@quatrain/auth-supabase 1.1.17 → 1.1.19

package/LICENSE.md

@@ -0,0 +1,15 @@
+# LICENSE UPDATE NOTICE
+
+As of 01/01/2026, Quatrain Core is licensed under the **GNU Affero General Public License v3.0 (AGPL v3)**.
+Previous versions remain under the MIT License.
+
+## Why AGPL?
+
+We believe in open collaboration for the development ecosystem. The AGPL ensures that any modification or deployment of this BaaS stack, including over a network, benefits the entire community.
+
+## Commercial Services & Enterprise Usage
+
+We provide official deployment services, technical training, and certification for Quatrain Core.
+For organizations requiring a non-copyleft license (commercial license) or custom proprietary integrations, please contact the copyright holder: **Quatrain Technologies**.
+
+Copyright © 2024-2026 Quatrain Technologies. All Rights Reserved.

package/README.md

@@ -17,12 +17,73 @@ npm install @quatrain/auth-supabase @supabase/supabase-js
 
 ## Usage
 
+### Setup
+
 ```typescript
 import { Auth } from '@quatrain/auth'
 import { SupabaseAuthAdapter } from '@quatrain/auth-supabase'
 
 const adapter = new SupabaseAuthAdapter({
-   config: { url: '...', anonKey: '...' },
+   config: { supabaseUrl: '...', supabaseKey: '...' },
+})
+Auth.addProvider(adapter, 'default', true)
+```
+
+### Register a New User
+
+```typescript
+import { User } from '@quatrain/backend'
+
+const user = new User({
+   _: {
+      name: 'John Doe',
+      email: 'john@example.com',
+      phone: '+1234567890',
+   },
+})
+
+const supabaseUser = await adapter.register(user, 'password123')
+console.log('User registered:', supabaseUser.id)
+```
+
+### Sign In
+
+```typescript
+const result = await adapter.signup('john@example.com', 'password123')
+if (result) {
+   console.log('Signed in:', result.user)
+   console.log('Session token:', result.session.access_token)
+}
+```
+
+### Sign Out
+
+```typescript
+const success = await adapter.signout()
+console.log('Signed out:', success)
+```
+
+### Update User Profile
+
+```typescript
+await adapter.update(user, {
+   email: 'newemail@example.com',
+   phone: '+0987654321',
+})
+```
+
+### Refresh Token
+
+```typescript
+const newTokens = await adapter.refreshToken(refreshToken)
+console.log('New access token:', newTokens.access_token)
+```
+
+### Set Custom User Claims
+
+```typescript
+await adapter.setCustomUserClaims(userId, {
+   role: 'admin',
+   permissions: ['read', 'write', 'delete'],
 })
-Auth.addAdapter(adapter, 'default', true)
 ```

package/lib/SupabaseAuthAdapter.js

@@ -165,7 +165,6 @@ class SupabaseAuthAdapter extends auth_1.AbstractAuthAdapter {
             const { data, error } = yield this._client.auth.admin.updateUserById(id, {
                 user_metadata: claims,
             });
-            console.log(data, error);
             if (error) {
                 throw new auth_1.AuthenticationError(error);
             }

package/lib/SupabaseAuthAdapter.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/SupabaseAuthAdapter.test.js

