@selvajs/supabase-provider 0.14.3 → 0.14.4-beta.1

package/dist/storage/__tests__/conformance.test.js

@@ -1,149 +0,0 @@
-import { describe, beforeEach, it, expect } from 'vitest';
-import { createClient } from '@supabase/supabase-js';
-import { runStorageProviderConformance } from '@selvajs/platform/testing';
-import { definitionPaths } from '@selvajs/platform';
-import { SupabaseStorageProvider } from '../SupabaseStorageProvider.js';
-const SUPABASE_URL = process.env.SUPABASE_URL;
-const SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY;
-const PUBLIC_BUCKET = process.env.SUPABASE_PUBLIC_BUCKET ?? 'selva-public';
-const PRIVATE_BUCKET = process.env.SUPABASE_PRIVATE_BUCKET ?? 'selva-private';
-// The conformance suite hits a live Supabase stack. If creds aren't present
-// (e.g. in CI without Docker, or a clean clone pre-`supabase start`), skip
-// the suite with a single explanatory test so the run surfaces the reason.
-// `createClient` transitively loads `@supabase/realtime-js`, which on Node < 22
-// throws at construction without native WebSocket — treat that as "no stack"
-// rather than crashing the suite during collection.
-function tryBuildAdminClient() {
-    if (!SUPABASE_URL || !SERVICE_ROLE_KEY)
-        return null;
-    try {
-        return createClient(SUPABASE_URL, SERVICE_ROLE_KEY, {
-            auth: { persistSession: false, autoRefreshToken: false }
-        });
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        if (msg.includes('WebSocket'))
-            return null;
-        throw err;
-    }
-}
-const _adminClient = tryBuildAdminClient();
-if (_adminClient === null) {
-    describe.skip('SupabaseStorageProvider (skipped: no live stack)', () => {
-        it('populate packages/providers/supabase/.env.test with SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY (from `npx supabase start`) to run these tests', () => { });
-    });
-}
-else {
-    // Re-bind in this branch so closures below see the non-null narrowed type.
-    const adminClient = _adminClient;
-    /**
-     * Delete every object under a prefix in a bucket. The conformance suite
-     * assumes fresh state per test; Supabase Storage is shared across runs,
-     * so we reset both buckets before each test.
-     */
-    async function emptyBucket(bucket) {
-        const keys = [];
-        const stack = [''];
-        while (stack.length > 0) {
-            const dir = stack.pop();
-            const { data, error } = await adminClient.storage.from(bucket).list(dir, {
-                limit: 1000,
-                sortBy: { column: 'name', order: 'asc' }
-            });
-            if (error)
-                throw error;
-            for (const entry of data ?? []) {
-                const full = dir ? `${dir}/${entry.name}` : entry.name;
-                if (entry.id === null)
-                    stack.push(full);
-                else
-                    keys.push(full);
-            }
-        }
-        if (keys.length === 0)
-            return;
-        for (let i = 0; i < keys.length; i += 1000) {
-            const { error } = await adminClient.storage.from(bucket).remove(keys.slice(i, i + 1000));
-            if (error)
-                throw error;
-        }
-    }
-    describe('SupabaseStorageProvider', () => {
-        beforeEach(async () => {
-            await Promise.all([emptyBucket(PUBLIC_BUCKET), emptyBucket(PRIVATE_BUCKET)]);
-        });
-        runStorageProviderConformance({
-            name: 'SupabaseStorageProvider',
-            createStorage: () => new SupabaseStorageProvider({
-                supabaseUrl: SUPABASE_URL,
-                serviceRoleKey: SERVICE_ROLE_KEY,
-                publicBucket: PUBLIC_BUCKET,
-                privateBucket: PRIVATE_BUCKET
-            })
-        });
-        // ============================================================================
-        // Bucket routing — Supabase-specific (the conformance suite is provider-
-        // agnostic and can't see which bucket a file lands in). Without these tests
-        // a regex regression in `bucketFor` could silently move .gh source files
-        // into the public/CDN bucket.
