@rehearsal-db/core 0.1.0-beta.10 → 0.1.0-beta.12

package/src/cli/rehearsal.mjs

@@ -6,7 +6,7 @@
  */
 
 import { createHash } from "node:crypto";
-import { readFile, writeFile } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import { join, relative } from "node:path";
 import { performance } from "node:perf_hooks";
 import { parseEnv } from "node:util";
@@ -18,12 +18,7 @@ import {
   renderHumanError,
   serializeRehearsalError,
 } from "../shared/diagnostics.mjs";
-import {
-  inspectDetectedProject,
-  findRehearsalConfigPath,
-  loadRehearsalConfig,
-  renderDetectedConfig,
-} from "../project/configuration.mjs";
+import { loadRehearsalConfig } from "../project/configuration.mjs";
 import {
   inspectRehearsalBaseline,
   inspectRehearsalMigrations,
@@ -113,6 +108,7 @@ import {
   renderSourceRetirement,
   renderSupportReport,
 } from "./renderers.mjs";
+import { runRehearsalInit } from "./init_command.mjs";
 
 const packageRoot = fileURLToPath(new URL("../..", import.meta.url));
 const projectRoot = process.cwd();
@@ -148,54 +144,13 @@ const emit = ({ command, data, flags, render, status = "success" }) => {
   else console.log(render(data, flags.verbosity));
 };
 
-const runInit = async ({ flags }) => {
-  const detected = await inspectDetectedProject({ projectRoot });
-  const source = renderDetectedConfig(detected);
-  const destination = join(projectRoot, "rehearsal.config.mjs");
-  let existingPath = null;
-  try {
-    existingPath = await findRehearsalConfigPath({ projectRoot });
-  } catch (error) {
-    if (
-      !String(error?.message ?? error).startsWith("No Rehearsal configuration")
-    ) {
-      throw error;
-    }
-  }
-  if (existingPath) {
-    if (flags.write) {
-      throw new Error(
-        `A Rehearsal configuration already exists at ${relative(projectRoot, existingPath)}; Rehearsal will not overwrite it.`,
-      );
-    }
-    return {
-      mode: "existing",
-      destination: relative(projectRoot, existingPath),
-      detected,
-      source: "",
-      nextAction:
-        "Review the existing configuration, then run rehearsal doctor.",
-    };
-  }
-  if (flags.write)
-    await writeFile(destination, source, { flag: "wx", mode: 0o600 });
-  return {
-    mode: flags.write ? "written" : "preview",
-    destination: relative(projectRoot, destination),
-    detected,
-    source,
-    nextAction: flags.write
-      ? "Review the generated safety settings and run rehearsal doctor."
-      : "Review this preview, then rerun rehearsal init --write to create it.",
-  };
-};
-
 const runSetup = async ({ flags, planOptions }) => {
   const plan =
     flags.setupPlan ??
     (await planRehearsalSetup({
       projectRoot,
-      target: flags.target ?? "supabase",
+      configPath: planOptions.configPath,
+      target: flags.target,
     }));
   if (flags.write) await applyRehearsalSetup(plan);
   const result = summarizeRehearsalSetup(plan, {
@@ -417,7 +372,7 @@ const executeCommand = async ({ command, flags, planOptions, guided }) => {
     return;
   }
   if (command === "init") {
-    const data = await runInit({ flags });
+    const data = await runRehearsalInit({ projectRoot, flags });
     emit({ command, data, flags, render: renderInit });
     return;
   }

