@plutocms/supabase 0.15.0 → 0.15.1

package/server/utils/access-mail.ts

@@ -21,8 +21,13 @@ function inviteFailed() {
 }
 
 /** Finds the id of the account with this email, or null. */
-export async function findUserIdByEmail(client: UserClient, email: string): Promise<string | null> {
-  const { data, error } = await client.rpc('find_user_id_by_email', { p_email: email })
+export async function findUserIdByEmail(
+  client: UserClient,
+  email: string
+): Promise<string | null> {
+  const { data, error } = await client.rpc('find_user_id_by_email', {
+    p_email: email,
+  })
 
   if (error) {
     throw mapAccessError(error)
@@ -32,8 +37,15 @@ export async function findUserIdByEmail(client: UserClient, email: string): Prom
 }
 
 /** Adds roles to a user. It keeps the roles the user has. */
-export async function addRoles(client: UserClient, target: string, roleKeys: string[]): Promise<void> {
-  const { error } = await client.rpc('add_user_roles', { target, role_keys: roleKeys })
+export async function addRoles(
+  client: UserClient,
+  target: string,
+  roleKeys: string[]
+): Promise<void> {
+  const { error } = await client.rpc('add_user_roles', {
+    target,
+    role_keys: roleKeys,
+  })
 
   if (error) {
     throw mapAccessError(error)
@@ -44,7 +56,11 @@ export async function addRoles(client: UserClient, target: string, roleKeys: str
  * The URL that the user opens to accept an invite. The accept-invite page
  * reads `token_hash` and `type`, then calls `verifyOtp`.
  */
-export function acceptInviteUrl(origin: string, hashedToken: string, type: AcceptLinkType): string {
+export function acceptInviteUrl(
+  origin: string,
+  hashedToken: string,
+  type: AcceptLinkType
+): string {
   const url = new URL(INVITE_ACCEPT_PATH, origin)
 
   url.searchParams.set('token_hash', hashedToken)
@@ -62,8 +78,7 @@ interface GenerateLinkParams {
 }
 
 type GeneratedLink =
-  | { kind: 'link', userId: string, link: string }
-  | { kind: 'exists' }
+  { kind: 'link'; userId: string; link: string } | { kind: 'exists' }
 
 /**
  * Makes a one-time link with the service role key. GoTrue sends no email and
@@ -78,17 +93,23 @@ export async function generateAcceptLink(
   params: GenerateLinkParams
 ): Promise<GeneratedLink> {
   const options = { redirectTo: params.redirectTo }
-  const { data, error } = params.type === 'invite'
-    ? await service.auth.admin.generateLink({
-        type: 'invite',
-        email: params.email,
-        options: { ...options, data: params.displayName ? { display_name: params.displayName } : {} },
-      })
-    : await service.auth.admin.generateLink({
-        type: 'magiclink',
-        email: params.email,
-        options,
-      })
+  const { data, error } =
+    params.type === 'invite'
+      ? await service.auth.admin.generateLink({
+          type: 'invite',
+          email: params.email,
+          options: {
+            ...options,
+            data: params.displayName
+              ? { display_name: params.displayName }
+              : {},
+          },
+        })
+      : await service.auth.admin.generateLink({
+          type: 'magiclink',
+          email: params.email,
+          options,
+        })
 
   if (error) {
     if (error.code === 'email_exists' || error.code === 'user_already_exists') {
@@ -118,7 +139,11 @@ export async function generateAcceptLink(
     ? (verification as AcceptLinkType)
     : params.type
 
