@powersync/service-core 0.9.0 → 0.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +12 -0
- package/dist/auth/StaticSupabaseKeyCollector.d.ts +19 -0
- package/dist/auth/StaticSupabaseKeyCollector.js +28 -0
- package/dist/auth/StaticSupabaseKeyCollector.js.map +1 -0
- package/dist/auth/auth-index.d.ts +1 -0
- package/dist/auth/auth-index.js +1 -0
- package/dist/auth/auth-index.js.map +1 -1
- package/dist/entry/commands/compact-action.js +1 -1
- package/dist/util/config/compound-config-collector.js +16 -0
- package/dist/util/config/compound-config-collector.js.map +1 -1
- package/package.json +2 -2
- package/src/auth/StaticSupabaseKeyCollector.ts +31 -0
- package/src/auth/auth-index.ts +1 -0
- package/src/entry/commands/compact-action.ts +1 -1
- package/src/util/config/compound-config-collector.ts +19 -1
- package/tsconfig.tsbuildinfo +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,17 @@
|
|
|
1
1
|
# @powersync/service-core
|
|
2
2
|
|
|
3
|
+
## 0.10.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- 35c267f: Add "supabase_jwt_secret" config option to simplify static Supabase auth.
|
|
8
|
+
|
|
9
|
+
### Patch Changes
|
|
10
|
+
|
|
11
|
+
- 2c18ad2: Fix compact action
|
|
12
|
+
- Updated dependencies [35c267f]
|
|
13
|
+
- @powersync/service-types@0.4.0
|
|
14
|
+
|
|
3
15
|
## 0.9.0
|
|
4
16
|
|
|
5
17
|
### Minor Changes
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
import * as jose from 'jose';
|
|
2
|
+
import { KeySpec } from './KeySpec.js';
|
|
3
|
+
import { KeyCollector, KeyResult } from './KeyCollector.js';
|
|
4
|
+
/**
|
|
5
|
+
* Set of static keys for Supabase.
|
|
6
|
+
*
|
|
7
|
+
* Same as StaticKeyCollector, but with some configuration tweaks for Supabase.
|
|
8
|
+
*
|
|
9
|
+
* Similar to SupabaseKeyCollector, but using hardcoded keys instead of fetching
|
|
10
|
+
* from the database.
|
|
11
|
+
*
|
|
12
|
+
* A key can be added both with and without a kid, in case wildcard matching is desired.
|
|
13
|
+
*/
|
|
14
|
+
export declare class StaticSupabaseKeyCollector implements KeyCollector {
|
|
15
|
+
private keys;
|
|
16
|
+
static importKeys(keys: jose.JWK[]): Promise<StaticSupabaseKeyCollector>;
|
|
17
|
+
constructor(keys: KeySpec[]);
|
|
18
|
+
getKeys(): Promise<KeyResult>;
|
|
19
|
+
}
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
import { KeySpec } from './KeySpec.js';
|
|
2
|
+
const SUPABASE_KEY_OPTIONS = {
|
|
3
|
+
requiresAudience: ['authenticated'],
|
|
4
|
+
maxLifetimeSeconds: 86400 * 7 + 1200 // 1 week + 20 minutes margin
|
|
5
|
+
};
|
|
6
|
+
/**
|
|
7
|
+
* Set of static keys for Supabase.
|
|
8
|
+
*
|
|
9
|
+
* Same as StaticKeyCollector, but with some configuration tweaks for Supabase.
|
|
10
|
+
*
|
|
11
|
+
* Similar to SupabaseKeyCollector, but using hardcoded keys instead of fetching
|
|
12
|
+
* from the database.
|
|
13
|
+
*
|
|
14
|
+
* A key can be added both with and without a kid, in case wildcard matching is desired.