-        // ============================================================================
-        describe('bucket routing', () => {
-            const storage = new SupabaseStorageProvider({
-                supabaseUrl: SUPABASE_URL,
-                serviceRoleKey: SERVICE_ROLE_KEY,
-                publicBucket: PUBLIC_BUCKET,
-                privateBucket: PRIVATE_BUCKET
-            });
-            async function existsInBucket(bucket, path) {
-                const { data, error } = await adminClient.storage.from(bucket).download(path);
-                if (error)
-                    return false;
-                return Boolean(data);
-            }
-            it('versioned .gh files land in the private bucket', async () => {
-                const guid = 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa';
-                const path = definitionPaths.version(guid, 1, 'gh');
-                await storage.put(path, new TextEncoder().encode('GH_BYTES'));
-                expect(await existsInBucket(PRIVATE_BUCKET, path)).toBe(true);
-                expect(await existsInBucket(PUBLIC_BUCKET, path)).toBe(false);
-            });
-            it('versioned .ghx files land in the private bucket', async () => {
-                const guid = 'bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb';
-                const path = definitionPaths.version(guid, 3, 'ghx');
-                await storage.put(path, new TextEncoder().encode('GHX_BYTES'));
-                expect(await existsInBucket(PRIVATE_BUCKET, path)).toBe(true);
-                expect(await existsInBucket(PUBLIC_BUCKET, path)).toBe(false);
-            });
-            it('cover images land in the public bucket', async () => {
-                const guid = 'cccccccc-cccc-cccc-cccc-cccccccccccc';
-                const path = definitionPaths.image(guid);
-                // Real 1×1 transparent PNG. The provider runs every image through
-                // transcodeImageIfNeeded → sharp, so a hand-crafted byte stub
-                // would fail the decode. Routing (the test's actual concern) is
-                // independent of which format the input arrives in.
-                const tinyPng = Uint8Array.from([
-                    137, 80, 78, 71, 13, 10, 26, 10, 0, 0, 0, 13, 73, 72, 68, 82, 0, 0, 0, 1, 0, 0, 0, 1, 8,
-                    6, 0, 0, 0, 31, 21, 196, 137, 0, 0, 0, 9, 112, 72, 89, 115, 0, 0, 3, 232, 0, 0, 3, 232, 1,
-                    181, 123, 82, 107, 0, 0, 0, 13, 73, 68, 65, 84, 120, 156, 99, 96, 96, 96, 96, 0, 0, 0, 5,
-                    0, 1, 165, 246, 69, 64, 0, 0, 0, 0, 73, 69, 78, 68, 174, 66, 96, 130
-                ]);
-                await storage.put(path, tinyPng, 'image/png');
-                expect(await existsInBucket(PUBLIC_BUCKET, path)).toBe(true);
-                expect(await existsInBucket(PRIVATE_BUCKET, path)).toBe(false);
-            });
-            it('getPublicUrl returns the proxy prefix for private files', () => {
-                const path = definitionPaths.version('guid-1', 1, 'gh');
-                const url = storage.getPublicUrl(path);
-                expect(url.startsWith('/api/files/')).toBe(true);
-                expect(url).not.toContain('/storage/v1/object/public/');
-            });
-            it('getPublicUrl returns the CDN URL for public files', () => {
-                const path = definitionPaths.image('guid-1');
-                const url = storage.getPublicUrl(path);
-                expect(url).toContain(`/storage/v1/object/public/${PUBLIC_BUCKET}/`);
-            });
-        });
-    });
-}
-//# sourceMappingURL=conformance.test.js.map