package/src/cli/renderers.mjs

@@ -14,6 +14,16 @@ export const renderPlan = (plan, verbosity) => {
       ...plan.targets.flatMap((target) => [
         `${target.name} — ${target.plan.config.project}`,
         `  ✓ ${target.plan.environment.kind}`,
+        ...(target.plan.environment.authenticationProviders.length
+          ? [
+              `  ✓ External identity providers ${target.plan.environment.authenticationProviders.join(", ")}`,
+              ...(target.plan.environment.authenticationCallback
+                ? [
+                    `  → Register callback ${target.plan.environment.authenticationCallback}`,
+                  ]
+                : []),
+            ]
+          : []),
         `  ✓ baseline ${target.plan.baseline.generationId}`,
         `  ✓ ${formatCount(target.plan.baseline.tableCount, "table")}; ${formatCount(target.plan.baseline.rowCount, "row")}`,
         ...(target.plan.migrations.candidates.length
@@ -69,6 +79,11 @@ export const renderPlan = (plan, verbosity) => {
     ...(plan.environment.authenticationProviders.length
       ? [
           `  ✓ External identity providers ${plan.environment.authenticationProviders.join(", ")}`,
+          ...(plan.environment.authenticationCallback
+            ? [
+                `  → Register callback ${plan.environment.authenticationCallback}`,
+              ]
+            : []),
         ]
       : []),
     "",
@@ -194,6 +209,15 @@ export const renderInit = (result) =>
     `Detected package manager: ${result.detected.packageManager}`,
     `Detected Supabase config: ${result.detected.hasSupabaseConfig ? "yes" : "no"}`,
     `Detected migrations: ${result.detected.hasMigrations ? "yes" : "no"}`,
+    ...(result.availableOptions?.length
+      ? [
+          "",
+          "AVAILABLE BUT NOT ENABLED",
+          ...result.availableOptions.map(
+            (option) => `  → ${option.path}: ${option.summary}`,
+          ),
+        ]
+      : []),
     ...(result.source ? ["", result.source] : []),
     result.nextAction,
   ].join("\n");
@@ -566,8 +590,13 @@ export const renderIdentityPlan = ({ mode, plan }) =>
   [
     `LOCAL IDENTITY — ${mode.toUpperCase()}`,
     `Identity: ${plan.review.name}`,
-    `Provider: ${plan.review.provider}`,
-    `Approved email receipt: ${plan.review.approvedEmailSha256}`,
+    `Matcher: ${plan.review.matcher.type}`,
+    plan.review.matcher.type === "verified-email"
+      ? `Providers: ${plan.review.matcher.providers.join(", ")}`
+      : `Provider: ${plan.review.matcher.provider}`,
+    plan.review.matcher.type === "verified-email"
+      ? `Approved email receipt: ${plan.review.matcher.approvedEmailSha256}`
+      : `Approved subject receipt: ${plan.review.matcher.approvedSubjectSha256}`,
     `Relational references: ${plan.review.references.length}`,
     `Nested JSON references: ${plan.review.jsonReferences.length}`,
     `Signup defaults: ${plan.review.signupDefaults.length}`,

package/src/identity/claim.mjs

@@ -12,6 +12,12 @@ const UUID =
   /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/iu;
 const SHA256 = /^[a-f0-9]{64}$/u;
 const ENVIRONMENT_KEY = /^[A-Z][A-Z0-9_]*$/u;
+const SUPPORTED_IDENTITY_PROVIDERS = Object.freeze([
+  "email",
+  "github",
+  "google",
+]);
+const identityPlanValues = new WeakMap();
 
 const isObject = (value) =>
   value !== null && typeof value === "object" && !Array.isArray(value);
@@ -78,6 +84,114 @@ const defaultMatcher = (value, label) => {
   return Object.freeze({ kind: "exact", value: jsonValue(value, label) });
 };
 