@@ -0,0 +1,383 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const SupabaseAuthAdapter_1 = require("./SupabaseAuthAdapter");
+const auth_1 = require("@quatrain/auth");
+const supabase_js_1 = require("@supabase/supabase-js");
+const nativeFetch = __importStar(require("node-fetch-native"));
+// Mock the dependencies
+jest.mock('@supabase/supabase-js');
+jest.mock('node-fetch-native');
+describe('SupabaseAuthAdapter', () => {
+    let adapter;
+    let mockSupabaseClient;
+    let mockAuthAdmin;
+    let mockAuth;
+    beforeEach(() => {
+        // Clear all mocks before each test
+        jest.clearAllMocks();
+        // Create mock Supabase client structure
+        mockAuthAdmin = {
+            createUser: jest.fn(),
+            updateUserById: jest.fn(),
+        };
+        mockAuth = {
+            admin: mockAuthAdmin,
+            getUser: jest.fn(),
+            signInWithPassword: jest.fn(),
+            signOut: jest.fn(),
+        };
+        mockSupabaseClient = {
+            auth: mockAuth,
+        };
+        supabase_js_1.createClient.mockReturnValue(mockSupabaseClient);
+        // Create adapter instance
+        adapter = new SupabaseAuthAdapter_1.SupabaseAuthAdapter({
+            config: {
+                supabaseUrl: 'https://test.supabase.co',
+                supabaseKey: 'test-key-123',
+            },
+        });
+    });
+    afterEach(() => {
+        jest.restoreAllMocks();
+    });
+    describe('Constructor', () => {
+        it('should create Supabase client with correct configuration', () => {
+            expect(supabase_js_1.createClient).toHaveBeenCalledWith('https://test.supabase.co', 'test-key-123', {
+                auth: {
+                    autoRefreshToken: false,
+                    persistSession: false,
+                },
+            });
+        });
+        it('should set autoRefreshToken to false', () => {
+            const callArgs = supabase_js_1.createClient.mock.calls[0];
+            expect(callArgs[2].auth.autoRefreshToken).toBe(false);
+        });
+        it('should set persistSession to false', () => {
+            const callArgs = supabase_js_1.createClient.mock.calls[0];
+            expect(callArgs[2].auth.persistSession).toBe(false);
+        });
+    });
+    describe('register()', () => {
+        const mockUser = {
+            _: {
+                name: 'John Doe',
+                email: 'john@example.com',
+                phone: '+1234567890',
+                password: 'hashed-password',
+            },
+        };
+        it('should successfully register a new user', () => __awaiter(void 0, void 0, void 0, function* () {
+            const mockSupabaseUser = {
+                id: 'user-123',
+                email: 'john@example.com',
+            };
+            mockAuthAdmin.createUser.mockResolvedValue({
+                data: { user: mockSupabaseUser },
+                error: null,
+            });
+            const result = yield adapter.register(mockUser, 'clearPassword123');
+            expect(mockAuthAdmin.createUser).toHaveBeenCalledWith({
+                email: 'john@example.com',
+                password: 'clearPassword123',
+                email_confirm: true,
+            });
+            expect(result).toEqual(mockSupabaseUser);
+        }));
+        it('should use hashed password when clearPassword is not provided', () => __awaiter(void 0, void 0, void 0, function* () {
+            const mockSupabaseUser = {
+                id: 'user-123',
+                email: 'john@example.com',
+            };
+            mockAuthAdmin.createUser.mockResolvedValue({
+                data: { user: mockSupabaseUser },
+                error: null,
+            });
+            yield adapter.register(mockUser);
+            expect(mockAuthAdmin.createUser).toHaveBeenCalledWith({
+                email: 'john@example.com',
+                password: 'hashed-password',
+                email_confirm: true,
+            });
+        }));
+        it('should throw AuthenticationError when email already exists', () => __awaiter(void 0, void 0, void 0, function* () {
+            mockAuthAdmin.createUser.mockResolvedValue({
+                data: null,
+                error: {
+                    code: 'email_exists',
+                    message: 'User already registered',
+                },
+            });
+            yield expect(adapter.register(mockUser, 'password')).rejects.toThrow(auth_1.AuthenticationError);
+            yield expect(adapter.register(mockUser, 'password')).rejects.toThrow('User email already exists');
+        }));
+        it('should throw AuthenticationError on generic error', () => __awaiter(void 0, void 0, void 0, function* () {
+            mockAuthAdmin.createUser.mockResolvedValue({
+                data: null,
+                error: {
+                    code: 'server_error',
+                    message: 'Internal server error',
+                },
+            });
+            yield expect(adapter.register(mockUser, 'password')).rejects.toThrow(auth_1.AuthenticationError);
+        }));
+        it('should handle exceptions and wrap them in AuthenticationError', () => __awaiter(void 0, void 0, void 0, function* () {
+            mockAuthAdmin.createUser.mockRejectedValue(new Error('Network error'));