package/dist/storage/__tests__/conformance.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"conformance.test.js","sourceRoot":"","sources":["../../../src/storage/__tests__/conformance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAExE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;AAC9C,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;AAC/D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,cAAc,CAAC;AAC3E,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,eAAe,CAAC;AAE9E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,gFAAgF;AAChF,6EAA6E;AAC7E,oDAAoD;AACpD,SAAS,mBAAmB;IAC3B,IAAI,CAAC,YAAY,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,YAAY,EAAE,gBAAgB,EAAE;YACnD,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACxD,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,GAAG,CAAC;IACX,CAAC;AACF,CAAC;AACD,MAAM,YAAY,GAAG,mBAAmB,EAAE,CAAC;AAE3C,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;QACtE,EAAE,CAAC,+IAA+I,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC/J,CAAC,CAAC,CAAC;AACJ,CAAC;KAAM,CAAC;IACP,2EAA2E;IAC3E,MAAM,WAAW,GAAG,YAAY,CAAC;IAEjC;;;;OAIG;IACH,KAAK,UAAU,WAAW,CAAC,MAAc;QACxC,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAa,CAAC,EAAE,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;YACzB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;gBACxE,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE;aACxC,CAAC,CAAC;YACH,IAAI,KAAK;gBAAE,MAAM,KAAK,CAAC;YACvB,KAAK,MAAM,KAAK,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;gBACvD,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;oBACnC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACF,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YACzF,IAAI,KAAK;gBAAE,MAAM,KAAK,CAAC;QACxB,CAAC;IACF,CAAC;IAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACxC,UAAU,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;QAEH,6BAA6B,CAAC;YAC7B,IAAI,EAAE,yBAAyB;YAC/B,aAAa,EAAE,GAAG,EAAE,CACnB,IAAI,uBAAuB,CAAC;gBAC3B,WAAW,EAAE,YAAa;gBAC1B,cAAc,EAAE,gBAAiB;gBACjC,YAAY,EAAE,aAAa;gBAC3B,aAAa,EAAE,cAAc;aAC7B,CAAC;SACH,CAAC,CAAC;QAEH,+EAA+E;QAC/E,yEAAyE;QACzE,4EAA4E;QAC5E,yEAAyE;QACzE,8BAA8B;QAC9B,+EAA+E;QAC/E,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;YAC/B,MAAM,OAAO,GAAG,IAAI,uBAAuB,CAAC;gBAC3C,WAAW,EAAE,YAAa;gBAC1B,cAAc,EAAE,gBAAiB;gBACjC,YAAY,EAAE,aAAa;gBAC3B,aAAa,EAAE,cAAc;aAC7B,CAAC,CAAC;YAEH,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,IAAY;gBACzD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC9E,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;gBACxB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YAED,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;gBAC/D,MAAM,IAAI,GAAG,sCAAsC,CAAC;gBACpD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;gBACpD,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC9D,MAAM,CAAC,MAAM,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC9D,MAAM,CAAC,MAAM,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/D,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;gBAChE,MAAM,IAAI,GAAG,sCAAsC,CAAC;gBACpD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;gBACrD,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/D,MAAM,CAAC,MAAM,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC9D,MAAM,CAAC,MAAM,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/D,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;gBACvD,MAAM,IAAI,GAAG,sCAAsC,CAAC;gBACpD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzC,kEAAkE;gBAClE,8DAA8D;gBAC9D,gEAAgE;gBAChE,oDAAoD;gBACpD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC;oBAC/B,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;oBACvF,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC;oBACzF,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;oBACxF,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG;iBACpE,CAAC,CAAC;gBACH,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;gBAC9C,MAAM,CAAC,MAAM,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7D,MAAM,CAAC,MAAM,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;gBAClE,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;gBACxD,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACvC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;gBAC5D,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACvC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,6BAA6B,aAAa,GAAG,CAAC,CAAC;YACtE,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/userProfile/__tests__/conformance.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=conformance.test.d.ts.map

package/dist/userProfile/__tests__/conformance.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"conformance.test.d.ts","sourceRoot":"","sources":["../../../src/userProfile/__tests__/conformance.test.ts"],"names":[],"mappings":""}

