@selvajs/supabase-provider 0.14.3 → 0.14.4-beta.0

package/src/data/SupabaseDefinitionStore.ts

@@ -12,9 +12,18 @@ import type {
 	Page,
 	UISchema
 } from '@selvajs/platform';
-import { ProviderError, auditSoftDelete, actorFrom, NoopEventSink } from '@selvajs/platform';
+import { ProviderError, actorFrom, NoopEventSink } from '@selvajs/platform';
 import type { ClientBundle } from './client.js';
+import { mapPostgrestError } from './errors.js';
 import { nextCursorFromRange, toRange } from './pagination.js';
+import { stampSoftDelete, stampUpdate } from './rowStamp.js';
+
+/** Explicit column list for `definitions` — every field `rowToRecord` consumes. */
+const DEFINITION_COLUMNS =
+	'guid, project_id, owner_id, created_by, updated_by, compute_server_id, display_name, description, category, tags, cover_image, status, run_count, live_version_id, draft_version_id, created_at, updated_at, deleted_at';
+/** Explicit column list for `definition_versions` — every field `rowToVersion` consumes. */
+const DEFINITION_VERSION_COLUMNS =
+	'id, definition_guid, version_number, file_ext, file_key, original_filename, uploaded_by, uploaded_at, change_note, schema, schema_extracted_at';
 
 /**
  * Definition metadata + version store backed by Postgres. Spec §6 versioning:
@@ -23,7 +32,7 @@ import { nextCursorFromRange, toRange } from './pagination.js';
  *
  * Deletion protection (§6) is enforced by FK constraints — `live_version_id`
  * and `draft_version_id` are ON DELETE RESTRICT. Trying to delete a
- * referenced version raises 23503 which `mapError` turns into a 409.
+ * referenced version raises 23503 which `mapPostgrestError` turns into a 409.
  *
  * `incrementSolveCount` uses a SQL function for atomic UPDATE — no
  * read-modify-write race like the local provider has.
@@ -69,27 +78,27 @@ export class SupabaseDefinitionStore implements IDefinitionStore {
 		const range = toRange(opts);
 		const direction = opts?.orderDir ?? 'desc';
 
+		// The public path embeds `project` to filter on its visibility/org; the
+		// non-public path selects the definition columns alone. Pick the select
+		// string up front so there's a single `.select()` call and the builder
+		// keeps one type across both branches.
+		const selectColumns = filter?.publicOnly
+			? `${DEFINITION_COLUMNS}, project:projects!inner(visibility, org_id)`
+			: DEFINITION_COLUMNS;
+
 		let query = this.clients
 			.forRequest(ctx)
 			.from('definitions')
-			.select('*', { count: 'exact' })
+			.select(selectColumns, { count: 'exact' })
 			.is('deleted_at', null);
 
-		if (filter?.projectId) query = query.eq('project_id', filter.projectId);
-
 		if (filter?.publicOnly) {
-			query = this.clients
-				.forRequest(ctx)
-				.from('definitions')
-				.select('*, project:projects!inner(visibility, org_id)', {
-					count: 'exact'
-				})
-				.is('deleted_at', null)
-				.eq('project.visibility', 'public');
+			query = query.eq('project.visibility', 'public');
 			if (filter.orgId) query = query.eq('project.org_id', filter.orgId);
-			if (filter.projectId) query = query.eq('project_id', filter.projectId);
 		}
 
+		if (filter?.projectId) query = query.eq('project_id', filter.projectId);
+
 		if (opts?.statuses?.length) {
 			query = query.in('status', opts.statuses);
 		} else {
@@ -106,8 +115,11 @@ export class SupabaseDefinitionStore implements IDefinitionStore {
 			.range(range.from, range.to);
 
 		const { data, error, count } = await query;
-		if (error) throw mapError(error);
-		const items = (data ?? []).map(rowToRecord);
+		if (error) throw mapPostgrestError(error);
+		// `data` is typed against the dynamic select string, which the PostgREST
+		// parser can't resolve to a row shape; the definition columns are all
+		// present regardless, so map through the known `DefinitionRow`.
+		const items = ((data ?? []) as unknown as DefinitionRow[]).map(rowToRecord);
 		return { items, nextCursor: nextCursorFromRange(range, items.length, count) };
 	}
 