|
|
15
|
+
*/
|
|
16
|
+
export class StaticSupabaseKeyCollector {
|
|
17
|
+
static async importKeys(keys) {
|
|
18
|
+
const parsedKeys = await Promise.all(keys.map((key) => KeySpec.importKey(key, SUPABASE_KEY_OPTIONS)));
|
|
19
|
+
return new StaticSupabaseKeyCollector(parsedKeys);
|
|
20
|
+
}
|
|
21
|
+
constructor(keys) {
|
|
22
|
+
this.keys = keys;
|
|
23
|
+
}
|
|
24
|
+
async getKeys() {
|
|
25
|
+
return { keys: this.keys, errors: [] };
|
|
26
|
+
}
|
|
27
|
+
}
|
|
28
|
+
//# sourceMappingURL=StaticSupabaseKeyCollector.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"StaticSupabaseKeyCollector.js","sourceRoot":"","sources":["../../src/auth/StaticSupabaseKeyCollector.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAc,MAAM,cAAc,CAAC;AAGnD,MAAM,oBAAoB,GAAe;IACvC,gBAAgB,EAAE,CAAC,eAAe,CAAC;IACnC,kBAAkB,EAAE,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,6BAA6B;CACnE,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,OAAO,0BAA0B;IACrC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAgB;QACtC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACtG,OAAO,IAAI,0BAA0B,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC;IAED,YAAoB,IAAe;QAAf,SAAI,GAAJ,IAAI,CAAW;IAAG,CAAC;IAEvC,KAAK,CAAC,OAAO;QACX,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;CACF"}
|
package/dist/auth/auth-index.js
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth-index.js","sourceRoot":"","sources":["../../src/auth/auth-index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC"}
|
|
1
|
+
{"version":3,"file":"auth-index.js","sourceRoot":"","sources":["../../src/auth/auth-index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iCAAiC,CAAC"}
|
|
@@ -73,7 +73,7 @@ export function registerCompactAction(program) {
|
|
|
73
73
|
wrapConfigCommand(compactCommand);
|
|
74
74
|
return compactCommand.description('Compact storage').action(async (options) => {
|
|
75
75
|
const buckets = options.buckets?.split(',');
|
|
76
|
-
if (buckets
|
|
76
|
+
if (buckets == null) {
|
|
77
77
|
logger.info('Compacting storage for all buckets...');
|
|
78
78
|
}
|
|
79
79
|
else {
|
|
@@ -33,6 +33,22 @@ export class CompoundConfigCollector {
|
|
|
33
33
|
const inputKeys = baseConfig.client_auth?.jwks?.keys ?? [];
|
|
34
34
|
const staticCollector = await auth.StaticKeyCollector.importKeys(inputKeys);
|
|
35
35
|
collectors.add(staticCollector);
|
|
36
|
+
if (baseConfig.client_auth?.supabase && baseConfig.client_auth?.supabase_jwt_secret != null) {
|
|
37
|
+
// This replaces the old SupabaseKeyCollector, with a statically-configured key.
|
|
38
|
+
// You can get the same effect with manual HS256 key configuration, but this
|
|
39
|
+
// makes the config simpler.
|
|
40
|
+
// We also a custom audience ("authenticated"), increased max lifetime (1 week),
|
|
41
|
+
// and auto base64-url-encode the key.
|
|
42
|
+
collectors.add(await auth.StaticSupabaseKeyCollector.importKeys([
|
|
43
|
+
{
|
|
44
|
+
kty: 'oct',
|
|
45
|
+
alg: 'HS256',
|
|
46
|
+
// In this case, the key is not base64-encoded yet.