package/dist/userProfile/__tests__/conformance.test.js

@@ -1,38 +0,0 @@
-import { describe, beforeEach, it } from 'vitest';
-import { runUserProfileStoreConformance } from '@selvajs/platform/testing';
-import { SupabaseUserProfileProvider } from '../SupabaseUserProfileProvider.js';
-import { readEnv, resetAllData } from '../../data/__tests__/test-helpers.js';
-const envCtx = readEnv();
-if (!envCtx) {
-    describe.skip('SupabaseUserProfileProvider (skipped: no live stack)', () => {
-        it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => { });
-    });
-}
-else {
-    describe('SupabaseUserProfileProvider', () => {
-        beforeEach(async () => {
-            await resetAllData(envCtx);
-        });
-        runUserProfileStoreConformance({
-            name: 'SupabaseUserProfileProvider',
-            createStore: async () => {
-                const store = new SupabaseUserProfileProvider(envCtx.bundle);
-                const seedUser = async (email) => {
-                    const { data, error } = await envCtx.adminClient.auth.admin.createUser({
-                        email,
-                        password: 'conformance-test-password-1234',
-                        email_confirm: true
-                    });
-                    if (error)
-                        throw error;
-                    return {
-                        id: data.user.id,
-                        email: data.user.email
-                    };
-                };
-                return { store, seedUser };
-            }
-        });
-    });
-}
-//# sourceMappingURL=conformance.test.js.map

package/dist/userProfile/__tests__/conformance.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"conformance.test.js","sourceRoot":"","sources":["../../../src/userProfile/__tests__/conformance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAE3E,OAAO,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAE7E,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;AAEzB,IAAI,CAAC,MAAM,EAAE,CAAC;IACb,QAAQ,CAAC,IAAI,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC1E,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACJ,CAAC;KAAM,CAAC;IACP,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;QAC5C,UAAU,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,8BAA8B,CAAC;YAC9B,IAAI,EAAE,6BAA6B;YACnC,WAAW,EAAE,KAAK,IAAI,EAAE;gBACvB,MAAM,KAAK,GAAG,IAAI,2BAA2B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC7D,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAa,EAAqB,EAAE;oBAC3D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;wBACtE,KAAK;wBACL,QAAQ,EAAE,gCAAgC;wBAC1C,aAAa,EAAE,IAAI;qBACnB,CAAC,CAAC;oBACH,IAAI,KAAK;wBAAE,MAAM,KAAK,CAAC;oBACvB,OAAO;wBACN,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;wBAChB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;qBACtB,CAAC;gBACH,CAAC,CAAC;gBACF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;YAC5B,CAAC;SACD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/src/auth/SupabaseAuthProvider.ts

@@ -1,464 +0,0 @@
-import { createClient, type SupabaseClient, type User } from '@supabase/supabase-js';
-import type {
-	IAuthProvider,
-	IEmailLinkAuth,
-	IOAuthAuth,
-	IPasswordAuth,
-	AuthUser,
-	LoginResult,
-	UserManagementResult,
-	ListOptions,
-	Page
-} from '@selvajs/platform';
-
-/**
- * Auth backed by Supabase Auth (GoTrue).
- *
- * Identity + session lifecycle are fully delegated:
- *  - `verifyLogin` wraps `auth.signInWithPassword` — returns the access_token
- *    straight from Supabase as the session token.
- *  - `verifyToken` calls `auth.getUser(token)` against an anon client scoped
- *    to that bearer; GoTrue validates the JWT for us.
- *  - User management uses `auth.admin.*` with the service-role client.
- *
- * Identity-only — platform permissions live on `IPlatformPermissionStore`
- * (`SupabasePlatformPermissionStore` reads `user_profiles.platform_permissions`)
- * and profile state on `IUserProfileStore`.
- */
-export interface SupabaseAuthProviderConfig {
-	supabaseUrl: string;
-	anonKey: string;
-	serviceRoleKey: string;
-	/**
-	 * Whether self-service signup is allowed via `passwordAuth.registerUser`.