@@ -115,11 +127,11 @@ export class SupabaseDefinitionStore implements IDefinitionStore {
 		const { data, error } = await this.clients
 			.forRequest(ctx)
 			.from('definitions')
-			.select('*')
+			.select(DEFINITION_COLUMNS)
 			.eq('guid', guid)
 			.is('deleted_at', null)
 			.maybeSingle();
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		return data ? rowToRecord(data) : null;
 	}
 
@@ -128,7 +140,7 @@ export class SupabaseDefinitionStore implements IDefinitionStore {
 			.forRequest(ctx)
 			.from('definitions')
 			.insert(recordToRow(record));
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		await this.events.emit({
 			type: 'definition.created',
 			definitionId: record.guid,
@@ -140,7 +152,7 @@ export class SupabaseDefinitionStore implements IDefinitionStore {
 	async update(ctx: RequestContext, guid: string, patch: DefinitionRecordPatch): Promise<void> {
 		const row = patchToRow(patch);
 		if (Object.keys(row).length === 0) return;
-		if (ctx.userId) row.updated_by = ctx.userId;
+		Object.assign(row, stampUpdate(ctx));
 
 		const { data, error } = await this.clients
 			.forRequest(ctx)
@@ -149,7 +161,7 @@ export class SupabaseDefinitionStore implements IDefinitionStore {
 			.eq('guid', guid)
 			.is('deleted_at', null)
 			.select('guid');
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		if (!data || data.length === 0) throw new ProviderError(`Definition '${guid}' not found`, 404);
 	}
 
@@ -157,19 +169,13 @@ export class SupabaseDefinitionStore implements IDefinitionStore {
 		// Soft-delete (matches the local provider and spec §9). A retention
 		// sweep running as service-role hard-deletes later, which cascades
 		// versions + share_links via FK.
-		const stamp = auditSoftDelete(ctx, ctx.userId);
-		const row: Record<string, unknown> = {
-			deleted_at: stamp.deletedAt,
-			updated_at: stamp.updatedAt
-		};
-		if (stamp.updatedBy) row.updated_by = stamp.updatedBy;
 		const { error } = await this.clients
 			.forRequest(ctx)
 			.from('definitions')
-			.update(row)
+			.update(stampSoftDelete(ctx))
 			.eq('guid', guid)
 			.is('deleted_at', null);
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		await this.events.emit({
 			type: 'definition.deleted',
 			definitionId: guid,
@@ -177,9 +183,31 @@ export class SupabaseDefinitionStore implements IDefinitionStore {
 		});
 	}
 
+	async deleteByProject(ctx: RequestContext, projectId: string): Promise<void> {
+		// Cascade from `deleteProject` — soft-delete every live definition in the
+		// project in one statement. `select('guid')` returns the affected rows so
+		// we can emit a `definition.deleted` per record (parity with the local
+		// provider and the single-`delete` path above).
+		const { data, error } = await this.clients
+			.forRequest(ctx)
+			.from('definitions')
+			.update(stampSoftDelete(ctx))
+			.eq('project_id', projectId)
+			.is('deleted_at', null)
+			.select('guid');
+		if (error) throw mapPostgrestError(error);
+		for (const row of data ?? []) {
+			await this.events.emit({
+				type: 'definition.deleted',
+				definitionId: row.guid,
+				actorId: actorFrom(ctx)
+			});
+		}
+	}
+
 	async incrementSolveCount(ctx: RequestContext, guid: string): Promise<void> {
 		const { error } = await this.clients.forRequest(ctx).rpc('increment_run_count', { g: guid });
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 	}
 
 	// ============================================================================
@@ -191,7 +219,7 @@ export class SupabaseDefinitionStore implements IDefinitionStore {
 			.forRequest(ctx)
 			.from('definition_versions')
 			.insert(versionToRow(version));
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		await this.events.emit({
 			type: 'definition_version.created',
 			versionId: version.id,
@@ -209,11 +237,11 @@ export class SupabaseDefinitionStore implements IDefinitionStore {
 		const { data, error, count } = await this.clients
 			.forRequest(ctx)
 			.from('definition_versions')
-			.select('*', { count: 'exact' })
+			.select(DEFINITION_VERSION_COLUMNS, { count: 'exact' })
 			.eq('definition_guid', definitionId)
 			.order('version_number', { ascending: false })
 			.range(range.from, range.to);
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		const items = (data ?? []).map(rowToVersion);
 		return { items, nextCursor: nextCursorFromRange(range, items.length, count) };
 	}
@@ -222,10 +250,10 @@ export class SupabaseDefinitionStore implements IDefinitionStore {
 		const { data, error } = await this.clients
 			.forRequest(ctx)
 			.from('definition_versions')
-			.select('*')
+			.select(DEFINITION_VERSION_COLUMNS)
 			.eq('id', versionId)
 			.maybeSingle();
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		return data ? rowToVersion(data) : null;
 	}
 