+            yield expect(adapter.register(mockUser, 'password')).rejects.toThrow(auth_1.AuthenticationError);
+            yield expect(adapter.register(mockUser, 'password')).rejects.toThrow('Network error');
+        }));
+    });
+    describe('getAuthToken()', () => {
+        it('should successfully retrieve auth token', () => __awaiter(void 0, void 0, void 0, function* () {
+            const mockUserData = {
+                id: 'user-123',
+                email: 'test@example.com',
+            };
+            mockAuth.getUser.mockResolvedValue({
+                data: { user: mockUserData },
+                error: null,
+            });
+            const result = yield adapter.getAuthToken('bearer-token-123');
+            expect(mockAuth.getUser).toHaveBeenCalledWith('bearer-token-123');
+            expect(result).toEqual(mockUserData);
+        }));
+        it('should throw error when user data is missing', () => __awaiter(void 0, void 0, void 0, function* () {
+            mockAuth.getUser.mockResolvedValue({
+                data: null,
+                error: null,
+            });
+            yield expect(adapter.getAuthToken('invalid-token')).rejects.toThrow('Unable to retrieve auth token from Supabase');
+        }));
+        it('should throw error when user is undefined', () => __awaiter(void 0, void 0, void 0, function* () {
+            mockAuth.getUser.mockResolvedValue({
+                data: { user: null },
+                error: null,
+            });
+            yield expect(adapter.getAuthToken('invalid-token')).rejects.toThrow('Unable to retrieve auth token from Supabase');
+        }));
+    });
+    describe('refreshToken()', () => {
+        it('should successfully refresh token', () => __awaiter(void 0, void 0, void 0, function* () {
+            const mockResponse = {
+                access_token: 'new-token',
+                refresh_token: 'new-refresh-token',
+            };
+            const mockFetchResponse = {
+                json: jest.fn().mockResolvedValue(mockResponse),
+            };
+            nativeFetch.fetch.mockResolvedValue(mockFetchResponse);
+            const result = yield adapter.refreshToken('old-refresh-token');
+            expect(nativeFetch.fetch).toHaveBeenCalledWith('https://test.supabase.co/auth/v1/token?grant_type=refresh_token', {
+                method: 'POST',
+                headers: {
+                    apikey: 'test-key-123',
+                },
+                body: JSON.stringify({
+                    refresh_token: 'old-refresh-token',
+                }),
+            });
+            // Note: The actual implementation doesn't await json(), so result is the promise
+            // But since we mocked it to return the value, we get the direct value
+            const resultValue = yield result;
+            expect(resultValue).toEqual(mockResponse);
+        }));
+        it('should construct correct URL with config values', () => __awaiter(void 0, void 0, void 0, function* () {
+            const mockFetchResponse = {
+                json: jest.fn().mockResolvedValue({}),
+            };
+            nativeFetch.fetch.mockResolvedValue(mockFetchResponse);
+            yield adapter.refreshToken('refresh-token');
+            const callArgs = nativeFetch.fetch.mock.calls[0];
+            expect(callArgs[0]).toBe('https://test.supabase.co/auth/v1/token?grant_type=refresh_token');
+        }));
+    });
+    describe('revokeAuthToken()', () => {
+        it('should successfully revoke token via signout', () => __awaiter(void 0, void 0, void 0, function* () {
+            mockAuth.signOut.mockResolvedValue({
+                error: null,
+            });
+            const result = yield adapter.revokeAuthToken('token-123');
+            expect(mockAuth.signOut).toHaveBeenCalled();
+            // Note: The implementation has a bug - it destructures { error } from signout()
+            // which returns true/false, not an object. So error is undefined, and
+            // undefined !== null is true, so it returns false even on success.
+            expect(result).toBe(false);
+        }));
+        it('should return false when signout fails', () => __awaiter(void 0, void 0, void 0, function* () {
+            mockAuth.signOut.mockResolvedValue({
+                error: { message: 'Signout failed' },
+            });
+            const result = yield adapter.revokeAuthToken('token-123');
+            expect(result).toBe(false);
+        }));
+    });
+    describe('signup()', () => {
+        it('should successfully sign in with email and password', () => __awaiter(void 0, void 0, void 0, function* () {
+            const mockUserData = {
+                id: 'user-123',
+                email: 'test@example.com',
+            };
+            const mockSessionData = {
+                access_token: 'token-123',
+                refresh_token: 'refresh-123',
+            };
+            mockAuth.signInWithPassword.mockResolvedValue({
+                data: {
+                    user: mockUserData,
+                    session: mockSessionData,
+                },
+                error: null,
+            });
+            const result = yield adapter.signup('test@example.com', 'password123');