+const provider = (value, label, { subject = false } = {}) => {
+  if (!SUPPORTED_IDENTITY_PROVIDERS.includes(value)) {
+    throw new Error(`${label} is unsupported.`);
+  }
+  if (subject && value === "email") {
+    throw new Error(
+      `${label} cannot use email with a provider-subject matcher.`,
+    );
+  }
+  return value;
+};
+
+const normalizeIdentityMatcher = (entry, label) => {
+  const legacyKeys = [
+    "provider",
+    "emailEnvironmentVariable",
+    "approvedEmailSha256",
+  ];
+  const hasLegacyMatcher = legacyKeys.some((key) => entry[key] !== undefined);
+  if (entry.matcher !== undefined && hasLegacyMatcher) {
+    throw new Error(
+      `${label} cannot combine matcher with legacy provider and email fields.`,
+    );
+  }
+  if (entry.matcher === undefined) {
+    const legacyProvider = provider(entry.provider, `${label}.provider`);
+    if (!ENVIRONMENT_KEY.test(entry.emailEnvironmentVariable ?? "")) {
+      throw new Error(`${label}.emailEnvironmentVariable is invalid.`);
+    }
+    if (!SHA256.test(entry.approvedEmailSha256 ?? "")) {
+      throw new Error(`${label}.approvedEmailSha256 must be a SHA-256.`);
+    }
+    return Object.freeze({
+      type: "verified-email",
+      providers: Object.freeze([legacyProvider]),
+      emailEnvironmentVariable: entry.emailEnvironmentVariable,
+      approvedEmailSha256: entry.approvedEmailSha256,
+    });
+  }
+  if (!isObject(entry.matcher)) {
+    throw new Error(`${label}.matcher must be an object.`);
+  }
+  const matcherLabel = `${label}.matcher`;
+  if (entry.matcher.type === "verified-email") {
+    keys(
+      entry.matcher,
+      ["type", "providers", "emailEnvironmentVariable", "approvedEmailSha256"],
+      matcherLabel,
+    );
+    if (
+      !Array.isArray(entry.matcher.providers) ||
+      entry.matcher.providers.length === 0
+    ) {
+      throw new Error(`${matcherLabel}.providers must not be empty.`);
+    }
+    const providers = entry.matcher.providers.map((value, index) =>
+      provider(value, `${matcherLabel}.providers[${index}]`),
+    );
+    if (new Set(providers).size !== providers.length) {
+      throw new Error(`${matcherLabel}.providers must not contain duplicates.`);
+    }
+    if (!ENVIRONMENT_KEY.test(entry.matcher.emailEnvironmentVariable ?? "")) {
+      throw new Error(`${matcherLabel}.emailEnvironmentVariable is invalid.`);
+    }
+    if (!SHA256.test(entry.matcher.approvedEmailSha256 ?? "")) {
+      throw new Error(`${matcherLabel}.approvedEmailSha256 must be a SHA-256.`);
+    }
+    return Object.freeze({
+      type: "verified-email",
+      providers: Object.freeze(providers),
+      emailEnvironmentVariable: entry.matcher.emailEnvironmentVariable,
+      approvedEmailSha256: entry.matcher.approvedEmailSha256,
+    });
+  }
+  if (entry.matcher.type === "provider-subject") {
+    keys(
+      entry.matcher,
+      [
+        "type",
+        "provider",
+        "subjectEnvironmentVariable",
+        "approvedSubjectSha256",
+      ],
+      matcherLabel,
+    );
+    const subjectProvider = provider(
+      entry.matcher.provider,
+      `${matcherLabel}.provider`,
+      { subject: true },
+    );
+    if (!ENVIRONMENT_KEY.test(entry.matcher.subjectEnvironmentVariable ?? "")) {
+      throw new Error(`${matcherLabel}.subjectEnvironmentVariable is invalid.`);
+    }
+    if (!SHA256.test(entry.matcher.approvedSubjectSha256 ?? "")) {
+      throw new Error(
+        `${matcherLabel}.approvedSubjectSha256 must be a SHA-256.`,
+      );
+    }
+    return Object.freeze({
+      type: "provider-subject",
+      provider: subjectProvider,
+      subjectEnvironmentVariable: entry.matcher.subjectEnvironmentVariable,
+      approvedSubjectSha256: entry.matcher.approvedSubjectSha256,
