@selvajs/supabase-provider 0.11.0

package/src/data/SupabaseAuditQuery.ts

@@ -0,0 +1,103 @@
+import type {
+	AuditEventRow,
+	AuditQueryFilters,
+	AuditQueryResult,
+	DomainEvent,
+	IAuditQuery,
+	RequestContext
+} from '@selvajs/platform';
+import type { ClientBundle } from './client.js';
+
+const MAX_LIMIT = 200;
+const DEFAULT_LIMIT = 100;
+
+// Cursor values are interpolated into PostgREST filter strings — both formats
+// must be validated before any string concatenation reaches the query.
+const ISO_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})$/;
+const UUID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+
+/**
+ * Read-side for `audit_events`. Always uses the service-role client — RLS
+ * blocks all read access by design, so the route layer is the single trust
+ * boundary (callers must gate on `instance_admin`).
+ *
+ * Pagination is keyset on `(occurred_at desc, id desc)`. The `id` tie-breaker
+ * prevents skipped rows when multiple events land in the same millisecond.
+ */
+export class SupabaseAuditQuery implements IAuditQuery {
+	constructor(private readonly clients: ClientBundle) {}
+
+	async list(_ctx: RequestContext, filters: AuditQueryFilters): Promise<AuditQueryResult> {
+		const limit = clampLimit(filters.limit);
+
+		let q = this.clients.serviceClient
+			.from('audit_events')
+			.select('id, type, actor_id, occurred_at, data')
+			.order('occurred_at', { ascending: false })
+			.order('id', { ascending: false })
+			// Fetch one extra row to detect "has next page" without a count query.
+			.limit(limit + 1);
+
+		if (filters.types && filters.types.length > 0) {
+			q = q.in('type', [...filters.types]);
+		}
+		if (filters.actorId) {
+			q = q.eq('actor_id', filters.actorId);
+		}
+		if (filters.sinceIso) {
+			q = q.gte('occurred_at', filters.sinceIso);
+		}
+		if (filters.untilIso) {
+			q = q.lte('occurred_at', filters.untilIso);
+		}
+		if (filters.cursor) {
+			// `(occurred_at, id) < (cursorTs, cursorId)` expressed for PostgREST:
+			// strictly older OR same timestamp with a strictly smaller id.
+			//
+			// Both values are interpolated into a `.or()` filter string. Validate
+			// shape before interpolation — without these guards a malformed cursor
+			// (or a hand-crafted URL by a route caller) could break out of the
+			// filter and combine with arbitrary PostgREST operators.
+			const ts = filters.cursor.occurredAt;
+			const id = filters.cursor.id;
+			if (!ISO_RE.test(ts) || !UUID_RE.test(id)) {
+				throw new Error('audit_events query: malformed cursor');
+			}
+			q = q.or(`occurred_at.lt.${ts},and(occurred_at.eq.${ts},id.lt.${id})`);
+		}
+
+		const { data, error } = await q;
+		if (error) {
+			throw new Error(`audit_events query failed: ${error.message}`);
+		}
+
+		const fetched = (data ?? []) as Array<{
+			id: string;
+			type: string;
+			actor_id: string;
+			occurred_at: string;
+			data: DomainEvent;
+		}>;
+
+		const hasMore = fetched.length > limit;
+		const page = hasMore ? fetched.slice(0, limit) : fetched;
+		const last = page[page.length - 1];
+
+		return {
+			rows: page.map((r) => ({
+				id: r.id,
+				type: r.type as DomainEvent['type'],
+				actorId: r.actor_id,
+				occurredAt: r.occurred_at,
+				data: r.data
+			})) satisfies AuditEventRow[],
+			nextCursor: hasMore && last ? { occurredAt: last.occurred_at, id: last.id } : null
+		};
+	}
+}
+
+function clampLimit(requested: number | undefined): number {
+	if (!requested || requested <= 0) return DEFAULT_LIMIT;
+	if (requested > MAX_LIMIT) return MAX_LIMIT;
+	return Math.floor(requested);
+}

package/src/data/SupabaseComputeServerStore.ts

@@ -0,0 +1,262 @@
+import {
+	isOrgServer,
+	isPlatformServer,
+	type IComputeServerStore,
+	type ComputeConfig,
+	type ComputeServerConfig,
+	type RequestContext
+} from '@selvajs/platform';
+import { ProviderError } from '@selvajs/platform';
+import type { ClientBundle } from './client.js';
+
+/**
+ * Compute-server config backed by three tables:
+ *   - `compute_servers`: one row per server. `scope = 'platform' | 'org'`.