-  return { kind: 'link', userId, link: acceptInviteUrl(params.origin, hashedToken, type) }
+  return {
+    kind: 'link',
+    userId,
+    link: acceptInviteUrl(params.origin, hashedToken, type),
+  }
 }
 
 interface ProvisionParams {
@@ -160,7 +185,9 @@ export function serviceKeyRequiredError() {
  *   If the roles fail, the new user is deleted.
  * - The account appears after the lookup (a race): the roles are added.
  */
-export async function provisionAccess(params: ProvisionParams): Promise<ProvisionResult> {
+export async function provisionAccess(
+  params: ProvisionParams
+): Promise<ProvisionResult> {
   const { client, service, email, roleKeys } = params
   const link = (type: 'invite' | 'magiclink') =>
     generateAcceptLink(service, { ...params, type })
@@ -177,7 +204,8 @@ export async function provisionAccess(params: ProvisionParams): Promise<Provisio
     // admin from taking over a customer's or another admin's account. Only an
     // account that never confirmed (a pending invite, or a sign-up with no
     // confirmation) gets a link, because it cannot sign in without one.
-    const { data: found, error: lookupError } = await service.auth.admin.getUserById(userId)
+    const { data: found, error: lookupError } =
+      await service.auth.admin.getUserById(userId)
 
     if (lookupError || !found.user) {
       console.error('invite: getUserById failed for an existing account')
@@ -224,7 +252,9 @@ export async function provisionAccess(params: ProvisionParams): Promise<Provisio
   })
 
   if (setError) {
-    const { error: undoError } = await service.auth.admin.deleteUser(made.userId)
+    const { error: undoError } = await service.auth.admin.deleteUser(
+      made.userId
+    )
 
     if (undoError) {
       console.error('invite: could not delete the new user:', undoError.message)
@@ -266,7 +296,10 @@ export async function inviteSiteName(client: UserClient): Promise<string> {
 }
 
 /** The labels of the roles, in the order of the keys. A key with no label stays as it is. */
-async function roleLabels(client: UserClient, roleKeys: string[]): Promise<string[]> {
+async function roleLabels(
+  client: UserClient,
+  roleKeys: string[]
+): Promise<string[]> {
   try {
     const { data } = await client.rpc('list_roles')
     const labels = new Map((data ?? []).map((role) => [role.key, role.label]))
@@ -292,7 +325,9 @@ interface InviteMailParams {
  * fails. The caller keeps the user and the roles, and gives the link to the
  * admin. The log holds the error code only: no recipient, link or key.
  */
-export async function sendInviteMail(params: InviteMailParams): Promise<boolean> {
+export async function sendInviteMail(
+  params: InviteMailParams
+): Promise<boolean> {
   try {
     const [siteName, roles] = await Promise.all([
       inviteSiteName(params.client),
@@ -314,14 +349,19 @@ export async function sendInviteMail(params: InviteMailParams): Promise<boolean>
   } catch (error) {
     const code = (error as { code?: unknown } | null)?.code
 
-    console.error('invite: the Pluto mail send failed:', typeof code === 'string' ? code : 'unknown')
+    console.error(
+      'invite: the Pluto mail send failed:',
+      typeof code === 'string' ? code : 'unknown'
+    )
 
     return false
   }
 }
 
 /** The name of the admin who invites, for the email. Empty when unknown. */
-export function inviterNameOf(user: { user_metadata?: Record<string, unknown> | null }): string | undefined {
+export function inviterNameOf(user: {
+  user_metadata?: Record<string, unknown> | null
+}): string | undefined {
   const meta = user.user_metadata ?? {}
 
   for (const value of [meta.display_name, meta.full_name, meta.name]) {
@@ -337,12 +377,16 @@ export function inviterNameOf(user: { user_metadata?: Record<string, unknown> |
  * Checks the optional email language against the admin languages. Throws a
  * 400 for a language the admin does not have.
  */
-export function assertInviteLocale(event: H3Event, locale: string | undefined): void {
+export function assertInviteLocale(
+  event: H3Event,
+  locale: string | undefined
+): void {
   if (locale === undefined) {
     return
   }
 
