@selvajs/supabase-provider 0.14.3 → 0.14.4-beta.1

package/src/data/SupabaseProjectStore.ts

@@ -1,454 +0,0 @@
-import type {
-	IProjectStore,
-	IEventSink,
-	Project,
-	ProjectMember,
-	ProjectRole,
-	RequestContext,
-	ListOptions,
-	Page
-} from '@selvajs/platform';
-import { ProviderError, auditSoftDelete, actorFrom, NoopEventSink } from '@selvajs/platform';
-import type { ClientBundle } from './client.js';
-import { nextCursorFromRange, orderColumn, toRange } from './pagination.js';
-
-/**
- * Project + project-membership store backed by Postgres. Visibility semantics
- * (public / org / private) are enforced by the `visible_project()` helper in
- * RLS. Access predicates (canEdit / canManage / canView etc.) live as pure
- * functions in `@selvajs/platform/access`; the route layer composes them with
- * pre-loaded entities. See `packages/selva/src/lib/server/access.server.ts`.
- *
- * `createProject` atomically seeds the creator as the project `owner` in
- * `project_members` so subsequent user-scoped reads can see it.
- */
-export class SupabaseProjectStore implements IProjectStore {
-	private readonly events: IEventSink;
-
-	constructor(
-		private readonly clients: ClientBundle,
-		events: IEventSink = new NoopEventSink()
-	) {
-		this.events = events;
-	}
-
-	async listProjects(
-		ctx: RequestContext,
-		orgId: string,
-		opts?: ListOptions
-	): Promise<Page<Project>> {
-		const range = toRange(opts);
-		const direction = opts?.orderDir ?? 'desc';
-		const { data, error, count } = await this.clients
-			.forRequest(ctx)
-			.from('projects')
-			.select('*', { count: 'exact' })
-			.eq('org_id', orgId)
-			.is('deleted_at', null)
-			.order(orderColumn(opts?.orderBy), { ascending: direction === 'asc' })
-			.range(range.from, range.to);
-		if (error) throw mapError(error);
-		const items = (data ?? []).map(rowToProject);
-		return { items, nextCursor: nextCursorFromRange(range, items.length, count) };
-	}
-
-	async getProject(ctx: RequestContext, id: string): Promise<Project | null> {
-		const { data, error } = await this.clients
-			.forRequest(ctx)
-			.from('projects')
-			.select('*')
-			.eq('id', id)
-			.is('deleted_at', null)
-			.maybeSingle();
-		if (error) throw mapError(error);
-		return data ? rowToProject(data) : null;
-	}
-
-	async getProjectBySlug(
-		ctx: RequestContext,
-		orgId: string,
-		slug: string
-	): Promise<Project | null> {
-		const { data, error } = await this.clients
-			.forRequest(ctx)
-			.from('projects')
-			.select('*')
-			.eq('org_id', orgId)
-			.eq('slug', slug)
-			.is('deleted_at', null)
-			.maybeSingle();
-		if (error) throw mapError(error);
-		return data ? rowToProject(data) : null;
-	}
-
-	async createProject(ctx: RequestContext, project: Project): Promise<void> {
-		const client = this.clients.forRequest(ctx);
-		const { error } = await client.from('projects').insert(projectToRow(project));
-		if (error) throw mapError(error);
-
-		// Seed owner membership so user-scoped reads see the project post-create.
-		// Upsert so a stale soft-deleted row from a prior project with the same id
-		// is reactivated rather than blocking creation.