+ *     Platform rows carry a `shared_with_all` flag + `compute_server_shares`
+ *     allowlist; org rows carry `owner_org_id`.
+ *   - `compute_server_shares`: many-to-many for platform servers shared
+ *     with specific orgs (when `shared_with_all = false`).
+ *   - `compute_server_org_defaults`: per-org `orgDefaults[orgId]` choice.
+ *   - `compute_server_platform_default`: single-row sentinel for the global
+ *     `defaultServerId`.
+ *
+ * `getConfig` returns the full doc; the visibility predicate is applied by
+ * callers (resolver, page loaders) using helpers in `@selvajs/platform`.
+ */
+export class SupabaseComputeServerStore implements IComputeServerStore {
+	constructor(private readonly clients: ClientBundle) {}
+
+	async getConfig(ctx: RequestContext): Promise<ComputeConfig> {
+		const client = this.clients.forRequest(ctx);
+
+		const [serversRes, sharesRes, orgDefRes, platDefRes] = await Promise.all([
+			client.from('compute_servers').select('*'),
+			client.from('compute_server_shares').select('*'),
+			client.from('compute_server_org_defaults').select('*'),
+			client
+				.from('compute_server_platform_default')
+				.select('default_server_id')
+				.eq('singleton', true)
+				.maybeSingle()
+		]);
+
+		if (serversRes.error) throw mapError(serversRes.error);
+		if (sharesRes.error) throw mapError(sharesRes.error);
+		if (orgDefRes.error) throw mapError(orgDefRes.error);
+		if (platDefRes.error) throw mapError(platDefRes.error);
+
+		// Build per-server `sharedWith` allowlists from the join table.
+		const sharedByServer = new Map<string, string[]>();
+		for (const row of sharesRes.data ?? []) {
+			const list = sharedByServer.get(row.server_id) ?? [];
+			list.push(row.org_id);
+			sharedByServer.set(row.server_id, list);
+		}
+
+		const servers = (serversRes.data ?? []).map((row) => rowToServer(row, sharedByServer));
+
+		const orgDefaults: Record<string, string> = {};
+		for (const row of orgDefRes.data ?? []) {
+			if (row.default_server_id) orgDefaults[row.org_id] = row.default_server_id;
+		}
+
+		return {
+			servers,
+			defaultServerId: platDefRes.data?.default_server_id ?? undefined,
+			orgDefaults
+		};
+	}
+
+	async savePlatformServers(
+		ctx: RequestContext,
+		servers: ComputeServerConfig[],
+		defaultServerId: string | undefined
+	): Promise<void> {
+		const client = this.clients.forRequest(ctx);
+		const platformOnly = servers.filter(isPlatformServer);
+
+		// Replace-all of platform rows.
+		const { error: delErr } = await client.from('compute_servers').delete().eq('scope', 'platform');
+		if (delErr) throw mapError(delErr);
+
+		if (platformOnly.length > 0) {
+			const { error: insErr } = await client
+				.from('compute_servers')
+				.insert(platformOnly.map(serverToRow));
+			if (insErr) throw mapError(insErr);
+
+			// Rebuild the share rows for any non-`all` platform servers.