-  const adminLocales = useRuntimeConfig(event).public.plutoI18n?.adminLocales ?? []
+  const adminLocales =
+    useRuntimeConfig(event).public.plutoI18n?.adminLocales ?? []
 
   if (!adminLocales.includes(locale)) {
     throw createPlutoError({

package/server/utils/capability-guard.ts

@@ -44,7 +44,9 @@ export async function requireCapability(
   }
 
   const client = await serverSupabaseClient<Database>(event)
-  const { data, error } = await client.rpc('has_capability', { cap: capability })
+  const { data, error } = await client.rpc('has_capability', {
+    cap: capability,
+  })
 
   if (error || data !== true) {
     // A custom `message` without a `messageKey` has no translation, so it
@@ -56,7 +58,8 @@ export async function requireCapability(
     throw createPlutoError({
       statusCode: 403,
       message:
-        options?.message ?? `Your account is missing the "${capability}" permission.`,
+        options?.message ??
+        `Your account is missing the "${capability}" permission.`,
       key: options?.messageKey ?? 'supabase.errors.missingPermission',
       params: { capability },
     })

package/server/utils/content-adapter.ts

@@ -40,7 +40,8 @@ async function getClient(event: H3Event): Promise<SupabaseClient> {
 }
 
 /** The anonymous client and the url/key pair it was built from. */
-let anonymousClient: { url: string, key: string, client: SupabaseClient } | undefined
+let anonymousClient:
+  { url: string; key: string; client: SupabaseClient } | undefined
 
 /**
  * A Supabase client with no user session, for public reads of the public
@@ -51,9 +52,16 @@ let anonymousClient: { url: string, key: string, client: SupabaseClient } | unde
  * whole process.
  */
 function getAnonymousClient(event: H3Event): SupabaseClient {
-  const { url, key } = useRuntimeConfig(event).public.supabase as { url: string, key: string }
+  const { url, key } = useRuntimeConfig(event).public.supabase as {
+    url: string
+    key: string
+  }
 
-  if (!anonymousClient || anonymousClient.url !== url || anonymousClient.key !== key) {
+  if (
+    !anonymousClient ||
+    anonymousClient.url !== url ||
+    anonymousClient.key !== key
+  ) {
     anonymousClient = {
       url,
       key,
@@ -98,7 +106,9 @@ export function resolveTimestampColumn(
  * `undefined` when status is disabled entirely (`type.status === false`
  * or unset).
  */
-export function resolveStatusColumn(type: PlutoContentType): string | undefined {
+export function resolveStatusColumn(
+  type: PlutoContentType
+): string | undefined {
   if (!type.status) {
     return undefined
   }
@@ -123,7 +133,9 @@ function resolveSortColumn(type: PlutoContentType, fieldName: string): string {
 function timestampColumns(type: PlutoContentType): string[] {
   const { created, updated, published } = timestampKeys(type)
 
-  return [created, updated, published].filter((column): column is string => column !== undefined)
+  return [created, updated, published].filter(
+    (column): column is string => column !== undefined
+  )
 }
 
 /**
@@ -131,8 +143,12 @@ function timestampColumns(type: PlutoContentType): string[] {
  * because a timestamp is not a declared field. A key is missing when its
  * timestamp is off. Core uses this to sort and to show the public dates.
  */
-function timestampKeys(type: PlutoContentType): { created?: string, updated?: string, published?: string } {
-  const keys: { created?: string, updated?: string, published?: string } = {}
+function timestampKeys(type: PlutoContentType): {
+  created?: string
+  updated?: string
+  published?: string
+} {
+  const keys: { created?: string; updated?: string; published?: string } = {}
 
   const created = resolveTimestampColumn(type, 'created')
   if (created) {
@@ -158,7 +174,10 @@ function timestampKeys(type: PlutoContentType): { created?: string, updated?: st
  * declares, and a timestamp is not a field. A field with the same name as a
  * timestamp column keeps its own value.
  */
-function toItem(type: PlutoContentType, row: Record<string, unknown>): PlutoContentItem {
+function toItem(
+  type: PlutoContentType,
+  row: Record<string, unknown>
+): PlutoContentItem {
   const item = mapColumnsToFields(type, row)
 
   for (const column of timestampColumns(type)) {
@@ -202,7 +221,11 @@ export function toContentError(error: PostgrestError) {
 }
 
