@quatrain/auth-supabase 1.2.2 → 1.2.4

package/dist/SupabaseAuthAdapter.d.ts

@@ -1,7 +1,25 @@
 import { User } from '@quatrain/backend';
 import { AbstractAuthAdapter, AuthParameters } from '@quatrain/auth';
+import { ApiMiddleware } from '@quatrain/api';
+/**
+ * Authentication adapter implementing the Supabase SDK ecosystem.
+ * Acts as a centralized bridge handling signup, tokens, and middleware enforcement.
+ */
 export declare class SupabaseAuthAdapter extends AbstractAuthAdapter {
     protected _client: any;
+    /**
+     * Initializes a new instance securely with Supabase configuration keys.
+     *
+     * @param config - Must contain `supabaseUrl` and `supabaseKey`.
+     * @returns A constructed SupabaseAuthAdapter or null on invalid params.
+     */
+    static factory(config: any): SupabaseAuthAdapter | null;
+    /**
+     * Express middleware capturing Bearer JWT tokens to execute auth verification.
+     *
+     * @returns The middleware function.
+     */
+    middleware(): ApiMiddleware;
     constructor(params?: AuthParameters);
     /**
      * Register new user in authentication
@@ -9,15 +27,63 @@ export declare class SupabaseAuthAdapter extends AbstractAuthAdapter {
      * @returns user unique id
      */
     register(user: User, clearPassword?: string): Promise<any>;
+    /**
+     * Resolves a raw Bearer token via the Supabase Auth API (`getUser`).
+     *
+     * @param bearer - Raw JWT string.
+     * @returns The decoded user object.
+     * @throws {Error} If verification fails.
+     */
     getAuthToken(bearer: string): Promise<any>;
+    /**
+     * Obtains a new JWT access token by exchanging the persistent refresh token.
+     *
+     * @param refreshToken - The token.
+     * @returns Resolves the token packet.
+     */
     refreshToken(refreshToken: string): Promise<any>;
+    /**
+     * Instructs the Supabase client to destroy the current session.
+     *
+     * @param token - Target token.
+     */
     revokeAuthToken(token: string): Promise<false | undefined>;
+    /**
+     * Executes a direct login / session instantiation via `signInWithPassword`.
+     *
+     * @param login - Email string.
+     * @param password - Raw password.
+     * @returns Resolved user session.
+     */
     signup(login: string, password: string): Promise<false | {
         user: any;
         session: any;
     }>;
+    /**
+     * Disconnects and destroys the active session context.
+     *
+     * @returns True if successful.
+     */
     signout(): Promise<any>;
+    /**
+     * Modifies a Supabase Auth user record.
+     *
+     * @param user - Target user.
+     * @param updatable - The delta properties.
+     */
     update(user: User, updatable: any): Promise<any>;
+    /**
+     * (Unimplemented) Destroys the user context inside Supabase.
+     *
+     * @param user - Target user.
+     */
     delete(user: User): Promise<any>;
+    /**
+     * Merges specific attributes into the Supabase `user_metadata` field using the admin API.
+     *
+     * @param id - The target user ID.
+     * @param claims - The payload of new claims.
+     * @returns Resolved updated user wrapper.
+     */
     setCustomUserClaims(id: string, claims: any): Promise<any>;
 }