-		const { error: memberError } = await client.from('project_members').upsert(
-			{
-				project_id: project.id,
-				user_id: project.ownerId,
-				role: 'owner',
-				joined_at: new Date().toISOString(),
-				deleted_at: null
-			},
-			{ onConflict: 'project_id,user_id' }
-		);
-		if (memberError) throw mapError(memberError);
-		await this.events.emit({
-			type: 'project.created',
-			projectId: project.id,
-			orgId: project.orgId,
-			actorId: actorFrom(ctx)
-		});
-	}
-
-	async updateProject(
-		ctx: RequestContext,
-		id: string,
-		patch: Partial<
-			Pick<Project, 'name' | 'slug' | 'description' | 'visibility' | 'autoJoinOnUpload'>
-		>
-	): Promise<void> {
-		const row: Record<string, unknown> = {};
-		if (patch.name !== undefined) row.name = patch.name;
-		if (patch.slug !== undefined) row.slug = patch.slug;
-		if (patch.description !== undefined) row.description = patch.description;
-		if (patch.visibility !== undefined) row.visibility = patch.visibility;
-		if (patch.autoJoinOnUpload !== undefined) row.auto_join_on_upload = patch.autoJoinOnUpload;
-		if (Object.keys(row).length === 0) return;
-		if (ctx.userId) row.updated_by = ctx.userId;
-
-		const { data, error } = await this.clients
-			.forRequest(ctx)
-			.from('projects')
-			.update(row)
-			.eq('id', id)
-			.is('deleted_at', null)
-			.select('id');
-		if (error) throw mapError(error);
-		if (!data || data.length === 0) throw new ProviderError(`Project '${id}' not found`, 404);
-	}
-
-	async deleteProject(ctx: RequestContext, id: string): Promise<void> {
-		// §9 soft-delete with cascade. Mirrors LocalProjectStore: project →
-		// project_members, definitions. FK CASCADE doesn't fire on soft-delete,
-		// so the cascade is in app code.
-		const client = this.clients.forRequest(ctx);
-		const stamp = auditSoftDelete(ctx, ctx.userId);
-		const stampRow = stampToRow(stamp);
-
-		const { data, error } = await client
-			.from('projects')
-			.update(stampRow)
-			.eq('id', id)
-			.is('deleted_at', null)
-			.select('id');
-		if (error) throw mapError(error);
-		if (!data || data.length === 0) throw new ProviderError(`Project '${id}' not found`, 404);
-
-		const { error: pmErr } = await client
-			.from('project_members')
-			.update(stampRow)
-			.eq('project_id', id)
-			.is('deleted_at', null);
-		if (pmErr) throw mapError(pmErr);
-
-		const { error: defErr } = await client
-			.from('definitions')
-			.update(stampRow)
-			.eq('project_id', id)
-			.is('deleted_at', null);
-		if (defErr) throw mapError(defErr);
-
-		await this.events.emit({ type: 'project.deleted', projectId: id, actorId: actorFrom(ctx) });
-	}
-
-	async reactivateProject(
-		ctx: RequestContext,
-		orgId: string,
-		slug: string
-	): Promise<Project | null> {
-		const client = this.clients.forRequest(ctx);
-
-		// Clear the tombstone. The WHERE deleted_at IS NOT NULL ensures we never
-		// accidentally clobber a live row, and the unique constraint means there
-		// can be at most one tombstone per (org_id, slug) at any time.
-		const { data, error } = await client
-			.from('projects')
-			.update({ deleted_at: null })
-			.eq('org_id', orgId)
-			.eq('slug', slug)
-			.not('deleted_at', 'is', null)
-			.select('*')
-			.maybeSingle();
-		if (error) throw mapError(error);
-		if (!data) return null;
-
-		// Reactivate the owner's project_members row (deleteProject cascades to it).