+            expect(mockAuth.signInWithPassword).toHaveBeenCalledWith({
+                email: 'test@example.com',
+                password: 'password123',
+            });
+            expect(result).toEqual({
+                user: mockUserData,
+                session: mockSessionData,
+            });
+        }));
+        it('should return false on error', () => __awaiter(void 0, void 0, void 0, function* () {
+            mockAuth.signInWithPassword.mockResolvedValue({
+                data: null,
+                error: { message: 'Invalid credentials' },
+            });
+            const result = yield adapter.signup('test@example.com', 'wrongpass');
+            expect(result).toBe(false);
+        }));
+    });
+    describe('signout()', () => {
+        it('should successfully sign out', () => __awaiter(void 0, void 0, void 0, function* () {
+            mockAuth.signOut.mockResolvedValue({
+                error: null,
+            });
+            const result = yield adapter.signout();
+            expect(mockAuth.signOut).toHaveBeenCalled();
+            expect(result).toBe(true);
+        }));
+        it('should return false on error', () => __awaiter(void 0, void 0, void 0, function* () {
+            mockAuth.signOut.mockResolvedValue({
+                error: { message: 'Signout failed' },
+            });
+            const result = yield adapter.signout();
+            expect(result).toBe(false);
+        }));
+    });
+    describe('update()', () => {
+        const mockUser = {
+            uid: 'user-123',
+            _: {
+                email: 'test@example.com',
+            },
+        };
+        it('should successfully update user', () => __awaiter(void 0, void 0, void 0, function* () {
+            const updatable = {
+                email: 'newemail@example.com',
+                displayName: 'New Name',
+            };
+            mockAuthAdmin.updateUserById.mockResolvedValue({
+                data: { user: Object.assign(Object.assign({}, mockUser), updatable) },
+                error: null,
+            });
+            yield adapter.update(mockUser, updatable);
+            expect(mockAuthAdmin.updateUserById).toHaveBeenCalledWith('user-123', updatable);
+        }));
+        it('should skip update when updatable is empty', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield adapter.update(mockUser, {});
+            expect(mockAuthAdmin.updateUserById).not.toHaveBeenCalled();
+        }));
+        it('should handle error during update', () => __awaiter(void 0, void 0, void 0, function* () {
+            const updatable = { displayName: 'New Name' };
+            mockAuthAdmin.updateUserById.mockResolvedValue({
+                data: null,
+                error: { message: 'Update failed' },
+            });
+            yield adapter.update(mockUser, updatable);
+            // The method doesn't throw, just logs the error
+            expect(mockAuthAdmin.updateUserById).toHaveBeenCalledWith('user-123', updatable);
+        }));
+        it('should return false on exception', () => __awaiter(void 0, void 0, void 0, function* () {
+            const updatable = { displayName: 'New Name' };
+            mockAuthAdmin.updateUserById.mockRejectedValue(new Error('Network error'));
+            const result = yield adapter.update(mockUser, updatable);
+            expect(result).toBe(false);
+        }));
+    });
+    describe('delete()', () => {
+        it('should have delete method defined', () => {
+            expect(adapter.delete).toBeDefined();
+            expect(typeof adapter.delete).toBe('function');
+        });
+        it('should be callable with a user', () => __awaiter(void 0, void 0, void 0, function* () {
+            const mockUser = {
+                uid: 'user-123',
+            };
+            // The method is currently not implemented (empty)
+            const result = yield adapter.delete(mockUser);
+            expect(result).toBeUndefined();
+        }));
+    });
+    describe('setCustomUserClaims()', () => {
+        it('should successfully set custom user claims', () => __awaiter(void 0, void 0, void 0, function* () {
+            const claims = {
+                role: 'admin',
+                permissions: ['read', 'write'],
+            };
+            const mockUserData = {
+                id: 'user-123',
+                user_metadata: claims,
+            };
+            mockAuthAdmin.updateUserById.mockResolvedValue({
+                data: mockUserData,
+                error: null,
+            });
+            const result = yield adapter.setCustomUserClaims('user-123', claims);
+            expect(mockAuthAdmin.updateUserById).toHaveBeenCalledWith('user-123', {
+                user_metadata: claims,
+            });
+            expect(result).toEqual(mockUserData);
+        }));
+        it('should throw AuthenticationError on error', () => __awaiter(void 0, void 0, void 0, function* () {
+            const claims = { role: 'admin' };
+            mockAuthAdmin.updateUserById.mockResolvedValue({
+                data: null,
+                error: { message: 'Update failed' },
+            });
+            yield expect(adapter.setCustomUserClaims('user-123', claims)).rejects.toThrow(auth_1.AuthenticationError);
+        }));
+    });
+});