|
|
47
|
+
k: Buffer.from(baseConfig.client_auth.supabase_jwt_secret, 'utf8').toString('base64url'),
|
|
48
|
+
kid: undefined // Wildcard kid - any kid can match
|
|
49
|
+
}
|
|
50
|
+
]));
|
|
51
|
+
}
|
|
36
52
|
let jwks_uris = baseConfig.client_auth?.jwks_uri ?? [];
|
|
37
53
|
if (typeof jwks_uris == 'string') {
|
|
38
54
|
jwks_uris = [jwks_uris];
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"compound-config-collector.js","sourceRoot":"","sources":["../../../src/util/config/compound-config-collector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAE3D,OAAO,KAAK,IAAI,MAAM,0BAA0B,CAAC;AAEjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAC7F,OAAO,EAAE,wBAAwB,EAAE,MAAM,kDAAkD,CAAC;AAC5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACpG,OAAO,EAAE,wBAAwB,EAAE,MAAM,kDAAkD,CAAC;AA4B5F,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAE1C,MAAM,yBAAyB,GAAmC;IAChE,gBAAgB,EAAE,CAAC,IAAI,qBAAqB,EAAE,EAAE,IAAI,yBAAyB,EAAE,EAAE,IAAI,uBAAuB,EAAE,CAAC;IAC/G,mBAAmB,EAAE;QACnB,IAAI,wBAAwB,EAAE;QAC9B,IAAI,4BAA4B,EAAE;QAClC,IAAI,wBAAwB,EAAE;KAC/B;CACF,CAAC;AAEF,MAAM,OAAO,uBAAuB;IAClC,YAAsB,UAA0C,yBAAyB;QAAnE,YAAO,GAAP,OAAO,CAA4D;IAAG,CAAC;IAE7F;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,eAA6B,EAAE;QACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAE9D,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,EAAE,WAAW,IAAI,EAAE,CAAC;QAC9D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAE/C,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;QAC3D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"compound-config-collector.js","sourceRoot":"","sources":["../../../src/util/config/compound-config-collector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAE3D,OAAO,KAAK,IAAI,MAAM,0BAA0B,CAAC;AAEjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAC7F,OAAO,EAAE,wBAAwB,EAAE,MAAM,kDAAkD,CAAC;AAC5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACpG,OAAO,EAAE,wBAAwB,EAAE,MAAM,kDAAkD,CAAC;AA4B5F,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAE1C,MAAM,yBAAyB,GAAmC;IAChE,gBAAgB,EAAE,CAAC,IAAI,qBAAqB,EAAE,EAAE,IAAI,yBAAyB,EAAE,EAAE,IAAI,uBAAuB,EAAE,CAAC;IAC/G,mBAAmB,EAAE;QACnB,IAAI,wBAAwB,EAAE;QAC9B,IAAI,4BAA4B,EAAE;QAClC,IAAI,wBAAwB,EAAE;KAC/B;CACF,CAAC;AAEF,MAAM,OAAO,uBAAuB;IAClC,YAAsB,UAA0C,yBAAyB;QAAnE,YAAO,GAAP,OAAO,CAA4D;IAAG,CAAC;IAE7F;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,eAA6B,EAAE;QACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAE9D,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,EAAE,WAAW,IAAI,EAAE,CAAC;QAC9D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAE/C,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;QAC3D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC5E,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAEhC,IAAI,UAAU,CAAC,WAAW,EAAE,QAAQ,IAAI,UAAU,CAAC,WAAW,EAAE,mBAAmB,IAAI,IAAI,EAAE,CAAC;YAC5F,gFAAgF;YAChF,4EAA4E;YAC5E,4BAA4B;YAC5B,gFAAgF;YAChF,sCAAsC;YACtC,UAAU,CAAC,GAAG,CACZ,MAAM,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC;gBAC/C;oBACE,GAAG,EAAE,KAAK;oBACV,GAAG,EAAE,OAAO;oBACZ,mDAAmD;oBACnD,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;oBACxF,GAAG,EAAE,SAAS,CAAC,mCAAmC;iBACnD;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,GAAG,UAAU,CAAC,WAAW,EAAE,QAAQ,IAAI,EAAE,CAAC;QACvD,IAAI,OAAO,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,SAAS,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;QAED,KAAK,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;YAC1B,UAAU,CAAC,GAAG,CACZ,