-	 * Default false — production deployments start with invite-only.
-	 */
-	enableSelfSignup?: boolean;
-	/**
-	 * OAuth providers enabled in the Supabase dashboard (lowercased:
-	 * "google", "github", …). Surfaced via `oauth.listProviders()` so the
-	 * driving layer doesn't read provider-specific env vars itself. Defaults
-	 * to an empty list.
-	 */
-	oauthProviders?: readonly string[];
-	/**
-	 * Allow `emailLink.sendMagicLink` to create new users on first request.
-	 * Default true — matches Supabase's `signInWithOtp` default and gives
-	 * fresh installs a working signup path. Set false for invite-only
-	 * deployments; `sendMagicLink` for an unknown email returns
-	 * `{ ok: false, reason: 'signup_disabled' }`.
-	 */
-	allowEmailLinkSignup?: boolean;
-}
-
-export class SupabaseAuthProvider implements IAuthProvider {
-	readonly name = 'Supabase Auth';
-	readonly passwordAuth: IPasswordAuth;
-	readonly oauth: IOAuthAuth;
-	readonly emailLink: IEmailLinkAuth;
-
-	private readonly admin: SupabaseClient;
-	private readonly anon: SupabaseClient;
-	private readonly anonKey: string;
-	private readonly supabaseUrl: string;
-
-	constructor(config: SupabaseAuthProviderConfig) {
-		this.supabaseUrl = config.supabaseUrl;
-		this.anonKey = config.anonKey;
-		this.admin = createClient(config.supabaseUrl, config.serviceRoleKey, {
-			auth: { persistSession: false, autoRefreshToken: false }
-		});
-		this.anon = createClient(config.supabaseUrl, config.anonKey, {
-			auth: { persistSession: false, autoRefreshToken: false }
-		});
-		this.passwordAuth = new SupabasePasswordAuth(
-			this.admin,
-			this.anon,
-			(email, password) => this.signIn(email, password),
-			config.enableSelfSignup ?? false,
-			(user) => this.hydrate(user)
-		);
-		this.oauth = new SupabaseOAuthAuth(
-			this.anon,
-			(user) => this.hydrate(user),
-			config.oauthProviders ?? []
-		);
-		this.emailLink = new SupabaseEmailLinkAuth(
-			this.anon,
-			(user) => this.hydrate(user),
-			config.allowEmailLinkSignup ?? true
-		);
-	}
-
-	static fromEnv(env: Record<string, string | undefined>): SupabaseAuthProvider {
-		const supabaseUrl = env.SUPABASE_URL;
-		const anonKey = env.SUPABASE_ANON_KEY;
-		const serviceRoleKey = env.SUPABASE_SERVICE_ROLE_KEY;
-		if (!supabaseUrl) throw new Error('Missing required env var: SUPABASE_URL');
-		if (!anonKey) throw new Error('Missing required env var: SUPABASE_ANON_KEY');
-		if (!serviceRoleKey) throw new Error('Missing required env var: SUPABASE_SERVICE_ROLE_KEY');
-		const oauthProviders = (env.SUPABASE_OAUTH_PROVIDERS ?? '')
-			.split(',')
-			.map((p) => p.trim().toLowerCase())
-			.filter((p) => p.length > 0);
-		return new SupabaseAuthProvider({
-			supabaseUrl,
-			anonKey,
-			serviceRoleKey,
-			enableSelfSignup: env.SUPABASE_ENABLE_SELF_SIGNUP === 'true',
-			oauthProviders,
-			// Default true; set SUPABASE_ALLOW_EMAIL_LINK_SIGNUP=false to lock down
-			// to invite-only and reject magic-link signups for new addresses.