package/dist/SupabaseAuthAdapter.js

@@ -47,7 +47,47 @@ const auth_1 = require("@quatrain/auth");
 const supabase_js_1 = require("@supabase/supabase-js");
 const nativeFetch = __importStar(require("node-fetch-native"));
 // Create a single supabase client for interacting with your database
+/**
+ * Authentication adapter implementing the Supabase SDK ecosystem.
+ * Acts as a centralized bridge handling signup, tokens, and middleware enforcement.
+ */
 class SupabaseAuthAdapter extends auth_1.AbstractAuthAdapter {
+    /**
+     * Initializes a new instance securely with Supabase configuration keys.
+     *
+     * @param config - Must contain `supabaseUrl` and `supabaseKey`.
+     * @returns A constructed SupabaseAuthAdapter or null on invalid params.
+     */
+    static factory(config) {
+        if (!config.supabaseUrl || !config.supabaseKey)
+            return null;
+        return new SupabaseAuthAdapter({ config });
+    }
+    /**
+     * Express middleware capturing Bearer JWT tokens to execute auth verification.
+     *
+     * @returns The middleware function.
+     */
+    middleware() {
+        return (req, res) => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const bearer = (((_a = req.headers) === null || _a === void 0 ? void 0 : _a.authorization) || '').split(' ')[1] || '';
+            if (bearer) {
+                try {
+                    const user = yield this.getAuthToken(bearer);
+                    if (user) {
+                        return true; // Authorized
+                    }
+                }
+                catch (e) {
+                    auth_1.Auth.error(`[SupabaseAuthAdapter] Middleware token verification failed: ${e.message}`);
+                }
+            }
+            res.setHeader('WWW-Authenticate', 'Bearer realm="Core API"');
+            res.status(401).send('Authentication required.');
+            return false;
+        });
+    }
     constructor(params = {}) {
         super(params);
         this._client = (0, supabase_js_1.createClient)(params.config.supabaseUrl, params.config.supabaseKey, {
@@ -88,6 +128,13 @@ class SupabaseAuthAdapter extends auth_1.AbstractAuthAdapter {
             }
         });
     }
+    /**
+     * Resolves a raw Bearer token via the Supabase Auth API (`getUser`).
+     *
+     * @param bearer - Raw JWT string.
+     * @returns The decoded user object.
+     * @throws {Error} If verification fails.
+     */
     getAuthToken(bearer) {
         return __awaiter(this, void 0, void 0, function* () {
             const token = yield this._client.auth.getUser(bearer);
@@ -97,6 +144,12 @@ class SupabaseAuthAdapter extends auth_1.AbstractAuthAdapter {
             throw new Error('Unable to retrieve auth token from Supabase');
         });
     }
+    /**
+     * Obtains a new JWT access token by exchanging the persistent refresh token.
+     *
+     * @param refreshToken - The token.
+     * @returns Resolves the token packet.
+     */
     refreshToken(refreshToken) {
         return __awaiter(this, void 0, void 0, function* () {
             const url = `${this._params.config.supabaseUrl}/auth/v1/token?grant_type=refresh_token`;
@@ -113,6 +166,11 @@ class SupabaseAuthAdapter extends auth_1.AbstractAuthAdapter {
             return data;
         });
     }
+    /**
+     * Instructs the Supabase client to destroy the current session.
+     *
+     * @param token - Target token.
+     */
     revokeAuthToken(token) {
         return __awaiter(this, void 0, void 0, function* () {
             // Careful, this only delete tokens on client side, not on server side
@@ -123,6 +181,13 @@ class SupabaseAuthAdapter extends auth_1.AbstractAuthAdapter {
             }
         });
     }
+    /**
+     * Executes a direct login / session instantiation via `signInWithPassword`.
+     *
+     * @param login - Email string.
+     * @param password - Raw password.
+     * @returns Resolved user session.
+     */
     signup(login, password) {
         return __awaiter(this, void 0, void 0, function* () {
             const { data, error } = yield this._client.auth.signInWithPassword({
@@ -136,6 +201,11 @@ class SupabaseAuthAdapter extends auth_1.AbstractAuthAdapter {
             return { user: data.user, session: data.session };
         });
     }
+    /**
+     * Disconnects and destroys the active session context.
+     *
+     * @returns True if successful.
+     */
     signout() {
         return __awaiter(this, void 0, void 0, function* () {
             const { error } = yield this._client.auth.signOut();
@@ -146,6 +216,12 @@ class SupabaseAuthAdapter extends auth_1.AbstractAuthAdapter {
             return true;
         });
     }
+    /**
+     * Modifies a Supabase Auth user record.
+     *
+     * @param user - Target user.
+     * @param updatable - The delta properties.
+     */
     update(user, updatable) {
         return __awaiter(this, void 0, void 0, function* () {
             auth_1.Auth.debug('auth data to update', JSON.stringify(updatable));
@@ -164,11 +240,23 @@ class SupabaseAuthAdapter extends auth_1.AbstractAuthAdapter {
             }
         });
     }
+    /**
+     * (Unimplemented) Destroys the user context inside Supabase.
+     *
+     * @param user - Target user.
+     */
     delete(user) {
         return __awaiter(this, void 0, void 0, function* () {
             // return await getAuth().deleteUser(user.uid)
         });
     }
+    /**
+     * Merges specific attributes into the Supabase `user_metadata` field using the admin API.
+     *
+     * @param id - The target user ID.
+     * @param claims - The payload of new claims.
+     * @returns Resolved updated user wrapper.
+     */
     setCustomUserClaims(id, claims) {
         return __awaiter(this, void 0, void 0, function* () {
             auth_1.Auth.debug(`Updating user ${id} with claims ${JSON.stringify(claims)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quatrain/auth-supabase",
-  "version": "1.2.2",
+  "version": "1.2.4",
   "license": "AGPL-3.0-only",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -19,8 +19,9 @@
   },
   "author": "Quatrain Développement SAS <developers@quatrain.com>",
   "dependencies": {
-    "@quatrain/auth": "^1.2.1",
-    "@quatrain/backend": "^1.2.5",
+    "@quatrain/api": "^1.1.5",
+    "@quatrain/auth": "^1.2.2",
+    "@quatrain/backend": "^1.2.6",
     "@supabase/supabase-js": "^2.87.3",
     "node-fetch-native": "^1.6.4"
   },

package/src/SupabaseAuthAdapter.ts

@@ -5,13 +5,55 @@ import {
    AuthenticationError,
    AuthParameters,
 } from '@quatrain/auth'
+import { ApiMiddleware, ApiRequest, ApiResponse } from '@quatrain/api'
 import { createClient } from '@supabase/supabase-js'
 import * as nativeFetch from 'node-fetch-native'
 
 // Create a single supabase client for interacting with your database
+/**
+ * Authentication adapter implementing the Supabase SDK ecosystem.
+ * Acts as a centralized bridge handling signup, tokens, and middleware enforcement.
+ */
 export class SupabaseAuthAdapter extends AbstractAuthAdapter {
    protected _client: any
 