@@ -235,19 +263,19 @@ export class SupabaseDefinitionStore implements IDefinitionStore {
 			.from('definition_versions')
 			.update({ schema, schema_extracted_at: new Date().toISOString() })
 			.eq('id', versionId);
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 	}
 
 	async deleteVersion(ctx: RequestContext, versionId: string): Promise<void> {
 		// FK enforcement at the DB layer: live_version_id / draft_version_id
 		// are ON DELETE RESTRICT. If the version is referenced by either
-		// channel, Postgres raises 23503 → mapError → ProviderError(409).
+		// channel, Postgres raises 23503 → mapPostgrestError → ProviderError(409).
 		const { error } = await this.clients
 			.forRequest(ctx)
 			.from('definition_versions')
 			.delete()
 			.eq('id', versionId);
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		await this.events.emit({
 			type: 'definition_version.deleted',
 			versionId,
@@ -293,7 +321,7 @@ export class SupabaseDefinitionStore implements IDefinitionStore {
 			.select('id, definition_guid')
 			.eq('id', versionId)
 			.maybeSingle();
-		if (vError) throw mapError(vError);
+		if (vError) throw mapPostgrestError(vError);
 		if (!version || version.definition_guid !== definitionId) {
 			throw new ProviderError(`Version '${versionId}' not found for this definition`, 404);
 		}
@@ -303,9 +331,9 @@ export class SupabaseDefinitionStore implements IDefinitionStore {
 		const row: Record<string, unknown> = {
 			live_version_id: versionId,
 			draft_version_id: versionId,
-			status: 'draft'
+			status: 'draft',
+			...stampUpdate(ctx)
 		};
-		if (ctx.userId) row.updated_by = ctx.userId;
 
 		const { data, error } = await client
 			.from('definitions')
@@ -313,7 +341,7 @@ export class SupabaseDefinitionStore implements IDefinitionStore {
 			.eq('guid', definitionId)
 			.is('deleted_at', null)
 			.select('guid');
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		if (!data || data.length === 0) {
 			throw new ProviderError(`Definition '${definitionId}' not found`, 404);
 		}
@@ -333,20 +361,19 @@ export class SupabaseDefinitionStore implements IDefinitionStore {
 			.select('id, definition_guid')
 			.eq('id', versionId)
 			.maybeSingle();
-		if (vError) throw mapError(vError);
+		if (vError) throw mapPostgrestError(vError);
 		if (!version || version.definition_guid !== definitionId) {
 			throw new ProviderError(`Version '${versionId}' not found for this definition`, 404);
 		}
 
-		const row: Record<string, unknown> = { [column]: versionId };
-		if (ctx.userId) row.updated_by = ctx.userId;
+		const row: Record<string, unknown> = { [column]: versionId, ...stampUpdate(ctx) };
 		const { data, error } = await client
 			.from('definitions')
 			.update(row)
 			.eq('guid', definitionId)
 			.is('deleted_at', null)
 			.select('guid');
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		if (!data || data.length === 0) {
 			throw new ProviderError(`Definition '${definitionId}' not found`, 404);
 		}
@@ -498,23 +525,3 @@ function definitionOrderColumn(orderBy: DefinitionListOptions['orderBy'] | undef
 			return 'created_at';
 	}
 }
-
-interface PostgrestError {
-	code?: string;
-	message?: string;
-}
-
-function mapError(e: unknown): Error {
-	const pg = e as PostgrestError;
-	if (pg?.code === '23505') return new ProviderError(pg.message ?? 'Duplicate record', 409);
-	if (pg?.code === '23503') return new ProviderError(pg.message ?? 'Foreign key violation', 409);
-	if (e instanceof Error) return e;
-	if (e && typeof e === 'object') {
-		const obj = e as { message?: string; details?: string; hint?: string; code?: string };
-		const msg = obj.message ?? obj.details ?? obj.hint ?? 'Unknown Postgres error';
-		const err = new Error(obj.code ? `[${obj.code}] ${msg}` : msg);
-		Object.assign(err, obj);
-		return err;
-	}
-	return new Error(String(e));
-}