-			allowEmailLinkSignup: env.SUPABASE_ALLOW_EMAIL_LINK_SIGNUP !== 'false'
-		});
-	}
-
-	async verifyToken(token: string): Promise<AuthUser | null> {
-		if (!token) return null;
-		// Per-request anon client with the JWT attached. `getUser(token)` also
-		// works, but routing through a scoped client keeps future sub-calls
-		// (profile fetch, etc.) RLS-aware if we ever move them here.
-		const { data, error } = await this.anon.auth.getUser(token);
-		if (error || !data.user) return null;
-		if (data.user.user_metadata?.disabled === true) return null;
-		return this.hydrate(data.user);
-	}
-
-	async getUser(id: string): Promise<AuthUser | null> {
-		const { data, error } = await this.admin.auth.admin.getUserById(id);
-		if (error || !data.user) return null;
-		return this.hydrate(data.user);
-	}
-
-	async listUsers(opts?: ListOptions): Promise<Page<AuthUser> | null> {
-		// GoTrue's admin.listUsers uses its own pagination (page/perPage).
-		// Translate our cursor (offset) into page number.
-		const perPage = opts?.limit ?? 50;
-		const page = opts?.cursor ? parseInt(opts.cursor, 10) : 1;
-		const { data, error } = await this.admin.auth.admin.listUsers({
-			page: Number.isFinite(page) && page >= 1 ? page : 1,
-			perPage
-		});
-		if (error) throw error;
-
-		const users = data.users;
-		const hydrated = users.map((u) => this.hydrate(u));
-		// If the page was full, assume there may be more.
-		const nextCursor = users.length >= perPage ? String(page + 1) : undefined;
-		return { items: hydrated, nextCursor };
-	}
-
-	async createUser(email: string): Promise<AuthUser> {
-		// Allowlist variant: create without a password. The user receives a
-		// magic-link / OIDC handoff from the consuming app. Identity-only;
-		// platform permissions are granted via IPlatformPermissionStore.
-		const { data, error } = await this.admin.auth.admin.createUser({
-			email,
-			email_confirm: true
-		});
-		if (error) throw error;
-		if (!data.user) throw new Error('createUser returned no user');
-		return this.hydrate(data.user);
-	}
-
-	async deleteUser(id: string): Promise<UserManagementResult> {
-		// Identity-only delete. The §2 sole-`instance_admin` invariant lives
-		// on IPlatformPermissionStore; callers consult it before calling here.
-		const { error } = await this.admin.auth.admin.deleteUser(id);
-		if (error) {
-			// 404-shaped errors from GoTrue surface as { status: 404 } or a
-			// specific message. Normalize to 'not_found' rather than throwing.
-			const e = error as unknown as { status?: number; message?: string };
-			if (e.status === 404 || /not.?found/i.test(e.message ?? '')) return 'not_found';
-			throw error;
-		}
-		return 'ok';
-	}
-
-	async disableUser(id: string): Promise<UserManagementResult> {
-		const { data: existing, error: fetchError } = await this.admin.auth.admin.getUserById(id);
-		if (fetchError || !existing.user) return 'not_found';
-		// GoTrue's user_metadata update merges shallowly — preserve existing
-		// fields by spreading them in.
-		const mergedMetadata = {
-			...(existing.user.user_metadata ?? {}),
-			disabled: true
-		};
-		const { error } = await this.admin.auth.admin.updateUserById(id, {
-			user_metadata: mergedMetadata
-		});
-		if (error) {
-			const e = error as unknown as { status?: number; message?: string };
-			if (e.status === 404 || /not.?found/i.test(e.message ?? '')) return 'not_found';
-			throw error;
-		}
-		return 'ok';
-	}
-
-	async touchLastLogin(id: string): Promise<void> {
-		// 60-second debounce. Matches the local provider.