+   /**
+    * Initializes a new instance securely with Supabase configuration keys.
+    * 
+    * @param config - Must contain `supabaseUrl` and `supabaseKey`.
+    * @returns A constructed SupabaseAuthAdapter or null on invalid params.
+    */
+   static factory(config: any): SupabaseAuthAdapter | null {
+      if (!config.supabaseUrl || !config.supabaseKey) return null
+      return new SupabaseAuthAdapter({ config })
+   }
+
+   /**
+    * Express middleware capturing Bearer JWT tokens to execute auth verification.
+    * 
+    * @returns The middleware function.
+    */
+   public middleware(): ApiMiddleware {
+      return async (req: ApiRequest, res: ApiResponse): Promise<boolean> => {
+         const bearer = ((req.headers?.authorization as string) || '').split(' ')[1] || ''
+         
+         if (bearer) {
+            try {
+               const user = await this.getAuthToken(bearer)
+               if (user) {
+                  return true // Authorized
+               }
+            } catch(e) {
+               Auth.error(`[SupabaseAuthAdapter] Middleware token verification failed: ${(e as Error).message}`)
+            }
+         }
+
+         res.setHeader('WWW-Authenticate', 'Bearer realm="Core API"')
+         res.status(401).send('Authentication required.')
+         return false
+      }
+   }
+
    constructor(params: AuthParameters = {}) {
       super(params)
       this._client = createClient(
@@ -63,6 +105,13 @@ export class SupabaseAuthAdapter extends AbstractAuthAdapter {
       }
    }
 
+   /**
+    * Resolves a raw Bearer token via the Supabase Auth API (`getUser`).
+    * 
+    * @param bearer - Raw JWT string.
+    * @returns The decoded user object.
+    * @throws {Error} If verification fails.
+    */
    async getAuthToken(bearer: string) {
       const token = await this._client.auth.getUser(bearer)
       if (token.data && token.data.user) {
@@ -71,6 +120,12 @@ export class SupabaseAuthAdapter extends AbstractAuthAdapter {
       throw new Error('Unable to retrieve auth token from Supabase')
    }
 
+   /**
+    * Obtains a new JWT access token by exchanging the persistent refresh token.
+    * 
+    * @param refreshToken - The token.
+    * @returns Resolves the token packet.
+    */
    async refreshToken(refreshToken: string) {
       const url = `${this._params.config.supabaseUrl}/auth/v1/token?grant_type=refresh_token`
       const response = await nativeFetch.fetch(url, {
@@ -88,6 +143,11 @@ export class SupabaseAuthAdapter extends AbstractAuthAdapter {
       return data
    }
 
+   /**
+    * Instructs the Supabase client to destroy the current session.
+    * 
+    * @param token - Target token.
+    */
    async revokeAuthToken(token: string) {
       // Careful, this only delete tokens on client side, not on server side
       const { error } = await this.signout()
@@ -97,6 +157,13 @@ export class SupabaseAuthAdapter extends AbstractAuthAdapter {
       }
    }
 
+   /**
+    * Executes a direct login / session instantiation via `signInWithPassword`.
+    * 
+    * @param login - Email string.
+    * @param password - Raw password.
+    * @returns Resolved user session.
+    */
    async signup(login: string, password: string) {
       const { data, error } = await this._client.auth.signInWithPassword({
          email: login,
@@ -111,6 +178,11 @@ export class SupabaseAuthAdapter extends AbstractAuthAdapter {
       return { user: data.user, session: data.session }
    }
 
+   /**
+    * Disconnects and destroys the active session context.
+    * 
+    * @returns True if successful.
+    */
    async signout(): Promise<any> {
       const { error } = await this._client.auth.signOut()
       if (error !== null) {
@@ -120,6 +192,12 @@ export class SupabaseAuthAdapter extends AbstractAuthAdapter {
       return true
    }
 
+   /**
+    * Modifies a Supabase Auth user record.
+    * 
+    * @param user - Target user.
+    * @param updatable - The delta properties.
+    */
    async update(user: User, updatable: any): Promise<any> {
       Auth.debug('auth data to update', JSON.stringify(updatable))
 
@@ -140,10 +218,22 @@ export class SupabaseAuthAdapter extends AbstractAuthAdapter {
       }
    }
 
+   /**
+    * (Unimplemented) Destroys the user context inside Supabase.
+    * 
+    * @param user - Target user.
+    */
    async delete(user: User): Promise<any> {
       // return await getAuth().deleteUser(user.uid)
    }
 
+   /**
+    * Merges specific attributes into the Supabase `user_metadata` field using the admin API.
+    * 
+    * @param id - The target user ID.
+    * @param claims - The payload of new claims.
+    * @returns Resolved updated user wrapper.
+    */
    async setCustomUserClaims(id: string, claims: any) {
       Auth.debug(`Updating user ${id} with claims ${JSON.stringify(claims)}`)
       const { data, error } = await this._client.auth.admin.updateUserById(id, {