+			const shareRows = platformOnly.flatMap((s) =>
+				s.sharedWith === 'all'
+					? []
+					: s.sharedWith.map((orgId) => ({ server_id: s.id, org_id: orgId }))
+			);
+			if (shareRows.length > 0) {
+				const { error: shErr } = await client.from('compute_server_shares').insert(shareRows);
+				if (shErr) throw mapError(shErr);
+			}
+		}
+
+		const { error: defErr } = await client
+			.from('compute_server_platform_default')
+			.update({ default_server_id: defaultServerId ?? null })
+			.eq('singleton', true);
+		if (defErr) throw mapError(defErr);
+	}
+
+	async saveOrgServers(
+		ctx: RequestContext,
+		orgId: string,
+		servers: ComputeServerConfig[],
+		defaultServerId?: string | null
+	): Promise<void> {
+		const client = this.clients.forRequest(ctx);
+		const orgOnly = servers.filter(isOrgServer).map((s) => ({ ...s, ownerOrgId: orgId }));
+
+		const { error: delErr } = await client
+			.from('compute_servers')
+			.delete()
+			.eq('scope', 'org')
+			.eq('owner_org_id', orgId);
+		if (delErr) throw mapError(delErr);
+
+		if (orgOnly.length > 0) {
+			const { error: insErr } = await client
+				.from('compute_servers')
+				.insert(orgOnly.map(serverToRow));
+			if (insErr) throw mapError(insErr);
+		}
+
+		if (defaultServerId === null) {
+			const { error } = await client
+				.from('compute_server_org_defaults')
+				.delete()
+				.eq('org_id', orgId);
+			if (error) throw mapError(error);
+		} else if (typeof defaultServerId === 'string') {
+			const { error } = await client
+				.from('compute_server_org_defaults')
+				.upsert({ org_id: orgId, default_server_id: defaultServerId });
+			if (error) throw mapError(error);
+		}
+	}
+
+	async setOrgDefault(ctx: RequestContext, orgId: string, serverId: string | null): Promise<void> {
+		const client = this.clients.forRequest(ctx);
+		if (serverId === null) {
+			const { error } = await client
+				.from('compute_server_org_defaults')
+				.delete()
+				.eq('org_id', orgId);
+			if (error) throw mapError(error);
+			return;
+		}
+		const { error } = await client
+			.from('compute_server_org_defaults')
+			.upsert({ org_id: orgId, default_server_id: serverId });
+		if (error) throw mapError(error);
+	}
+
+	async deleteByOrg(ctx: RequestContext, orgId: string): Promise<void> {
+		const client = this.clients.forRequest(ctx);
+
+		// orgDefaults entry — FK on org_id cascades from orgs(id), but org
+		// soft-delete doesn't trigger the cascade, so do it explicitly.
+		const { error: defErr } = await client
+			.from('compute_server_org_defaults')
+			.delete()
+			.eq('org_id', orgId);
+		if (defErr) throw mapError(defErr);
+
+		// Org-private servers owned by this org.
+		const { error: srvErr } = await client
+			.from('compute_servers')
+			.delete()
+			.eq('scope', 'org')
+			.eq('owner_org_id', orgId);
+		if (srvErr) throw mapError(srvErr);
+
+		// Strip this org from any platform server share allowlist.