-		const { error: pmErr } = await client
-			.from('project_members')
-			.update({ deleted_at: null })
-			.eq('project_id', data.id)
-			.eq('user_id', data.owner_id)
-			.not('deleted_at', 'is', null);
-		if (pmErr) throw mapError(pmErr);
-
-		const project = rowToProject(data);
-		await this.events.emit({
-			type: 'project.created',
-			projectId: project.id,
-			orgId: project.orgId,
-			actorId: actorFrom(ctx)
-		});
-		return project;
-	}
-
-	// ============================================================================
-	// Project members
-	// ============================================================================
-	async listProjectMembers(
-		ctx: RequestContext,
-		projectId: string,
-		opts?: ListOptions
-	): Promise<Page<ProjectMember>> {
-		const range = toRange(opts);
-		const { data, error, count } = await this.clients
-			.forRequest(ctx)
-			.from('project_members')
-			.select('*', { count: 'exact' })
-			.eq('project_id', projectId)
-			.is('deleted_at', null)
-			.order('joined_at', { ascending: (opts?.orderDir ?? 'desc') === 'asc' })
-			.range(range.from, range.to);
-		if (error) throw mapError(error);
-		const items = (data ?? []).map(rowToProjectMember);
-		return { items, nextCursor: nextCursorFromRange(range, items.length, count) };
-	}
-
-	async getProjectMember(
-		ctx: RequestContext,
-		projectId: string,
-		userId: string
-	): Promise<ProjectMember | null> {
-		const { data, error } = await this.clients
-			.forRequest(ctx)
-			.from('project_members')
-			.select('*')
-			.eq('project_id', projectId)
-			.eq('user_id', userId)
-			.is('deleted_at', null)
-			.maybeSingle();
-		if (error) throw mapError(error);
-		return data ? rowToProjectMember(data) : null;
-	}
-
-	async addProjectMember(ctx: RequestContext, member: ProjectMember): Promise<void> {
-		// Upsert reactivates a prior soft-deleted row instead of throwing
-		// duplicate-key. Mirrors LocalProjectStore.addProjectMember.
-		const row: Record<string, unknown> = {
-			...projectMemberToRow(member),
-			deleted_at: null
-		};
-		if (ctx.userId) row.updated_by = ctx.userId;
-		const { error } = await this.clients
-			.forRequest(ctx)
-			.from('project_members')
-			.upsert(row, { onConflict: 'project_id,user_id' });
-		if (error) throw mapError(error);
-		await this.events.emit({
-			type: 'project_member.added',
-			projectId: member.projectId,
-			userId: member.userId,
-			actorId: actorFrom(ctx)
-		});
-	}
-
-	async updateProjectMemberRole(
-		ctx: RequestContext,
-		projectId: string,
-		userId: string,
-		role: ProjectRole
-	): Promise<void> {
-		const row: Record<string, unknown> = { role };
-		if (ctx.userId) row.updated_by = ctx.userId;
-		const { data, error } = await this.clients
-			.forRequest(ctx)
-			.from('project_members')
-			.update(row)
-			.eq('project_id', projectId)
-			.eq('user_id', userId)
-			.is('deleted_at', null)
-			.select('user_id');
-		if (error) throw mapError(error);
-		if (!data || data.length === 0)
-			throw new ProviderError(`Project member '${userId}' not found`, 404);
-		await this.events.emit({
-			type: 'project_member.role_changed',
-			projectId,
-			userId,
-			role,
-			actorId: actorFrom(ctx)
-		});
-	}
-
-	async removeProjectMember(ctx: RequestContext, projectId: string, userId: string): Promise<void> {
-		const stamp = auditSoftDelete(ctx, ctx.userId);
-		const { error } = await this.clients
-			.forRequest(ctx)
-			.from('project_members')
-			.update(stampToRow(stamp))
-			.eq('project_id', projectId)
-			.eq('user_id', userId)
-			.is('deleted_at', null);
-		if (error) throw mapError(error);
-		await this.events.emit({
-			type: 'project_member.removed',
-			projectId,
-			userId,
-			actorId: actorFrom(ctx)
-		});
-	}
-}
-
-// ============================================================================
-// Row ↔ domain mappers
-// ============================================================================
-//
-// Audit columns (`created_by` / `updated_by`) FK to `auth.users(id)` with
-// `ON DELETE SET NULL`; they can legitimately become NULL when the user is
-// deleted (spec §8). Mappers fall back to `owner_id` so the domain type
-// stays non-nullable. Also true for ProjectMember audit columns below.
-// that haven't applied the latest migration — the mapper falls back to
-// owner_id / user_id / joined_at in those cases.