+    });
+  }
+  throw new Error(`${matcherLabel}.type is unsupported.`);
+};
+
 export const validateIdentityPolicy = (policy) => {
   if (
     !isObject(policy) ||
@@ -100,6 +214,7 @@ export const validateIdentityPolicy = (policy) => {
       if (
         ![
           "name",
+          "matcher",
           "provider",
           "emailEnvironmentVariable",
           "approvedEmailSha256",
@@ -121,14 +236,7 @@ export const validateIdentityPolicy = (policy) => {
     const name = entry.name;
     if (names.has(name)) throw new Error(`Identity policy duplicates ${name}.`);
     names.add(name);
-    if (!["google", "email"].includes(entry.provider))
-      throw new Error(`${label}.provider is unsupported.`);
-    if (!ENVIRONMENT_KEY.test(entry.emailEnvironmentVariable ?? "")) {
-      throw new Error(`${label}.emailEnvironmentVariable is invalid.`);
-    }
-    if (!SHA256.test(entry.approvedEmailSha256 ?? "")) {
-      throw new Error(`${label}.approvedEmailSha256 must be a SHA-256.`);
-    }
+    const matcher = normalizeIdentityMatcher(entry, label);
     if (!UUID.test(entry.placeholderUserId ?? ""))
       throw new Error(`${label}.placeholderUserId is invalid.`);
     const references = (entry.references ?? []).map(
@@ -341,9 +449,7 @@ export const validateIdentityPolicy = (policy) => {
     }
     return Object.freeze({
       name,
-      provider: entry.provider,
-      emailEnvironmentVariable: entry.emailEnvironmentVariable,
-      approvedEmailSha256: entry.approvedEmailSha256,
+      matcher,
       placeholderUserId: entry.placeholderUserId.toLowerCase(),
       references: Object.freeze(references),
       jsonReferences: Object.freeze(jsonReferences),
@@ -368,20 +474,32 @@ export const createIdentityClaimPlan = ({
   const normalized = validateIdentityPolicy(policy);
   const identity = normalized.identities.find((entry) => entry.name === name);
   if (!identity) throw new Error(`Identity policy does not declare ${name}.`);
-  const email = environment[identity.emailEnvironmentVariable]
-    ?.trim()
-    .toLowerCase();
-  if (!email || hash(email) !== identity.approvedEmailSha256) {
+  const matcher = identity.matcher;
+  const environmentVariable =
+    matcher.type === "verified-email"
+      ? matcher.emailEnvironmentVariable
+      : matcher.subjectEnvironmentVariable;
+  const rawValue = environment[environmentVariable];
+  const matchValue =
+    matcher.type === "verified-email"
+      ? rawValue?.trim().toLowerCase()
+      : rawValue?.trim();
+  const approvedSha256 =
+    matcher.type === "verified-email"
+      ? matcher.approvedEmailSha256
+      : matcher.approvedSubjectSha256;
+  if (!matchValue || hash(matchValue) !== approvedSha256) {
     throw new Error(
-      "Local identity email does not match the reviewed receipt.",
+      matcher.type === "verified-email"
+        ? "Local identity email does not match the reviewed receipt."
+        : "Local identity provider subject does not match the reviewed receipt.",
     );
   }
   const review = {
-    planVersion: 2,
+    planVersion: 3,
     operation: "claim-local-identity",
     name: identity.name,
-    provider: identity.provider,
-    approvedEmailSha256: identity.approvedEmailSha256,
+    matcher,
     placeholderUserId: identity.placeholderUserId,
     references: identity.references,
     jsonReferences: identity.jsonReferences,
@@ -404,12 +522,13 @@ export const createIdentityClaimPlan = ({
         }
       : null,
   };
-  return Object.freeze({
+  const plan = {
     identity,
-    email,
     review: Object.freeze(review),
     digest: hash(canonical(review)),
-  });
+  };
+  identityPlanValues.set(plan, matchValue);
+  return Object.freeze(plan);
 };
 