IAAI,IAAI,CAAC,kBAAkB,CACzB,IAAI,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAClG,CACF,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,iBAAiB,CAAC,CAAC;QAE1G,IAAI,MAAgC,CAAC;QACrC,IAAI,UAAU,CAAC,GAAG,EAAE,SAAS,IAAI,UAAU,IAAI,IAAI,IAAI,UAAU,CAAC,GAAG,IAAI,KAAK,EAAE,CAAC;YAC/E,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAEzE,IAAI,aAAa,GAAa,UAAU,CAAC,WAAW,EAAE,QAAQ,IAAI,EAAE,CAAC;QAErE,IAAI,MAAM,GAA4B;YACpC,WAAW,EAAE,UAAU;YACvB,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,WAAW,IAAI,EAAE;YACtD,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,eAAe,EAAE,QAAQ;YACzB,+DAA+D;YAC/D,mEAAmE;YACnE,mBAAmB,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;YACvD,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE;YACxC,GAAG,EAAE;gBACH,SAAS,EAAE,UAAU,CAAC,GAAG,EAAE,SAAS,IAAI,KAAK;gBAC7C,WAAW,EAAE,UAAU,CAAC,GAAG,EAAE,WAAW,IAAI,KAAK;gBACjD,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,aAAa;gBAC5C,QAAQ,EAAE,UAAU,CAAC,GAAG,EAAE,QAAQ,IAAI,KAAK;gBAC3C,OAAO,EAAE,MAAM;aAChB;YACD,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,IAAI;YAC7B,UAAU;YACV,aAAa;YAEb,oBAAoB,EAAE,IAAI,EAAE,QAAQ;YACpC,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,EAAE;YACnC,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,SAAS,EAAE;gBACT,yBAAyB,EAAE,UAAU,CAAC,SAAS,EAAE,yBAAyB,IAAI,KAAK;gBACnF,yBAAyB,EACvB,UAAU,CAAC,SAAS,EAAE,yBAAyB,IAAI,0CAA0C;aAChG;YACD,0DAA0D;YAC1D,qEAAqE;YACrE,gBAAgB,EAAE,YAAY;YAC9B,UAAU,EAAE,UAAU,CAAC,UAAU,IAAI,EAAE;SACxC,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,iBAAiB,CAAC,aAA2B;QAC3D,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;gBAC1D,IAAI,UAAU,EAAE,CAAC;oBACf,OAAO,UAAU,CAAC;gBACpB,CAAC;gBACD,MAAM,CAAC,KAAK,CACV,2CAA2C,SAAS,CAAC,IAAI,iDAAiD,CAC3G,CAAC;YACJ,CAAC;YAAC,OAAO,EAAE,EAAE,CAAC;gBACZ,yCAAyC;gBACzC,MAAM,IAAI,KAAK,CAAC,kCAAkC,SAAS,CAAC,IAAI,8BAA8B,EAAE,EAAE,CAAC,CAAC;YACtG,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IAC3G,CAAC;IAES,KAAK,CAAC,gBAAgB,CAC9B,UAAsC,EACtC,YAA0B;QAE1B,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;gBACjE,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,MAAM,CAAC,KAAK,CACV,qCAAqC,SAAS,CAAC,IAAI,iDAAiD,CACrG,CAAC;YACJ,CAAC;YAAC,OAAO,EAAE,EAAE,CAAC;gBACZ,yCAAyC;gBACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,CAAC,IAAI,8BAA8B,EAAE,EAAE,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;CACF"}
|
package/package.json
CHANGED
|
@@ -5,7 +5,7 @@
|
|
|
5
5
|
"publishConfig": {
|
|
6
6
|
"access": "public"
|
|
7
7
|
},
|
|
8
|
-
"version": "0.
|
|
8
|
+
"version": "0.10.0",
|
|
9
9
|
"main": "dist/index.js",
|
|
10
10
|
"license": "FSL-1.1-Apache-2.0",
|
|
11
11
|
"type": "module",
|
|
@@ -37,7 +37,7 @@
|
|
|
37
37
|
"@powersync/service-jsonbig": "0.17.10",
|
|
38
38
|
"@powersync/service-rsocket-router": "0.0.14",
|
|
39
39
|
"@powersync/service-sync-rules": "0.21.0",
|
|
40
|
-
"@powersync/service-types": "0.
|
|
40
|
+
"@powersync/service-types": "0.4.0"
|
|
41
41
|
},
|
|
42
42
|
"devDependencies": {
|
|
43
43
|
"@types/async": "^3.2.24",
|
|
@@ -0,0 +1,31 @@
|
|
|
1
|
+
import * as jose from 'jose';
|
|
2
|
+
import { KeySpec, KeyOptions } from './KeySpec.js';
|
|
3
|
+
import { KeyCollector, KeyResult } from './KeyCollector.js';
|
|
4
|
+
|
|
5
|
+
const SUPABASE_KEY_OPTIONS: KeyOptions = {
|
|
6
|
+
requiresAudience: ['authenticated'],
|
|
7
|
+
maxLifetimeSeconds: 86400 * 7 + 1200 // 1 week + 20 minutes margin
|
|
8
|
+
};
|
|
9
|
+
|
|
10
|
+
/**
|
|
11
|
+
* Set of static keys for Supabase.