 /** Resolves a field's storage column by name, warning and falling back to the raw name when the field is missing. This signals a misconfigured content type. */
-function resolveFieldColumn(type: PlutoContentType, fieldName: string, context: string): string {
+function resolveFieldColumn(
+  type: PlutoContentType,
+  fieldName: string,
+  context: string
+): string {
   const field = type.fields.find((candidate) => candidate.name === fieldName)
 
   if (field) {
@@ -216,7 +239,10 @@ function resolveFieldColumn(type: PlutoContentType, fieldName: string, context:
   return fieldName
 }
 
-async function list(ctx: PlutoContentContext, query: PlutoContentQuery): Promise<PlutoContentListResult> {
+async function list(
+  ctx: PlutoContentContext,
+  query: PlutoContentQuery
+): Promise<PlutoContentListResult> {
   const client = await getClient(ctx.event)
   const pkColumn = ctx.type.primaryKey ?? 'id'
 
@@ -224,7 +250,8 @@ async function list(ctx: PlutoContentContext, query: PlutoContentQuery): Promise
 
   const statusColumn = resolveStatusColumn(ctx.type)
   if (statusColumn && query.includeUnpublished !== true) {
-    const publishedValue = (ctx.type.status && ctx.type.status.publishedValue) || 'published'
+    const publishedValue =
+      (ctx.type.status && ctx.type.status.publishedValue) || 'published'
     builder = builder.eq(statusColumn, publishedValue)
   }
 
@@ -233,14 +260,20 @@ async function list(ctx: PlutoContentContext, query: PlutoContentQuery): Promise
   }
 
   if (query.search) {
-    const titleColumn = resolveFieldColumn(ctx.type, ctx.type.titleField, 'titleField')
+    const titleColumn = resolveFieldColumn(
+      ctx.type,
+      ctx.type.titleField,
+      'titleField'
+    )
     builder = builder.ilike(titleColumn, `%${query.search}%`)
   }
 
   const sort = query.sort ?? ctx.type.defaultSort
   if (sort) {
     const sortColumn = resolveSortColumn(ctx.type, sort.field)
-    builder = builder.order(sortColumn, { ascending: sort.direction !== 'desc' })
+    builder = builder.order(sortColumn, {
+      ascending: sort.direction !== 'desc',
+    })
   } else {
     const createdColumn = resolveTimestampColumn(ctx.type, 'created')
     builder = builder.order(createdColumn ?? pkColumn, { ascending: false })
@@ -260,7 +293,9 @@ async function list(ctx: PlutoContentContext, query: PlutoContentQuery): Promise
   }
 
   return {
-    data: (data ?? []).map((row: Record<string, unknown>) => toItem(ctx.type, row)),
+    data: (data ?? []).map((row: Record<string, unknown>) =>
+      toItem(ctx.type, row)
+    ),
     total: count ?? undefined,
   }
 }
@@ -279,7 +314,10 @@ function isInvalidIdShape(error: PostgrestError): boolean {
   return error.code === '22P02'
 }
 
-async function get(ctx: PlutoContentContext, idOrSlug: string | number): Promise<PlutoContentItem | null> {
+async function get(
+  ctx: PlutoContentContext,
+  idOrSlug: string | number
+): Promise<PlutoContentItem | null> {
   const client = await getClient(ctx.event)
   const pkColumn = ctx.type.primaryKey ?? 'id'
 
@@ -298,7 +336,11 @@ async function get(ctx: PlutoContentContext, idOrSlug: string | number): Promise
   }
 
   if (ctx.type.slug) {
-    const slugColumn = resolveFieldColumn(ctx.type, ctx.type.slug.field, 'slug.field')
+    const slugColumn = resolveFieldColumn(
+      ctx.type,
+      ctx.type.slug.field,
+      'slug.field'
+    )
 
     const bySlug = await client
       .from(ctx.type.source)
@@ -318,7 +360,10 @@ async function get(ctx: PlutoContentContext, idOrSlug: string | number): Promise
   return null
 }
 
-async function create(ctx: PlutoContentContext, values: Record<string, unknown>): Promise<PlutoContentItem> {
+async function create(
+  ctx: PlutoContentContext,
+  values: Record<string, unknown>
+): Promise<PlutoContentItem> {
   const client = await getClient(ctx.event)
   const row = mapFieldsToColumns(ctx.type, values)
 