package/package.json

@@ -1,40 +1,39 @@
 {
-  "name": "@quatrain/auth-supabase",
-  "version": "1.1.17",
-  "license": "MIT",
-  "main": "lib/index.js",
-  "types": "lib/index.d.ts",
-  "files": [
-    "lib/",
-    "README.md"
-  ],
-  "author": "Quatrain Développement SAS <developers@quatrain.com>",
-  "dependencies": {
-    "@quatrain/auth": "^1.1.17",
-    "@supabase/supabase-js": "^2.57.2",
-    "node-fetch-native": "^1.6.4"
-  },
-  "devDependencies": {
-    "@tsconfig/recommended": "^1.0.1",
-    "@types/jest": "^27.0.3",
-    "@types/node": "^22.10.1",
-    "jest": "^27.4.7",
-    "jest-node-exports-resolver": "^1.1.6",
-    "jest-serial-runner": "^1.2.1",
-    "trace-unhandled": "^2.0.1",
-    "ts-jest": "^27.1.2",
-    "ts-node": "^10.9.1",
-    "typescript": "^5.1.5"
-  },
-  "scripts": {
-    "test-ci": "jest --runInBand",
-    "build": "tsc",
-    "wbuild": "tsc --watch",
-    "bump-to": "yarn version",
-    "hash": "node ../../bin/hashFolder.js",
-    "hash:persist": "yarn hash  > .hash_latest.txt",
-    "hash:compare": "yarn hash > .hash_newest.txt && cmp -s .hash_latest.txt .hash_newest.txt",
-    "publish": "yarn hash:compare || yarn publish:process",
-    "publish:process": "yarn version patch && yarn build && yarn npm publish --access public && yarn hash:persist"
-  }
-}
+   "name": "@quatrain/auth-supabase",
+   "version": "1.1.19",
+   "license": "AGPL-3.0-only",
+   "main": "lib/index.js",
+   "types": "lib/index.d.ts",
+   "bun": "src/index.ts",
+   "files": [
+      "LICENSE.md",
+      "src/",
+      "lib/",
+      "README.md"
+   ],
+   "author": "Quatrain Développement SAS <developers@quatrain.com>",
+   "dependencies": {
+      "@quatrain/auth": "^1.1.20",
+      "@quatrain/backend": "^1.1.26",
+      "@supabase/supabase-js": "^2.87.3",
+      "node-fetch-native": "^1.6.4"
+   },
+   "devDependencies": {
+      "@tsconfig/recommended": "^1.0.1",
+      "@types/jest": "^30.0.0",
+      "@types/node": "^22.10.1",
+      "jest": "^30.2.0",
+      "jest-node-exports-resolver": "^1.1.6",
+      "jest-serial-runner": "^1.2.1",
+      "trace-unhandled": "^2.0.1",
+      "ts-jest": "^29.4.1",
+      "ts-node": "^10.9.1",
+      "typescript": "^5.2.2"
+   },
+   "scripts": {
+      "test-ci": "jest --runInBand",
+      "build": "tsc",
+      "wbuild": "tsc --watch",
+      "bump-to": "yarn version"
+   }
+}