|
|
12
|
+
*
|
|
13
|
+
* Same as StaticKeyCollector, but with some configuration tweaks for Supabase.
|
|
14
|
+
*
|
|
15
|
+
* Similar to SupabaseKeyCollector, but using hardcoded keys instead of fetching
|
|
16
|
+
* from the database.
|
|
17
|
+
*
|
|
18
|
+
* A key can be added both with and without a kid, in case wildcard matching is desired.
|
|
19
|
+
*/
|
|
20
|
+
export class StaticSupabaseKeyCollector implements KeyCollector {
|
|
21
|
+
static async importKeys(keys: jose.JWK[]) {
|
|
22
|
+
const parsedKeys = await Promise.all(keys.map((key) => KeySpec.importKey(key, SUPABASE_KEY_OPTIONS)));
|
|
23
|
+
return new StaticSupabaseKeyCollector(parsedKeys);
|
|
24
|
+
}
|
|
25
|
+
|
|
26
|
+
constructor(private keys: KeySpec[]) {}
|
|
27
|
+
|
|
28
|
+
async getKeys(): Promise<KeyResult> {
|
|
29
|
+
return { keys: this.keys, errors: [] };
|
|
30
|
+
}
|
|
31
|
+
}
|
package/src/auth/auth-index.ts
CHANGED
|
@@ -29,7 +29,7 @@ export function registerCompactAction(program: Command) {
|
|
|
29
29
|
|
|
30
30
|
return compactCommand.description('Compact storage').action(async (options) => {
|
|
31
31
|
const buckets = options.buckets?.split(',');
|
|
32
|
-
if (buckets
|
|
32
|
+
if (buckets == null) {
|
|
33
33
|
logger.info('Compacting storage for all buckets...');
|
|
34
34
|
} else {
|
|
35
35
|
logger.info(`Compacting storage for ${buckets.join(', ')}...`);
|
|
@@ -65,9 +65,27 @@ export class CompoundConfigCollector {
|
|
|
65
65
|
|
|
66
66
|
const inputKeys = baseConfig.client_auth?.jwks?.keys ?? [];
|
|
67
67
|
const staticCollector = await auth.StaticKeyCollector.importKeys(inputKeys);
|
|
68
|
-
|
|
69
68
|
collectors.add(staticCollector);
|
|
70
69
|
|
|
70
|
+
if (baseConfig.client_auth?.supabase && baseConfig.client_auth?.supabase_jwt_secret != null) {
|
|
71
|
+
// This replaces the old SupabaseKeyCollector, with a statically-configured key.
|
|
72
|
+
// You can get the same effect with manual HS256 key configuration, but this
|
|
73
|
+
// makes the config simpler.
|
|
74
|
+
// We also a custom audience ("authenticated"), increased max lifetime (1 week),
|
|
75
|
+
// and auto base64-url-encode the key.
|
|
76
|
+
collectors.add(
|
|
77
|
+
await auth.StaticSupabaseKeyCollector.importKeys([
|
|
78
|
+
{
|
|
79
|
+
kty: 'oct',
|
|
80
|
+
alg: 'HS256',
|
|
81
|
+
// In this case, the key is not base64-encoded yet.
|
|
82
|
+
k: Buffer.from(baseConfig.client_auth.supabase_jwt_secret, 'utf8').toString('base64url'),
|
|
83
|
+
kid: undefined // Wildcard kid - any kid can match
|
|
84
|
+
}
|
|
85
|
+
])
|
|
86
|
+
);
|
|
87
|
+
}
|
|
88
|
+
|
|
71
89
|
let jwks_uris = baseConfig.client_auth?.jwks_uri ?? [];
|
|
72
90
|
if (typeof jwks_uris == 'string') {
|
|
73
91
|
jwks_uris = [jwks_uris];
|