-
-interface ProjectRow {
-	id: string;
-	org_id: string;
-	name: string;
-	slug: string;
-	description: string | null;
-	visibility: Project['visibility'];
-	owner_id: string;
-	created_by?: string | null;
-	updated_by?: string | null;
-	auto_join_on_upload?: boolean | null;
-	created_at: string;
-	updated_at: string;
-	deleted_at?: string | null;
-}
-
-interface ProjectMemberRow {
-	project_id: string;
-	user_id: string;
-	role: ProjectRole;
-	joined_at: string;
-	updated_at?: string | null;
-	updated_by?: string | null;
-	deleted_at?: string | null;
-}
-
-function rowToProject(row: ProjectRow): Project {
-	return {
-		id: row.id,
-		orgId: row.org_id,
-		name: row.name,
-		slug: row.slug,
-		description: row.description ?? undefined,
-		visibility: row.visibility,
-		ownerId: row.owner_id,
-		createdBy: row.created_by ?? row.owner_id,
-		updatedBy: row.updated_by ?? row.owner_id,
-		autoJoinOnUpload: row.auto_join_on_upload ?? false,
-		createdAt: row.created_at,
-		updatedAt: row.updated_at,
-		deletedAt: row.deleted_at ?? null
-	};
-}
-
-function projectToRow(p: Project): ProjectRow {
-	return {
-		id: p.id,
-		org_id: p.orgId,
-		name: p.name,
-		slug: p.slug,
-		description: p.description ?? null,
-		visibility: p.visibility,
-		owner_id: p.ownerId,
-		created_by: p.createdBy,
-		updated_by: p.updatedBy,
-		auto_join_on_upload: p.autoJoinOnUpload,
-		created_at: p.createdAt,
-		updated_at: p.updatedAt,
-		deleted_at: p.deletedAt ?? null
-	};
-}
-
-function rowToProjectMember(row: ProjectMemberRow): ProjectMember {
-	return {
-		projectId: row.project_id,
-		userId: row.user_id,
-		role: row.role,
-		joinedAt: row.joined_at,
-		updatedAt: row.updated_at ?? row.joined_at,
-		updatedBy: row.updated_by ?? row.user_id,
-		deletedAt: row.deleted_at ?? null
-	};
-}
-
-function projectMemberToRow(m: ProjectMember): ProjectMemberRow {
-	return {
-		project_id: m.projectId,
-		user_id: m.userId,
-		role: m.role,
-		joined_at: m.joinedAt
-	};
-}
-
-// ============================================================================
-// Error translation
-// ============================================================================
-interface PostgrestError {
-	code?: string;
-	message?: string;
-}
-
-/**
- * Build a row payload from an audit-soft-delete stamp. `updated_by` only goes
- * into the row when ctx.userId is set — passing `''` would violate the
- * `references auth.users(id)` FK on system contexts. The DB trigger sets
- * `updated_at`, but for soft-delete we set it explicitly so it matches
- * `deleted_at` (single timestamp for the deletion event).
- */
-function stampToRow(stamp: {
-	updatedAt: string;
-	updatedBy: string;
-	deletedAt: string;
-}): Record<string, unknown> {
-	const row: Record<string, unknown> = {
-		deleted_at: stamp.deletedAt,
-		updated_at: stamp.updatedAt
-	};
-	if (stamp.updatedBy) row.updated_by = stamp.updatedBy;
-	return row;
-}
-
-function mapError(e: unknown): Error {
-	const pg = e as PostgrestError;
-	if (pg?.code === '23505') return new ProviderError(pg.message ?? 'Duplicate record', 409);
-	if (pg?.code === '23503') return new ProviderError(pg.message ?? 'Foreign key violation', 409);
-	if (e instanceof Error) return e;
-	if (e && typeof e === 'object') {
-		const obj = e as { message?: string; details?: string; hint?: string; code?: string };
-		const msg = obj.message ?? obj.details ?? obj.hint ?? 'Unknown Postgres error';
-		const err = new Error(obj.code ? `[${obj.code}] ${msg}` : msg);
-		Object.assign(err, obj);
-		return err;
-	}
-	return new Error(String(e));
-}

package/src/data/SupabaseShareLinkStore.ts

@@ -1,191 +0,0 @@
-import type {
-	IShareLinkStore,
-	IEventSink,
-	ShareLink,
-	RequestContext,
-	ListOptions,
-	Page
-} from '@selvajs/platform';
-import { ProviderError, actorFrom, NoopEventSink } from '@selvajs/platform';
-import type { ClientBundle } from './client.js';
-import { nextCursorFromRange, toRange } from './pagination.js';
-
-/**
- * Spec §7 — share-link store backed by Postgres.