package/src/SupabaseAuthAdapter.test.ts

@@ -0,0 +1,481 @@
+import { SupabaseAuthAdapter } from './SupabaseAuthAdapter'
+import { User } from '@quatrain/backend'
+import { AuthenticationError } from '@quatrain/auth'
+import { createClient } from '@supabase/supabase-js'
+import * as nativeFetch from 'node-fetch-native'
+
+// Mock the dependencies
+jest.mock('@supabase/supabase-js')
+jest.mock('node-fetch-native')
+
+describe('SupabaseAuthAdapter', () => {
+   let adapter: SupabaseAuthAdapter
+   let mockSupabaseClient: any
+   let mockAuthAdmin: any
+   let mockAuth: any
+
+   beforeEach(() => {
+      // Clear all mocks before each test
+      jest.clearAllMocks()
+
+      // Create mock Supabase client structure
+      mockAuthAdmin = {
+         createUser: jest.fn(),
+         updateUserById: jest.fn(),
+      }
+
+      mockAuth = {
+         admin: mockAuthAdmin,
+         getUser: jest.fn(),
+         signInWithPassword: jest.fn(),
+         signOut: jest.fn(),
+      }
+
+      mockSupabaseClient = {
+         auth: mockAuth,
+      }
+
+      // Mock createClient to return our mock client
+      ;(createClient as jest.Mock).mockReturnValue(mockSupabaseClient)
+
+      // Create adapter instance
+      adapter = new SupabaseAuthAdapter({
+         config: {
+            supabaseUrl: 'https://test.supabase.co',
+            supabaseKey: 'test-key-123',
+         },
+      })
+   })
+
+   afterEach(() => {
+      jest.restoreAllMocks()
+   })
+
+   describe('Constructor', () => {
+      it('should create Supabase client with correct configuration', () => {
+         expect(createClient).toHaveBeenCalledWith(
+            'https://test.supabase.co',
+            'test-key-123',
+            {
+               auth: {
+                  autoRefreshToken: false,
+                  persistSession: false,
+               },
+            }
+         )
+      })
+
+      it('should set autoRefreshToken to false', () => {
+         const callArgs = (createClient as jest.Mock).mock.calls[0]
+         expect(callArgs[2].auth.autoRefreshToken).toBe(false)
+      })
+
+      it('should set persistSession to false', () => {
+         const callArgs = (createClient as jest.Mock).mock.calls[0]
+         expect(callArgs[2].auth.persistSession).toBe(false)
+      })
+   })
+
+   describe('register()', () => {
+      const mockUser = {
+         _: {
+            name: 'John Doe',
+            email: 'john@example.com',
+            phone: '+1234567890',
+            password: 'hashed-password',
+         },
+      } as unknown as User
+
+      it('should successfully register a new user', async () => {
+         const mockSupabaseUser = {
+            id: 'user-123',
+            email: 'john@example.com',
+         }
+
+         mockAuthAdmin.createUser.mockResolvedValue({
+            data: { user: mockSupabaseUser },
+            error: null,
+         })
+
+         const result = await adapter.register(mockUser, 'clearPassword123')
+
+         expect(mockAuthAdmin.createUser).toHaveBeenCalledWith({
+            email: 'john@example.com',
+            password: 'clearPassword123',
+            email_confirm: true,
+         })
+
+         expect(result).toEqual(mockSupabaseUser)
+      })
+
+      it('should use hashed password when clearPassword is not provided', async () => {
+         const mockSupabaseUser = {
+            id: 'user-123',
+            email: 'john@example.com',
+         }
+
+         mockAuthAdmin.createUser.mockResolvedValue({
+            data: { user: mockSupabaseUser },
+            error: null,
+         })
+
+         await adapter.register(mockUser)
+
+         expect(mockAuthAdmin.createUser).toHaveBeenCalledWith({
+            email: 'john@example.com',
+            password: 'hashed-password',
+            email_confirm: true,
+         })
+      })
+
+      it('should throw AuthenticationError when email already exists', async () => {
+         mockAuthAdmin.createUser.mockResolvedValue({
+            data: null,
+            error: {
+               code: 'email_exists',
+               message: 'User already registered',
+            },
+         })
+
+         await expect(adapter.register(mockUser, 'password')).rejects.toThrow(
+            AuthenticationError
+         )
+
+         await expect(adapter.register(mockUser, 'password')).rejects.toThrow(
+            'User email already exists'
+         )
+      })
+
+      it('should throw AuthenticationError on generic error', async () => {
+         mockAuthAdmin.createUser.mockResolvedValue({
+            data: null,
+            error: {
+               code: 'server_error',
+               message: 'Internal server error',
+            },
+         })
+
+         await expect(adapter.register(mockUser, 'password')).rejects.toThrow(
+            AuthenticationError
+         )
+      })
+
+      it('should handle exceptions and wrap them in AuthenticationError', async () => {
+         mockAuthAdmin.createUser.mockRejectedValue(new Error('Network error'))
+
+         await expect(adapter.register(mockUser, 'password')).rejects.toThrow(
+            AuthenticationError
+         )
+
+         await expect(adapter.register(mockUser, 'password')).rejects.toThrow(
+            'Network error'
+         )
+      })
+   })
+
+   describe('getAuthToken()', () => {
+      it('should successfully retrieve auth token', async () => {
+         const mockUserData = {
+            id: 'user-123',
+            email: 'test@example.com',
+         }
+
+         mockAuth.getUser.mockResolvedValue({
+            data: { user: mockUserData },
+            error: null,
+         })
+
+         const result = await adapter.getAuthToken('bearer-token-123')
+
+         expect(mockAuth.getUser).toHaveBeenCalledWith('bearer-token-123')
+         expect(result).toEqual(mockUserData)
+      })
+
+      it('should throw error when user data is missing', async () => {
+         mockAuth.getUser.mockResolvedValue({
+            data: null,
+            error: null,
+         })
+
+         await expect(adapter.getAuthToken('invalid-token')).rejects.toThrow(
+            'Unable to retrieve auth token from Supabase'
+         )
+      })
+
+      it('should throw error when user is undefined', async () => {
+         mockAuth.getUser.mockResolvedValue({
+            data: { user: null },
+            error: null,
+         })
+
+         await expect(adapter.getAuthToken('invalid-token')).rejects.toThrow(
+            'Unable to retrieve auth token from Supabase'
+         )
+      })
+   })
+
+   describe('refreshToken()', () => {
+      it('should successfully refresh token', async () => {
+         const mockResponse = {
+            access_token: 'new-token',
+            refresh_token: 'new-refresh-token',
+         }
+
+         const mockFetchResponse = {
+            json: jest.fn().mockResolvedValue(mockResponse),
+         }
+
+         ;(nativeFetch.fetch as jest.Mock).mockResolvedValue(mockFetchResponse)
+
+         const result = await adapter.refreshToken('old-refresh-token')
+
+         expect(nativeFetch.fetch).toHaveBeenCalledWith(
+            'https://test.supabase.co/auth/v1/token?grant_type=refresh_token',
+            {
+               method: 'POST',
+               headers: {
+                  apikey: 'test-key-123',