 const inspectDeclaredDefault = ({ row, declaration }) => {
@@ -492,6 +611,84 @@ const countIdentityRows = async ({ client, reference, userId }) => {
   return count;
 };
 
+const findVerifiedLocalIdentity = async ({ client, plan, matchValue }) => {
+  const matcher = plan.identity.matcher;
+  if (matcher.type === "verified-email") {
+    const match = await client.query(
+      `select u.id::text, i.provider
+       from auth.users u
+       join auth.identities i on i.user_id = u.id
+       where lower(coalesce(i.identity_data->>'email', u.email)) = $1
+         and i.provider = any($2::text[])
+         and (
+           coalesce((i.identity_data->>'email_verified')::boolean, false)
+           or u.email_confirmed_at is not null
+         )
+       for update of u`,
+      [matchValue, matcher.providers],
+    );
+    if (match.rows.length !== 1) {
+      throw new Error(
+        match.rows.length === 0
+          ? "No verified local identity matches the reviewed email and provider allowlist."
+          : "More than one verified local identity matches the reviewed email and provider allowlist.",
+      );
+    }
+    const matchedProvider =
+      match.rows[0].provider ??
+      (matcher.providers.length === 1 ? matcher.providers[0] : null);
+    if (!matcher.providers.includes(matchedProvider)) {
+      throw new Error("Matched local identity provider is invalid.");
+    }
+    return { id: match.rows[0].id, provider: matchedProvider };
+  }
+  const candidates = await client.query(
+    `select u.id::text,
+            i.provider,
+            i.provider_id::text,
+            i.identity_data->>'sub' as subject
+     from auth.users u
+     join auth.identities i on i.user_id = u.id
+     where i.provider = $1
+       and (
+         coalesce((i.identity_data->>'email_verified')::boolean, false)
+         or u.email_confirmed_at is not null
+       )
+     for update of u`,
+    [matcher.provider],
+  );
+  const matches = [];
+  for (const candidate of candidates.rows) {
+    const subjects = [candidate.provider_id, candidate.subject]
+      .filter((value) => typeof value === "string" && value.trim())
+      .map((value) => value.trim());
+    const uniqueSubjects = [...new Set(subjects)];
+    if (
+      uniqueSubjects.some(
+        (subject) => hash(subject) === matcher.approvedSubjectSha256,
+      )
+    ) {
+      if (uniqueSubjects.length !== 1) {
+        throw new Error(
+          "The matched local provider identity has conflicting stable subjects.",
+        );
+      }
+      matches.push({ id: candidate.id, provider: candidate.provider });
+    }
+  }
+  if (matches.length !== 1) {
+    throw new Error(
+      matches.length === 0
+        ? "No verified local identity matches the reviewed provider subject."
+        : "More than one verified local identity matches the reviewed provider subject.",
+    );
+  }
+  if (matches[0].provider !== matcher.provider) {
+    throw new Error("Matched local identity provider is invalid.");
+  }
+  return matches[0];
+};
+
 export const applyIdentityClaim = async ({
   plan,
   confirmation,
@@ -504,6 +701,12 @@ export const applyIdentityClaim = async ({
       `Identity claim confirmation does not match. Expected ${plan.digest}.`,
     );
   }
+  const matchValue = identityPlanValues.get(plan);
+  if (!matchValue) {
+    throw new Error(
+      "Identity claim plans must be created from the reviewed local matcher environment.",
+    );
+  }
   const target = new URL(connectionString);
   if (!["127.0.0.1", "::1", "localhost"].includes(target.hostname)) {
     throw new Error(
@@ -525,27 +728,12 @@ export const applyIdentityClaim = async ({
   let storageObjectsTransferred = 0;
   try {
     await client.query("begin");
-    const match = await client.query(
-      `select u.id::text
-       from auth.users u
-       join auth.identities i on i.user_id = u.id
-       where lower(coalesce(i.identity_data->>'email', u.email)) = $1
-         and i.provider = $2
-         and (
-           coalesce((i.identity_data->>'email_verified')::boolean, false)
-           or u.email_confirmed_at is not null
-         )
-       for update of u`,
-      [plan.email, plan.identity.provider],
-    );
-    if (match.rows.length !== 1) {
-      throw new Error(
-        match.rows.length === 0
-          ? "No single verified local provider identity matches the reviewed email."
-          : "More than one local provider identity matches the reviewed email.",
-      );
-    }
-    const localUserId = match.rows[0].id;
+    const localIdentity = await findVerifiedLocalIdentity({
+      client,
+      plan,
+      matchValue,
+    });
+    const localUserId = localIdentity.id;
     if (!UUID.test(localUserId))
       throw new Error("Matched local identity is invalid.");
     const placeholderUser = await client.query(
@@ -932,7 +1120,7 @@ export const applyIdentityClaim = async ({
     }
     return {
       name: plan.identity.name,
-      provider: plan.identity.provider,
+      provider: localIdentity.provider,
       claimed: true,
       removedSignupDefaults,
       tokenHookVerified,