- *
- * Token resolution (`getByTokenHash`) and atomic increment use the
- * SECURITY DEFINER `try_increment_share_link_solve_count` RPC + service-
- * role client to bypass RLS — the token IS the credential, not the
- * authenticated user identity.
- *
- * `tryIncrementSolveCount` returns a single number on success or null when
- * the cap is hit. The RPC enforces "increment iff under cap and live" in
- * one statement, so even concurrent solves can't overshoot the cap.
- */
-export class SupabaseShareLinkStore implements IShareLinkStore {
-	private readonly events: IEventSink;
-
-	constructor(
-		private readonly clients: ClientBundle,
-		events: IEventSink = new NoopEventSink()
-	) {
-		this.events = events;
-	}
-
-	async create(ctx: RequestContext, link: ShareLink): Promise<void> {
-		const { error } = await this.clients
-			.forRequest(ctx)
-			.from('share_links')
-			.insert(linkToRow(link));
-		if (error) throw mapError(error);
-		await this.events.emit({
-			type: 'share_link.minted',
-			linkId: link.id,
-			definitionId: link.definitionId,
-			actorId: actorFrom(ctx)
-		});
-	}
-
-	async listByDefinition(
-		ctx: RequestContext,
-		definitionId: string,
-		opts?: ListOptions
-	): Promise<Page<ShareLink>> {
-		const range = toRange(opts);
-		const { data, error, count } = await this.clients
-			.forRequest(ctx)
-			.from('share_links')
-			.select('*', { count: 'exact' })
-			.eq('definition_guid', definitionId)
-			.is('revoked_at', null)
-			.order('created_at', { ascending: false })
-			.range(range.from, range.to);
-		if (error) throw mapError(error);
-		const items = (data ?? []).map(rowToLink);
-		return { items, nextCursor: nextCursorFromRange(range, items.length, count) };
-	}
-
-	async getById(ctx: RequestContext, id: string): Promise<ShareLink | null> {
-		const { data, error } = await this.clients
-			.forRequest(ctx)
-			.from('share_links')
-			.select('*')
-			.eq('id', id)
-			.maybeSingle();
-		if (error) throw mapError(error);
-		return data ? rowToLink(data) : null;
-	}
-
-	async getByTokenHash(_ctx: RequestContext, tokenHash: string): Promise<ShareLink | null> {
-		// Service-role: token resolution must work for anonymous requests too.
-		// RLS would scope the query down to "links the current user can see"
-		// — exactly the wrong semantic for token-credentialed access.
-		const { data, error } = await this.clients.serviceClient
-			.from('share_links')
-			.select('*, definitions!inner(deleted_at)')
-			.eq('token_hash', tokenHash)
-			.is('revoked_at', null)
-			.is('definitions.deleted_at', null)
-			.maybeSingle();
-		if (error) throw mapError(error);
-		return data ? rowToLink(data) : null;
-	}
-
-	async revoke(ctx: RequestContext, id: string): Promise<void> {
-		// Idempotent: succeeds whether or not the row exists / is already
-		// revoked. The `is null` predicate on revoked_at means a re-revoke
-		// is a no-op (no row updated).
-		const { error } = await this.clients
-			.forRequest(ctx)
-			.from('share_links')
-			.update({ revoked_at: new Date().toISOString() })
-			.eq('id', id)
-			.is('revoked_at', null);
-		if (error) throw mapError(error);
-		await this.events.emit({ type: 'share_link.revoked', linkId: id, actorId: actorFrom(ctx) });
-	}
-
-	async tryIncrementSolveCount(_ctx: RequestContext, id: string): Promise<number | null> {
-		// SECURITY DEFINER RPC — bypasses RLS. Atomic check-and-increment.
-		// Returns NULL when the link is missing/revoked/expired/capped; the
-		// row update is the only way to get a numeric return.