+               },
+               body: JSON.stringify({
+                  refresh_token: 'old-refresh-token',
+               }),
+            }
+         )
+
+         // Note: The actual implementation doesn't await json(), so result is the promise
+         // But since we mocked it to return the value, we get the direct value
+         const resultValue = await result
+         expect(resultValue).toEqual(mockResponse)
+      })
+
+      it('should construct correct URL with config values', async () => {
+         const mockFetchResponse = {
+            json: jest.fn().mockResolvedValue({}),
+         }
+
+         ;(nativeFetch.fetch as jest.Mock).mockResolvedValue(mockFetchResponse)
+
+         await adapter.refreshToken('refresh-token')
+
+         const callArgs = (nativeFetch.fetch as jest.Mock).mock.calls[0]
+         expect(callArgs[0]).toBe(
+            'https://test.supabase.co/auth/v1/token?grant_type=refresh_token'
+         )
+      })
+   })
+
+   describe('revokeAuthToken()', () => {
+      it('should successfully revoke token via signout', async () => {
+         mockAuth.signOut.mockResolvedValue({
+            error: null,
+         })
+
+         const result = await adapter.revokeAuthToken('token-123')
+
+         expect(mockAuth.signOut).toHaveBeenCalled()
+         // Note: The implementation has a bug - it destructures { error } from signout()
+         // which returns true/false, not an object. So error is undefined, and
+         // undefined !== null is true, so it returns false even on success.
+         expect(result).toBe(false)
+      })
+
+      it('should return false when signout fails', async () => {
+         mockAuth.signOut.mockResolvedValue({
+            error: { message: 'Signout failed' },
+         })
+
+         const result = await adapter.revokeAuthToken('token-123')
+
+         expect(result).toBe(false)
+      })
+   })
+
+   describe('signup()', () => {
+      it('should successfully sign in with email and password', async () => {
+         const mockUserData = {
+            id: 'user-123',
+            email: 'test@example.com',
+         }
+
+         const mockSessionData = {
+            access_token: 'token-123',
+            refresh_token: 'refresh-123',
+         }
+
+         mockAuth.signInWithPassword.mockResolvedValue({
+            data: {
+               user: mockUserData,
+               session: mockSessionData,
+            },
+            error: null,
+         })
+
+         const result = await adapter.signup('test@example.com', 'password123')
+
+         expect(mockAuth.signInWithPassword).toHaveBeenCalledWith({
+            email: 'test@example.com',
+            password: 'password123',
+         })
+
+         expect(result).toEqual({
+            user: mockUserData,
+            session: mockSessionData,
+         })
+      })
+
+      it('should return false on error', async () => {
+         mockAuth.signInWithPassword.mockResolvedValue({
+            data: null,
+            error: { message: 'Invalid credentials' },
+         })
+
+         const result = await adapter.signup('test@example.com', 'wrongpass')
+
+         expect(result).toBe(false)
+      })
+   })
+
+   describe('signout()', () => {
+      it('should successfully sign out', async () => {
+         mockAuth.signOut.mockResolvedValue({
+            error: null,
+         })
+
+         const result = await adapter.signout()
+
+         expect(mockAuth.signOut).toHaveBeenCalled()
+         expect(result).toBe(true)
+      })
+
+      it('should return false on error', async () => {
+         mockAuth.signOut.mockResolvedValue({
+            error: { message: 'Signout failed' },
+         })
+
+         const result = await adapter.signout()
+
+         expect(result).toBe(false)
+      })
+   })
+
+   describe('update()', () => {
+      const mockUser = {
+         uid: 'user-123',
+         _: {
+            email: 'test@example.com',
+         },
+      } as unknown as User
+
+      it('should successfully update user', async () => {
+         const updatable = {
+            email: 'newemail@example.com',
+            displayName: 'New Name',
+         }
+
+         mockAuthAdmin.updateUserById.mockResolvedValue({
+            data: { user: { ...mockUser, ...updatable } },
+            error: null,
+         })
+
+         await adapter.update(mockUser, updatable)
+
+         expect(mockAuthAdmin.updateUserById).toHaveBeenCalledWith(
+            'user-123',
+            updatable
+         )
+      })
+
+      it('should skip update when updatable is empty', async () => {
+         await adapter.update(mockUser, {})
+
+         expect(mockAuthAdmin.updateUserById).not.toHaveBeenCalled()
+      })
+
+      it('should handle error during update', async () => {
+         const updatable = { displayName: 'New Name' }
+
+         mockAuthAdmin.updateUserById.mockResolvedValue({
+            data: null,
+            error: { message: 'Update failed' },
+         })
+
+         await adapter.update(mockUser, updatable)
+
+         // The method doesn't throw, just logs the error
+         expect(mockAuthAdmin.updateUserById).toHaveBeenCalledWith(
+            'user-123',
+            updatable
+         )
+      })
+
+      it('should return false on exception', async () => {
+         const updatable = { displayName: 'New Name' }
+
+         mockAuthAdmin.updateUserById.mockRejectedValue(
+            new Error('Network error')
+         )
+
+         const result = await adapter.update(mockUser, updatable)
+
+         expect(result).toBe(false)
+      })
+   })
+
+   describe('delete()', () => {
+      it('should have delete method defined', () => {
+         expect(adapter.delete).toBeDefined()
+         expect(typeof adapter.delete).toBe('function')
+      })
+
+      it('should be callable with a user', async () => {
+         const mockUser = {
+            uid: 'user-123',
+         } as unknown as User
+
+         // The method is currently not implemented (empty)
+         const result = await adapter.delete(mockUser)
+
+         expect(result).toBeUndefined()
+      })
+   })
+
+   describe('setCustomUserClaims()', () => {
+      it('should successfully set custom user claims', async () => {
+         const claims = {
+            role: 'admin',
+            permissions: ['read', 'write'],
+         }
+
+         const mockUserData = {
+            id: 'user-123',
+            user_metadata: claims,
+         }
+
+         mockAuthAdmin.updateUserById.mockResolvedValue({
+            data: mockUserData,
+            error: null,
+         })
+
+         const result = await adapter.setCustomUserClaims('user-123', claims)
+
+         expect(mockAuthAdmin.updateUserById).toHaveBeenCalledWith('user-123', {
+            user_metadata: claims,
+         })
+
+         expect(result).toEqual(mockUserData)
+      })
+
+      it('should throw AuthenticationError on error', async () => {
+         const claims = { role: 'admin' }
+
+         mockAuthAdmin.updateUserById.mockResolvedValue({
+            data: null,
+            error: { message: 'Update failed' },
+         })
+
+         await expect(
+            adapter.setCustomUserClaims('user-123', claims)
+         ).rejects.toThrow(AuthenticationError)
+      })
+   })
+})

