFileSync(targetPath, 'utf-8')
       : null
 
-    if (existing === stdout) {
+    const processed = await formatWithAppPrettier(
+      rootDir,
+      targetPath,
+      keepInternalSupabase(stdout, existing)
+    )
+
+    if (existing === processed) {
       return
     }
 
-    writeFileSync(targetPath, stdout, 'utf-8')
+    writeFileSync(targetPath, processed, 'utf-8')
     console.warn(`[typegen] Regenerated Supabase types at ${targetPath}`)
   } catch (error) {
     console.warn('[typegen] Failed to regenerate Supabase types:', error)

package/app/components/navbar/NavbarAdmin.vue

@@ -1,219 +0,0 @@
-<script setup lang="ts">
-import { UDropdownMenu } from '#components'
-import { domainFromUrl } from '#imports'
-
-const host = useRequestURL().host
-
-const route = useRoute()
-const isSidebarOpen = useState<boolean>('pluto-admin-sidebar-open', () => false)
-
-function openSidebar() {
-  isSidebarOpen.value = true
-}
-
-const { t } = usePlutoI18n()
-
-const { isLoggedIn, user, logout } = await useAuth()
-
-const displayName = computed(() => {
-  return (
-    user.value?.display_name ||
-    user.value?.full_name ||
-    user.value?.name ||
-    user.value?.username ||
-    t('supabase.navbar.defaultUserName')
-  )
-})
-
-const shortDisplayName = computed(() => displayName.value.split(' ')[0])
-
-const userMenuLabel = computed(() => {
-  return user.value?.username
-    ? `${displayName.value} (${user.value.username})`
-    : displayName.value
-})
-
-const has_settings_modified = useState<boolean>('has_settings_modified')
-
-const { data: settingsData, status } = await useFetch('/api/settings', {
-  watch: [has_settings_modified],
-})
-
-const maybeDevUrl = computed(() => {
-  if (import.meta.dev) {
-    return `http://${host}`
-  }
-
-  return settingsData.value?.settings.website_url || ''
-})
-
-type DropdownItems = NonNullable<
-  Parameters<typeof UDropdownMenu>[0]['items']
->
-
-const items = computed<DropdownItems>(() => [
-  [
-    {
-      label: userMenuLabel.value,
-      avatar: {
-        icon: 'lucide:user',
-        class: 'bg-primary',
-        ui: {
-          icon: 'text-inverted text-sm',
-        },
-      },
-      type: 'label',
-    },
-  ],
-
-  [
-    {
-      label: t('pluto.common.settings'),
-      icon: 'i-lucide-cog',
-      type: 'link',
-      to: '/admin/settings',
-      kbds: ['meta', ','],
-      onSelect() {
-        if (isLoggedIn.value) {
-          navigateTo('/admin/settings')
-        }
-      },
-    },
-  ],
-
-  [
-    {
-      label: t('supabase.navbar.github'),
-      icon: 'i-simple-icons-github',
-      type: 'link',
-      to: 'https://github.com/ojvribeiro/pluto',
-      target: '_blank',
-      external: true,
-    },
-  ],
-
-  [
-    {
-      label: t('supabase.navbar.logout'),
-      icon: 'i-lucide-log-out',
-      kbds: ['meta', 'shift', 'q'],
-      class: 'cursor-pointer',
-      onSelect() {
-        logout({ showToast: true })
-      },
-    },
-  ],
-])
-
-defineShortcuts(extractShortcuts(items.value))
-</script>
-
-<template>
-  <PlutoNavbarAdmin>
-    <div
-      class="flex h-full min-w-0 items-stretch justify-between gap-1 px-2 lg:px-4"
-    >
-      <div class="flex min-w-0 items-center gap-x-1 lg:gap-x-3">
-        <UButton
-          :aria-label="t('supabase.navbar.openNavigation')"
-          class="lg:hidden"
-          icon="lucide:menu"
-          color="neutral"
-          variant="ghost"
-          square
-          @click="openSidebar"
-        />
-
-        <div class="h-full shrink-0 py-1">
-          <NuxtLink
-            :title="t('supabase.navbar.goHome')"
-            to="/admin/home"
-            class="group block h-full"
-          >
-            <img
-              src="/img/pluto.png"
-              class="block h-full grayscale-100 group-hover:grayscale-0"
-            />
-          </NuxtLink>
-        </div>
-
-        <div class="min-w-0 h-full overflow-hidden">
-          <ul class="flex h-full min-w-0 items-center text-sm">
-            <NavbarAdminActionButton
-              :show="route.path.startsWith('/admin')"
-              :title="
-                t('supabase.navbar.visitSite', {
-                  domain: domainFromUrl(maybeDevUrl),
-                })
-              "
-              :icon="
-                status === 'pending'
-                  ? 'lucide:loader-circle'
-                  : 'lucide:external-link'
-              "
-              :disabled="status === 'pending'"
-              :to="maybeDevUrl"
-              :label="t('supabase.navbar.viewSite')"
-              target="_blank"
-            />
-
-            <ClientOnly>
-              <template #fallback>
-                <li class="h-full">
-                  <div
-                    class="text-dimmed flex h-full items-center gap-x-2 rounded-sm px-2"
-                  >
-                    <Icon name="svg-spinners:ring-resize" />
-                  </div>
-                </li>
-              </template>
-
-              <PlutoNavbarAdminActions />
-            </ClientOnly>
-          </ul>
-        </div>
-      </div>
-
-      <div class="flex shrink-0 items-center gap-1 lg:gap-3">
-        <ColorModeButton />
-
-        <div class="h-full">
-          <UDropdownMenu
-            :items="items"
-            :ui="{
-              content: 'w-64',
-            }"
-            :modal="false"
-          >
-            <button
-              :aria-label="t('supabase.navbar.openUserMenu')"
-              class="group h-full py-1"
-              type="button"
-            >
-              <div
-                class="flex h-full items-center gap-x-2 rounded-sm rounded-l-xl pr-2 pl-0.5 group-hover:bg-elevated"
-              >
-                <UAvatar
-                  :ui="{
-                    root: 'rounded-xl',
-                    icon: 'text-inverted text-lg',
-                  }"
-                  :alt="displayName"
-                  size="sm"
-                  icon="lucide:user"
-                  class="bg-primary"
-                />
-
-                <span
-                  class="text-highlighted hidden text-sm font-semibold lg:inline"
-                >
-                  {{ shortDisplayName }}
-                </span>
-              </div>
-            </button>
-          </UDropdownMenu>
-        </div>
-      </div>
-    </div>
-  </PlutoNavbarAdmin>
-</template>