package/src/identity/provider_configuration.mjs

@@ -0,0 +1,177 @@
+/** Render reviewed local OAuth declarations into the disposable Supabase runtime. */
+
+const escapePattern = (value) =>
+  value.replaceAll(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+
+const LEGACY_PROVIDER_KEYS = new Set([
+  "client_id",
+  "email_optional",
+  "enabled",
+  "redirect_uri",
+  "secret",
+  "skip_nonce_check",
+]);
+const SAFE_BOOLEAN_PROVIDER_KEYS = new Set([
+  "email_optional",
+  "skip_nonce_check",
+]);
+
+const readTomlSections = (source) => {
+  const lines = source.split("\n");
+  const sections = [];
+  for (let index = 0; index < lines.length; index += 1) {
+    const match = /^\s*\[([^\]]+)\]\s*(?:#.*)?$/u.exec(lines[index]);
+    if (!match) continue;
+    if (sections.length) sections.at(-1).end = index;
+    sections.push({ name: match[1], start: index, end: lines.length });
+  }
+  return { lines, sections };
+};
+
+const validateLegacyProviderSection = ({ lines, section, provider }) => {
+  const seen = new Set();
+  for (const line of lines.slice(section.start + 1, section.end)) {
+    if (!line.trim() || /^\s*#/u.test(line)) continue;
+    const assignment = /^\s*([A-Za-z0-9_]+)\s*=/u.exec(line);
+    if (!assignment || !LEGACY_PROVIDER_KEYS.has(assignment[1])) {
+      throw new Error(
+        `The local Supabase template auth.external.${provider.name} section contains an unsupported setting. Rehearsal left the tracked template unchanged.`,
+      );
+    }
+    const key = assignment[1];
+    if (seen.has(key)) {
+      throw new Error(
+        `The local Supabase template auth.external.${provider.name} section contains duplicate ${key} settings.`,
+      );
+    }
+    seen.add(key);
+    if (
+      SAFE_BOOLEAN_PROVIDER_KEYS.has(key) &&
+      !new RegExp(
+        `^\\s*${escapePattern(key)}\\s*=\\s*${
+          key === "skip_nonce_check"
+            ? (provider.skipNonceCheck ?? false)
+            : (provider.emailOptional ?? false)
+        }\\s*(?:#.*)?$`,
+        "u",
+      ).test(line)
+    ) {
+      throw new Error(
+        `The local Supabase template auth.external.${provider.name}.${key} setting must match its explicit declarative authentication option before Rehearsal can replace the legacy provider in its disposable runtime copy.`,
+      );
+    }
+  }
+};
+
+export const inspectSupabaseAuthenticationProviderTransition = ({
+  source,
+  authentication,
+}) => {
+  if (!authentication) return Object.freeze({ replacedProviders: [] });
+  const { lines, sections } = readTomlSections(source);
+  const replacementSections = [];
+  for (const provider of authentication.providers) {
+    const sectionName = `auth.external.${provider.name}`;
+    const nested = sections.filter((section) =>
+      section.name.startsWith(`${sectionName}.`),
+    );
+    if (nested.length) {
+      throw new Error(
+        `The local Supabase template contains unsupported nested ${sectionName} configuration. Rehearsal left the tracked template unchanged.`,
+      );
+    }