@@ -387,10 +432,10 @@ async function update(
   // edit route: stamp published-at the first time a row is published, but
   // never overwrite an already-set value on a later edit.
   if (
-    statusColumn
-    && ctx.type.status
-    && ctx.type.status.publishedAtColumn
-    && row[statusColumn] === ctx.type.status.publishedValue
+    statusColumn &&
+    ctx.type.status &&
+    ctx.type.status.publishedAtColumn &&
+    row[statusColumn] === ctx.type.status.publishedValue
   ) {
     const publishedAtColumn = ctx.type.status.publishedAtColumn
     // Selects the whole row rather than the one dynamic column name:
@@ -407,7 +452,10 @@ async function update(
       throw toContentError(fetchError)
     }
 
-    if (existing && (existing as Record<string, unknown>)[publishedAtColumn] == null) {
+    if (
+      existing &&
+      (existing as Record<string, unknown>)[publishedAtColumn] == null
+    ) {
       row[publishedAtColumn] = new Date().toISOString()
     }
   }
@@ -426,7 +474,10 @@ async function update(
   return toItem(ctx.type, data)
 }
 
-async function remove(ctx: PlutoContentContext, id: string | number): Promise<void> {
+async function remove(
+  ctx: PlutoContentContext,
+  id: string | number
+): Promise<void> {
   const client = await getClient(ctx.event)
   const pkColumn = ctx.type.primaryKey ?? 'id'
 
@@ -445,7 +496,7 @@ async function remove(ctx: PlutoContentContext, id: string | number): Promise<vo
  */
 async function countCreated(
   ctx: PlutoContentContext,
-  range: { from: string, to: string }
+  range: { from: string; to: string }
 ): Promise<number | null> {
   const createdColumn = resolveTimestampColumn(ctx.type, 'created')
   if (!createdColumn) {

package/server/utils/service-client.ts

@@ -15,4 +15,6 @@ export function optionalServiceClient(event: H3Event) {
 }
 
 /** The client of `optionalServiceClient`, when the key is set. */
-export type ServiceClient = NonNullable<ReturnType<typeof optionalServiceClient>>
+export type ServiceClient = NonNullable<
+  ReturnType<typeof optionalServiceClient>
+>

package/server/utils/sign-in-link.ts

@@ -40,7 +40,9 @@ export async function sendSignInLink(
     options: {
       shouldCreateUser: options.createUser,
       emailRedirectTo: options.redirectTo,
-      data: options.displayName ? { display_name: options.displayName } : undefined,
+      data: options.displayName
+        ? { display_name: options.displayName }
+        : undefined,
     },
   })
 
@@ -52,14 +54,17 @@ export async function sendSignInLink(
  * SMTP, Supabase sends auth emails only to members of the project's
  * organization.
  */
-export function isEmailNotAuthorizedError(error: { code?: string } | null | undefined): boolean {
+export function isEmailNotAuthorizedError(
+  error: { code?: string } | null | undefined
+): boolean {
   return error?.code === 'email_address_not_authorized'
 }
 
 export function emailNotAuthorizedError() {
   return createPlutoError({
     statusCode: 400,
-    message: 'Supabase\'s built-in email sends only to members of your Supabase organization. Set up custom SMTP in Supabase to invite other addresses.',
+    message:
+      "Supabase's built-in email sends only to members of your Supabase organization. Set up custom SMTP in Supabase to invite other addresses.",
     key: 'supabase.access.errors.emailNotAuthorized',
   })
 }
@@ -69,14 +74,17 @@ export function emailNotAuthorizedError() {
  * 60 seconds, and a few per hour for the project with the built-in mailer.
  * This is not the in-memory limit of `rate-limit.ts`.
  */
-export function isEmailRateLimitError(error: { code?: string, status?: number } | null | undefined): boolean {
+export function isEmailRateLimitError(
+  error: { code?: string; status?: number } | null | undefined
+): boolean {
   return error?.status === 429 || error?.code === 'over_email_send_rate_limit'
 }
 