+		const { error: shErr } = await client
+			.from('compute_server_shares')
+			.delete()
+			.eq('org_id', orgId);
+		if (shErr) throw mapError(shErr);
+	}
+}
+
+interface ServerRow {
+	id: string;
+	scope: 'platform' | 'org';
+	owner_org_id: string | null;
+	shared_with_all: boolean;
+	label: string;
+	server_url: string;
+	api_key: string | null;
+	timeout_ms: number | null;
+	retry_count: number | null;
+}
+
+function rowToServer(row: ServerRow, sharedByServer: Map<string, string[]>): ComputeServerConfig {
+	const common = {
+		id: row.id,
+		label: row.label,
+		serverUrl: row.server_url,
+		apiKey: row.api_key ?? undefined,
+		timeoutMs: row.timeout_ms ?? undefined,
+		retryCount: row.retry_count ?? undefined
+	};
+	if (row.scope === 'platform') {
+		return {
+			...common,
+			scope: 'platform',
+			sharedWith: row.shared_with_all ? 'all' : (sharedByServer.get(row.id) ?? [])
+		};
+	}
+	if (!row.owner_org_id) {
+		throw new Error(`compute_servers row ${row.id} has scope='org' but null owner_org_id`);
+	}
+	return { ...common, scope: 'org', ownerOrgId: row.owner_org_id };
+}
+
+function serverToRow(s: ComputeServerConfig): ServerRow {
+	const base = {
+		id: s.id,
+		label: s.label,
+		server_url: s.serverUrl,
+		api_key: s.apiKey ?? null,
+		timeout_ms: s.timeoutMs ?? null,
+		retry_count: s.retryCount ?? null
+	};
+	if (isPlatformServer(s)) {
+		return {
+			...base,
+			scope: 'platform',
+			owner_org_id: null,
+			shared_with_all: s.sharedWith === 'all'
+		};
+	}
+	return {
+		...base,
+		scope: 'org',
+		owner_org_id: s.ownerOrgId,
+		shared_with_all: false
+	};
+}
+
+interface PostgrestError {
+	code?: string;
+	message?: string;
+}
+
+function mapError(e: unknown): Error {
+	const pg = e as PostgrestError;
+	if (pg?.code === '23505') return new ProviderError(pg.message ?? 'Duplicate record', 409);
+	if (pg?.code === '23503') return new ProviderError(pg.message ?? 'Foreign key violation', 409);
+	if (e instanceof Error) return e;
+	if (e && typeof e === 'object') {
+		const obj = e as { message?: string; code?: string };
+		return new Error(obj.code ? `[${obj.code}] ${obj.message ?? ''}` : (obj.message ?? String(e)));
+	}
+	return new Error(String(e));
+}

package/src/data/SupabaseDataProvider.ts

@@ -0,0 +1,125 @@
+import type { IDataProvider, IEventSink, IPlatformProjectGrantStore } from '@selvajs/platform';
+import { ProviderError } from '@selvajs/platform';
+import type { ClientBundle, BuildClientOptions } from './client.js';
+import { buildClientBundle } from './client.js';
+import { SupabaseEventSink } from './SupabaseEventSink.js';
+import { SupabaseAuditQuery } from './SupabaseAuditQuery.js';
+import { SupabaseOrgStore } from './SupabaseOrgStore.js';
+import { SupabaseProjectStore } from './SupabaseProjectStore.js';
+import { SupabaseDefinitionStore } from './SupabaseDefinitionStore.js';
+import { SupabaseInviteStore } from './SupabaseInviteStore.js';
+import { SupabaseComputeServerStore } from './SupabaseComputeServerStore.js';
+import { SupabaseShareLinkStore } from './SupabaseShareLinkStore.js';
+import { SupabaseUserProfileProvider } from '../userProfile/SupabaseUserProfileProvider.js';
+import { SupabasePlatformPermissionStore } from '../permissions/SupabasePlatformPermissionStore.js';
+
+/**
+ * Stub until the Supabase implementation lands. Reads and mutations surface a
+ * clear 501; cascade hooks are silent no-ops so deleting an org or project on
+ * a Supabase deployment without the feature wired does not blow up.
+ */
+const NOT_IMPLEMENTED_MSG = 'Platform projects are not supported on this deployment yet.';
+const notImplementedGrantStore: IPlatformProjectGrantStore = {
+	listByProject: async () => {
+		throw new ProviderError(NOT_IMPLEMENTED_MSG, 501);
+	},
+	create: async () => {
+		throw new ProviderError(NOT_IMPLEMENTED_MSG, 501);
+	},
+	delete: async () => {
+		throw new ProviderError(NOT_IMPLEMENTED_MSG, 501);
+	},
+	deleteByProject: async () => {
+		// No-op: nothing to clean up on a deployment that never accepted grants.
+	},
+	deleteByGranteeOrg: async () => {
+		// No-op: same reasoning.