package/src/data/SupabaseInviteStore.ts

@@ -6,10 +6,15 @@ import type {
 	ListOptions,
 	Page
 } from '@selvajs/platform';
-import { NoopEventSink, ProviderError, actorFrom } from '@selvajs/platform';
+import { NoopEventSink, actorFrom } from '@selvajs/platform';
 import type { ClientBundle } from './client.js';
+import { mapPostgrestError } from './errors.js';
 import { nextCursorFromRange, toRange } from './pagination.js';
 
+/** Explicit column list for `invites` — every field `rowToInvite` consumes. */
+const INVITE_COLUMNS =
+	'id, token_hash, email, org_id, org_role, org_permissions, invited_by, created_at, expires_at, accepted_at, accepted_by_user_id';
+
 /**
  * Invite store. `getByTokenHash` routes through a SECURITY DEFINER RPC so
  * unauthenticated / just-signed-up callers can validate and consume the
@@ -29,7 +34,7 @@ export class SupabaseInviteStore implements IInviteStore {
 			.forRequest(ctx)
 			.from('invites')
 			.insert(inviteToRow(invite));
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		await this.events.emit({
 			type: 'invite.created',
 			inviteId: invite.id,
@@ -47,7 +52,7 @@ export class SupabaseInviteStore implements IInviteStore {
 		const { data, error } = await this.clients
 			.forRequest(ctx)
 			.rpc('get_invite_by_token_hash', { h: tokenHash });
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		// rpc returns the matching row (or null). PostgREST may wrap it in
 		// an array depending on the signature — normalize both shapes.
 		const row = Array.isArray(data) ? data[0] : data;
@@ -59,11 +64,11 @@ export class SupabaseInviteStore implements IInviteStore {
 		const { data, error, count } = await this.clients
 			.forRequest(ctx)
 			.from('invites')
-			.select('*', { count: 'exact' })
+			.select(INVITE_COLUMNS, { count: 'exact' })
 			.eq('org_id', orgId)
 			.order('created_at', { ascending: (opts?.orderDir ?? 'desc') === 'asc' })
 			.range(range.from, range.to);
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		const items = (data ?? []).map(rowToInvite);
 		return { items, nextCursor: nextCursorFromRange(range, items.length, count) };
 	}
@@ -78,7 +83,7 @@ export class SupabaseInviteStore implements IInviteStore {
 			.eq('id', id)
 			.is('accepted_at', null)
 			.select('org_id');
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		const row = data?.[0];
 		if (!row) return;
 		await this.events.emit({
@@ -98,7 +103,7 @@ export class SupabaseInviteStore implements IInviteStore {
 			.eq('id', id)
 			.is('accepted_at', null)
 			.select('org_id');
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 		const row = data?.[0];
 		if (!row) return;
 		await this.events.emit({
@@ -115,7 +120,7 @@ export class SupabaseInviteStore implements IInviteStore {
 			.from('invites')
 			.delete()
 			.eq('org_id', orgId);
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 	}
 }
 
@@ -164,20 +169,3 @@ function inviteToRow(i: Invite): InviteRow {
 		accepted_by_user_id: i.acceptedByUserId ?? null
 	};
 }
-
-interface PostgrestError {
-	code?: string;
-	message?: string;
-}
-
-function mapError(e: unknown): Error {
-	const pg = e as PostgrestError;
-	if (pg?.code === '23505') return new ProviderError(pg.message ?? 'Duplicate record', 409);
-	if (pg?.code === '23503') return new ProviderError(pg.message ?? 'Foreign key violation', 409);
-	if (e instanceof Error) return e;
-	if (e && typeof e === 'object') {
-		const obj = e as { message?: string; code?: string };
-		return new Error(obj.code ? `[${obj.code}] ${obj.message ?? ''}` : (obj.message ?? String(e)));
-	}
-	return new Error(String(e));
-}