-		const { data, error } = await this.clients.serviceClient.rpc(
-			'try_increment_share_link_solve_count',
-			{ link_id: id }
-		);
-		if (error) throw mapError(error);
-		return typeof data === 'number' ? data : null;
-	}
-}
-
-// ============================================================================
-// Row ↔ domain mappers
-// ============================================================================
-interface ShareLinkRow {
-	id: string;
-	definition_guid: string;
-	channel: 'live' | 'draft';
-	token_hash: string;
-	name: string | null;
-	created_by: string;
-	created_at: string;
-	expires_at: string | null;
-	revoked_at: string | null;
-	allow_solve: boolean;
-	max_solves: number | null;
-	solve_count: number;
-}
-
-function rowToLink(row: ShareLinkRow): ShareLink {
-	return {
-		id: row.id,
-		definitionId: row.definition_guid,
-		channel: row.channel,
-		tokenHash: row.token_hash,
-		name: row.name ?? undefined,
-		createdBy: row.created_by,
-		createdAt: row.created_at,
-		expiresAt: row.expires_at,
-		revokedAt: row.revoked_at,
-		allowSolve: row.allow_solve,
-		maxSolves: row.max_solves,
-		solveCount: row.solve_count
-	};
-}
-
-function linkToRow(l: ShareLink): Record<string, unknown> {
-	return {
-		id: l.id,
-		definition_guid: l.definitionId,
-		channel: l.channel,
-		token_hash: l.tokenHash,
-		name: l.name ?? null,
-		created_by: l.createdBy,
-		created_at: l.createdAt,
-		expires_at: l.expiresAt ?? null,
-		revoked_at: l.revokedAt ?? null,
-		allow_solve: l.allowSolve,
-		max_solves: l.maxSolves ?? null,
-		solve_count: l.solveCount
-	};
-}
-
-interface PostgrestError {
-	code?: string;
-	message?: string;
-}
-
-function mapError(e: unknown): Error {
-	const pg = e as PostgrestError;
-	if (pg?.code === '23505') return new ProviderError(pg.message ?? 'Duplicate record', 409);
-	if (pg?.code === '23503') return new ProviderError(pg.message ?? 'Foreign key violation', 409);
-	if (e instanceof Error) return e;
-	if (e && typeof e === 'object') {
-		const obj = e as { message?: string; details?: string; hint?: string; code?: string };
-		const msg = obj.message ?? obj.details ?? obj.hint ?? 'Unknown Postgres error';
-		const err = new Error(obj.code ? `[${obj.code}] ${msg}` : msg);
-		Object.assign(err, obj);
-		return err;
-	}
-	return new Error(String(e));
-}

package/src/data/SupabaseSolveMetricSink.ts

@@ -1,38 +0,0 @@
-import type { ISolveMetricSink, RequestContext, SolveMetric } from '@selvajs/platform';
-import type { ClientBundle } from './client.js';
-
-/**
- * Persists every solve's timing to `selva.solve_metrics`. Writes use the
- * service-role client so RLS does not gate the telemetry — the sink runs as a
- * system process attached to the compute route, not the requesting user.
- *
- * Per the `ISolveMetricSink` contract, `record` MUST NOT throw. It sits on the
- * hot path of every solve and the response has already been produced by the
- * time we're here, so a failed insert is logged and swallowed.
- */
-export class SupabaseSolveMetricSink implements ISolveMetricSink {
-	constructor(private readonly clients: ClientBundle) {}
-
-	async record(_ctx: RequestContext, metric: SolveMetric): Promise<void> {
-		try {
-			const { error } = await this.clients.serviceClient.from('solve_metrics').insert({
-				actor_id: _ctx.userId || 'system',
-				definition_url: metric.definitionUrl,
-				definition_id: metric.definitionId,
-				version_id: metric.versionId,
-				channel: metric.channel,
-				org_id: metric.orgId,
-				duration_ms: metric.durationMs,
-				ok: metric.ok,
-				failure_kind: metric.failureKind,
-				error_count: metric.errorCount,
-				warning_count: metric.warningCount
-			});
-			if (error) {
-				console.error('[SupabaseSolveMetricSink] insert failed:', error.message, { metric });
-			}
-		} catch (err) {
-			console.error('[SupabaseSolveMetricSink] unexpected error:', err, { metric });
-		}
-	}
-}