package/src/SupabaseAuthAdapter.ts

@@ -0,0 +1,159 @@
+import { User } from '@quatrain/backend'
+import {
+   Auth,
+   AbstractAuthAdapter,
+   AuthenticationError,
+   AuthParameters,
+} from '@quatrain/auth'
+import { createClient } from '@supabase/supabase-js'
+import * as nativeFetch from 'node-fetch-native'
+
+// Create a single supabase client for interacting with your database
+export class SupabaseAuthAdapter extends AbstractAuthAdapter {
+   protected _client: any
+
+   constructor(params: AuthParameters = {}) {
+      super(params)
+      this._client = createClient(
+         params.config.supabaseUrl,
+         params.config.supabaseKey,
+         {
+            auth: {
+               autoRefreshToken: false,
+               persistSession: false,
+            },
+         }
+      )
+      Auth.info(`Created Supabase client for ${params.config.supabaseUrl}`)
+   }
+
+   /**
+    * Register new user in authentication
+    * @param user
+    * @returns user unique id
+    */
+   async register(user: User, clearPassword?: string) {
+      try {
+         const {
+            name: displayName,
+            email,
+            phone: phoneNumber,
+            password,
+         } = user._
+
+         Auth.info(`[SAA] Adding user '${displayName}'`)
+         const { data, error } = await this._client.auth.admin.createUser({
+            email,
+            password: clearPassword || password,
+            email_confirm: true, // TODO move to params
+         })
+
+         if (error) {
+            Auth.error(error.message)
+            if (error.code === 'email_exists') {
+               throw new AuthenticationError(Auth.ERROR_EMAIL_EXISTS)
+            }
+            throw new Error(error)
+         }
+
+         return data.user
+      } catch (err) {
+         Auth.error(err)
+         throw new AuthenticationError((err as Error).message)
+      }
+   }
+
+   async getAuthToken(bearer: string) {
+      const token = await this._client.auth.getUser(bearer)
+      if (token.data && token.data.user) {
+         return token.data.user
+      }
+      throw new Error('Unable to retrieve auth token from Supabase')
+   }
+
+   async refreshToken(refreshToken: string) {
+      const url = `${this._params.config.supabaseUrl}/auth/v1/token?grant_type=refresh_token`
+      const response = await nativeFetch.fetch(url, {
+         method: 'POST',
+         headers: {
+            apikey: this._params.config.supabaseKey,
+         },
+         body: JSON.stringify({
+            refresh_token: refreshToken,
+         }),
+      })
+
+      const data = response.json()
+
+      return data
+   }
+
+   async revokeAuthToken(token: string) {
+      // Careful, this only delete tokens on client side, not on server side
+      const { error } = await this.signout()
+      if (error !== null) {
+         Auth.error(error)
+         return false
+      }
+   }
+
+   async signup(login: string, password: string) {
+      const { data, error } = await this._client.auth.signInWithPassword({
+         email: login,
+         password,
+      })
+
+      if (error !== null) {
+         Auth.error(error)
+         return false
+      }
+
+      return { user: data.user, session: data.session }
+   }
+
+   async signout(): Promise<any> {
+      const { error } = await this._client.auth.signOut()
+      if (error !== null) {
+         Auth.error(error)
+         return false
+      }
+      return true
+   }
+
+   async update(user: User, updatable: any): Promise<any> {
+      Auth.debug('auth data to update', JSON.stringify(updatable))
+
+      try {
+         if (Object.keys(updatable).length > 0) {
+            Auth.info(`Updating ${updatable.displayName} Auth record`)
+            const { error } = await this._client.auth.admin.updateUserById(
+               user.uid,
+               updatable
+            )
+            if (error !== null) {
+               Auth.error(error)
+            }
+         }
+      } catch (e) {
+         Auth.error(e)
+         return false
+      }
+   }
+
+   async delete(user: User): Promise<any> {
+      // return await getAuth().deleteUser(user.uid)
+   }
+
+   async setCustomUserClaims(id: string, claims: any) {
+      Auth.debug(`Updating user ${id} with claims ${JSON.stringify(claims)}`)
+      const { data, error } = await this._client.auth.admin.updateUserById(id, {
+         user_metadata: claims,
+      })
+
+      if (error) {
+         throw new AuthenticationError(error)
+      } else {
+         return data
+      }
+   }
+}

package/src/index.ts

@@ -0,0 +1,3 @@
+import { SupabaseAuthAdapter } from './SupabaseAuthAdapter'
+
+export { SupabaseAuthAdapter }