 export function emailRateLimitError() {
   return createPlutoError({
     statusCode: 429,
-    message: 'Supabase sent too many emails. Wait a minute for the same address, or up to an hour with the built-in mailer. Custom SMTP in Supabase raises this limit.',
+    message:
+      'Supabase sent too many emails. Wait a minute for the same address, or up to an hour with the built-in mailer. Custom SMTP in Supabase raises this limit.',
     key: 'supabase.access.errors.emailRateLimited',
   })
 }
@@ -85,20 +93,27 @@ export function emailRateLimitError() {
  * True when Supabase refuses the address itself, for example an example or
  * test domain (`example.com`), or an address it cannot deliver to.
  */
-export function isEmailInvalidError(error: { code?: string } | null | undefined): boolean {
+export function isEmailInvalidError(
+  error: { code?: string } | null | undefined
+): boolean {
   return error?.code === 'email_address_invalid'
 }
 
 export function emailInvalidError() {
   return createPlutoError({
     statusCode: 400,
-    message: 'Supabase does not accept this email address. Use a real address: Supabase refuses example and test domains.',
+    message:
+      'Supabase does not accept this email address. Use a real address: Supabase refuses example and test domains.',
     key: 'supabase.access.errors.emailInvalid',
   })
 }
 
 /** Maps a GoTrue error of `signInWithOtp` to a Pluto error. */
-export function signInLinkError(error: { code?: string, status?: number, message: string }) {
+export function signInLinkError(error: {
+  code?: string
+  status?: number
+  message: string
+}) {
   if (isEmailNotAuthorizedError(error)) {
     return emailNotAuthorizedError()
   }
@@ -114,7 +129,8 @@ export function signInLinkError(error: { code?: string, status?: number, message
   if (error.code === 'signup_disabled' || error.code === 'otp_disabled') {
     return createPlutoError({
       statusCode: 503,
-      message: 'Public sign-up is off. Set NUXT_SUPABASE_SECRET_KEY on the server to send invites.',
+      message:
+        'Public sign-up is off. Set NUXT_SUPABASE_SECRET_KEY on the server to send invites.',
       key: 'supabase.access.errors.signupDisabled',
     })
   }

package/server/utils/typegen.ts

@@ -15,9 +15,10 @@ const execFileAsync = promisify(execFile)
  */
 function resolveSupabaseBin(rootDir: string): string {
   // On Windows, npm installs `supabase.cmd` and Bun installs `supabase.exe`.
-  const binNames = process.platform === 'win32'
-    ? ['supabase.cmd', 'supabase.exe']
-    : ['supabase']
+  const binNames =
+    process.platform === 'win32'
+      ? ['supabase.cmd', 'supabase.exe']
+      : ['supabase']
   const localBin = binNames
     .map((name) => join(rootDir, 'node_modules/.bin', name))
     .find((path) => existsSync(path))
@@ -25,7 +26,8 @@ function resolveSupabaseBin(rootDir: string): string {
 }
 
 // The block, with its leading comment lines. The block has no nested braces.
-const INTERNAL_BLOCK = /(?:^[ \t]*\/\/[^\n]*\n)*^[ \t]*__InternalSupabase:\s*\{[^{}]*\}[ \t]*\n/m
+const INTERNAL_BLOCK =
+  /(?:^[ \t]*\/\/[^\n]*\n)*^[ \t]*__InternalSupabase:\s*\{[^{}]*\}[ \t]*\n/m
 // The block itself. The name alone is not enough: the output also has it in
 // `Omit<Database, '__InternalSupabase'>`.
 const HAS_BLOCK = /^[ \t]*__InternalSupabase:\s*\{/m

package/server/utils/validate.ts

@@ -27,7 +27,10 @@ export interface ValidationError {
  * A nested field path (for example `address.zip`) is joined with `.` to
  * build `field`.
  */
-export async function parseBody<T>(event: H3Event, schema: ZodSchema<T>): Promise<T> {
+export async function parseBody<T>(
+  event: H3Event,
+  schema: ZodSchema<T>
+): Promise<T> {
   const body = await readBody(event)
   const result = schema.safeParse(body)