+    const matching = sections.filter((section) => section.name === sectionName);
+    if (matching.length > 1) {
+      throw new Error(
+        `The local Supabase template declares ${sectionName} more than once.`,
+      );
+    }
+    if (matching.length === 1) {
+      validateLegacyProviderSection({
+        lines,
+        section: matching[0],
+        provider,
+      });
+      replacementSections.push({ ...matching[0], provider: provider.name });
+    }
+  }
+  return Object.freeze({
+    replacedProviders: Object.freeze(
+      replacementSections.map(({ provider }) => provider),
+    ),
+    replacementSections: Object.freeze(replacementSections),
+  });
+};
+
+export const renderSupabaseAuthenticationProviders = ({
+  authentication,
+  apiPort,
+}) => {
+  if (!authentication) return "";
+  return authentication.providers
+    .map(
+      (
+        provider,
+      ) => `# Generated by Rehearsal from config.supabase.authentication.
+[auth.external.${provider.name}]
+enabled = true
+client_id = "env(${provider.clientIdEnvironmentVariable})"
+secret = "env(${provider.clientSecretEnvironmentVariable})"
+redirect_uri = "http://127.0.0.1:${apiPort}/auth/v1/callback"
+${provider.skipNonceCheck ? "skip_nonce_check = true\n" : ""}${provider.emailOptional ? "email_optional = true\n" : ""}
+`,
+    )
+    .join("\n");
+};
+
+const enableLocalSignup = (source) => {
+  const lines = source.split("\n");
+  let inAuth = false;
+  let authSections = 0;
+  let signupSettings = 0;
+  const updated = lines.map((line) => {
+    const section = /^\s*\[([^\]]+)\]\s*(?:#.*)?$/u.exec(line);
+    if (section) {
+      inAuth = section[1] === "auth";
+      if (inAuth) authSections += 1;
+      return line;
+    }
+    if (!inAuth || !/^\s*enable_signup\s*=/u.test(line)) return line;
+    signupSettings += 1;
+    const comment = line.match(/\s+#.*$/u)?.[0] ?? "";
+    return `enable_signup = true${comment}`;
+  });
+  if (authSections !== 1 || signupSettings !== 1) {
+    throw new Error(
+      "The local Supabase template must declare exactly one [auth] section with one enable_signup setting before Rehearsal can configure OAuth.",
+    );
+  }
+  return updated.join("\n");
+};
+
+export const applySupabaseAuthenticationProviders = ({
+  source,
+  authentication,
+  apiPort,
+}) => {
+  if (!authentication) return source;
+  const transition = inspectSupabaseAuthenticationProviderTransition({
+    source,
+    authentication,
+  });
+  const { lines } = readTomlSections(source);
+  const replacedIndexes = new Set(
+    transition.replacementSections.flatMap((section) =>
+      Array.from(
+        { length: section.end - section.start },
+        (_, offset) => section.start + offset,
+      ),
+    ),
+  );
+  const transitionedSource = lines
+    .filter((_, index) => !replacedIndexes.has(index))
+    .join("\n");
+  const runtimeSource = enableLocalSignup(transitionedSource);
+  const separator = runtimeSource.endsWith("\n") ? "\n" : "\n\n";
+  return `${runtimeSource}${separator}${renderSupabaseAuthenticationProviders({ authentication, apiPort })}`;
+};