+	}
+};
+
+/**
+ * Composition of every data store for the Supabase backend. Instantiates one
+ * `ClientBundle` (service-role + per-request factory) and wires each store
+ * against it so every store in a single process shares the same pooled clients.
+ */
+export class SupabaseDataProvider implements IDataProvider {
+	readonly orgs: SupabaseOrgStore;
+	readonly projects: SupabaseProjectStore;
+	readonly definitions: SupabaseDefinitionStore;
+	readonly invites: SupabaseInviteStore;
+	readonly computeServer: SupabaseComputeServerStore;
+	readonly shareLinks: SupabaseShareLinkStore;
+	readonly userProfile: SupabaseUserProfileProvider;
+	readonly permissions: SupabasePlatformPermissionStore;
+	readonly platformProjectGrants: IPlatformProjectGrantStore;
+	readonly auditQuery: SupabaseAuditQuery;
+
+	private constructor(
+		private readonly clients: ClientBundle,
+		events: IEventSink
+	) {
+		this.orgs = new SupabaseOrgStore(clients, events);
+		this.projects = new SupabaseProjectStore(clients, events);
+		this.definitions = new SupabaseDefinitionStore(clients, events);
+		this.invites = new SupabaseInviteStore(clients, events);
+		this.computeServer = new SupabaseComputeServerStore(clients);
+		this.shareLinks = new SupabaseShareLinkStore(clients, events);
+		this.userProfile = new SupabaseUserProfileProvider(clients);
+		this.permissions = new SupabasePlatformPermissionStore(clients);
+		this.platformProjectGrants = notImplementedGrantStore;
+		this.auditQuery = new SupabaseAuditQuery(clients);
+	}
+
+	static fromEnv(
+		env: Record<string, string | undefined>,
+		events?: IEventSink
+	): SupabaseDataProvider {
+		const supabaseUrl = env.SUPABASE_URL;
+		const anonKey = env.SUPABASE_ANON_KEY;
+		const serviceRoleKey = env.SUPABASE_SERVICE_ROLE_KEY;
+		if (!supabaseUrl) throw new Error('Missing required env var: SUPABASE_URL');
+		if (!anonKey) throw new Error('Missing required env var: SUPABASE_ANON_KEY');
+		if (!serviceRoleKey) throw new Error('Missing required env var: SUPABASE_SERVICE_ROLE_KEY');
+		const bundle = buildClientBundle({ supabaseUrl, anonKey, serviceRoleKey });
+		return new SupabaseDataProvider(bundle, events ?? new SupabaseEventSink(bundle));
+	}
+
+	static create(opts: BuildClientOptions, events?: IEventSink): SupabaseDataProvider {
+		const bundle = buildClientBundle(opts);
+		return new SupabaseDataProvider(bundle, events ?? new SupabaseEventSink(bundle));
+	}
+
+	/**
+	 * Build from a pre-existing `ClientBundle`. Useful for tests or advanced
+	 * cases that need to inject a custom event sink or share a bundle externally.
+	 */
+	static fromBundle(bundle: ClientBundle, events?: IEventSink): SupabaseDataProvider {
+		return new SupabaseDataProvider(bundle, events ?? new SupabaseEventSink(bundle));
+	}
+
+	/**
+	 * Expose the underlying bundle so other providers in the same package
+	 * (storage, user profile, auth) can share one set of clients per process.
+	 */
+	getClientBundle(): ClientBundle {
+		return this.clients;
+	}
+
+	/**
+	 * No-op: `public.user_profiles` is auto-seeded by the `handle_new_auth_user`
+	 * trigger on every `auth.users` insert (see `0001_initial.sql`). The data
+	 * layer always has a row for any authenticated user without per-request work.
+	 */
+	async ensureUser(): Promise<void> {
+		// Trigger handles it.
+	}
+
+	/**
+	 * No-op: `public.user_profiles.user_id` references `auth.users(id)` with
+	 * `on delete cascade`. Deleting the auth user removes the profile row
+	 * automatically.
+	 */
+	async onUserDeleted(): Promise<void> {
+		// FK cascade handles it.
+	}
+}