package/app/components/navbar/NavbarAdminProvider.vue

@@ -1,18 +0,0 @@
-<script setup lang="ts">
-const route = useRoute()
-const session = useSupabaseSession()
-
-const shouldShowNavbar = computed(() => {
-  if (allowedUnauthenticatedPaths.includes(route.path)) {
-    return false
-  }
-
-  return route.path === '/admin'
-    || route.path.startsWith('/admin/')
-    || Boolean(session.value)
-})
-</script>
-
-<template>
-  <NavbarAdmin v-if="shouldShowNavbar" />
-</template>

package/app/middleware/auth.ts

@@ -1,34 +0,0 @@
-import type { RouteLocationNormalizedGeneric } from 'vue-router'
-
-export default defineNuxtRouteMiddleware(async (to, from) => {
-  const { isLoggedIn, logout, allowedUnauthenticatedPaths } = await useAuth({
-    route: to as RouteLocationNormalizedGeneric,
-  })
-
-  if (
-    isLoggedIn.value &&
-    allowedUnauthenticatedPaths.includes(to.path) &&
-    to.path !== '/admin/update-password'
-  ) {
-    return navigateTo(
-      to.query.redirect
-        ? decodeURIComponent(to.query.redirect as string)
-        : '/admin/home'
-    )
-  }
-
-  if (
-    !isLoggedIn.value &&
-    to.path.startsWith('/admin') &&
-    !allowedUnauthenticatedPaths.includes(to.path)
-  ) {
-    if (from.query.redirect) {
-      return logout({
-        redirectTo: from.query.redirect as string,
-        showToast: true,
-      })
-    } else {
-      return logout()
-    }
-  }
-})

package/app/middleware/setup-check.ts

@@ -1,44 +0,0 @@
-export default defineNuxtRouteMiddleware(async (to, _from) => {
-  if (!to.path.startsWith('/admin')) {
-    return
-  }
-
-  try {
-    const data = await $fetch('/api/settings/first_setup')
-
-    if (!data.success) {
-      // Cannot determine setup state — send to setup page
-      if (to.path !== '/admin/setup') {
-        return navigateTo('/admin/setup')
-      }
-      return
-    }
-
-    if (data.is_first_setup) {
-      // Setup not done yet — only allow the setup page
-      if (to.path !== '/admin/setup') {
-        return navigateTo('/admin/setup')
-      }
-    } else {
-      // Setup already done — block access to setup page.
-      //
-      // Keep this redirect even after layer migrations move to
-      // /admin/migrations. The setup page prompts an unauthenticated
-      // visitor for a raw database connection string, and it is safe only
-      // because it is unreachable once setup is done. Reopening it for a
-      // routine layer addition would let an anonymous visitor submit a
-      // connection string to the server.
-      if (to.path === '/admin/setup') {
-        return navigateTo('/admin/login')
-      }
-    }
-  } catch (error) {
-    if (import.meta.dev) {
-      console.error('Error checking first setup status:', error)
-    }
-
-    if (to.path !== '/admin/setup') {
-      return navigateTo('/admin/setup')
-    }
-  }
-})