-		const { data, error } = await this.admin
-			.from('user_profiles')
-			.select('last_login_at')
-			.eq('user_id', id)
-			.maybeSingle();
-		if (error) return;
-
-		if (data?.last_login_at) {
-			const prev = Date.parse(data.last_login_at);
-			if (Number.isFinite(prev) && Date.now() - prev < 60_000) return;
-		}
-		await this.admin
-			.from('user_profiles')
-			.update({ last_login_at: new Date().toISOString() })
-			.eq('user_id', id);
-	}
-
-	// OAuth lives on `this.oauth` (typed `IOAuthAuth`); see `SupabaseOAuthAuth`
-	// below. Mirrors the `passwordAuth` capability split.
-
-	// ============================================================================
-	// Internals
-	// ============================================================================
-	/**
-	 * Sign in via GoTrue. Returns the access token string and the hydrated
-	 * user. Called by `SupabasePasswordAuth.verifyLogin` — kept on the
-	 * provider class so it has access to the hydrate helper without plumbing.
-	 */
-	private async signIn(
-		email: string,
-		password: string
-	): Promise<{ user: AuthUser; sessionToken: string } | null> {
-		const { data, error } = await this.anon.auth.signInWithPassword({ email, password });
-		if (error || !data.user || !data.session) return null;
-		if (data.user.user_metadata?.disabled === true) return null;
-		return { user: this.hydrate(data.user), sessionToken: data.session.access_token };
-	}
-
-	/**
-	 * Map a GoTrue `User` to our identity-only `AuthUser`. Platform permissions
-	 * live on `IPlatformPermissionStore` and profile fields (displayName,
-	 * starred, recentRuns) on `IUserProfileStore` — neither is in AuthUser.
-	 */
-	private hydrate(user: User): AuthUser {
-		return {
-			id: user.id,
-			email: user.email ?? undefined,
-			createdAt: user.created_at ?? undefined,
-			lastLoginAt: user.last_sign_in_at ?? undefined,
-			disabled: user.user_metadata?.disabled === true,
-			metadata: user.user_metadata
-		};
-	}
-
-	/**
-	 * Expose the anon URL + key so other code (e.g. the same process's
-	 * storage provider or per-request client factories) can build user-scoped
-	 * clients without requiring a second config read.
-	 */
-	getAnonClientConfig(): { supabaseUrl: string; anonKey: string } {
-		return { supabaseUrl: this.supabaseUrl, anonKey: this.anonKey };
-	}
-}
-
-class SupabasePasswordAuth implements IPasswordAuth {
-	constructor(
-		private readonly admin: SupabaseClient,
-		private readonly anon: SupabaseClient,
-		private readonly signIn: (
-			email: string,
-			password: string
-		) => Promise<{ user: AuthUser; sessionToken: string } | null>,
-		private readonly enableSelfSignup: boolean,
-		private readonly hydrate: (user: User) => AuthUser
-	) {}
-
-	async verifyLogin(email: string, password: string): Promise<LoginResult> {
-		const result = await this.signIn(email, password);
-		if (!result) return { kind: 'failed', reason: 'invalid_credentials' };
-		return { kind: 'success', user: result.user, sessionToken: result.sessionToken };
-	}
-
-	async createUserWithPassword(email: string, password: string): Promise<AuthUser> {
-		// Identity-only — platform permissions are granted separately via
-		// IPlatformPermissionStore.set after creation.
-		const { data, error } = await this.admin.auth.admin.createUser({
-			email,
-			password,
-			email_confirm: true
-		});
-		if (error) throw error;
-		if (!data.user) throw new Error('createUserWithPassword returned no user');
-		return this.hydrate(data.user);
-	}
-
-	async registerUser(email: string, password: string): Promise<AuthUser | null> {
-		if (!this.enableSelfSignup) return null;
-		const { data, error } = await this.anon.auth.signUp({ email, password });
-		if (error || !data.user) return null;
-		return this.hydrate(data.user);
-	}
-}
-
-/**
- * Supabase-backed `IOAuthAuth`. Thin wrappers over GoTrue's `signInWithOAuth`
- * / `exchangeCodeForSession` / `refreshSession` — the failure-shape mapping
- * (return null vs throw) is the only logic.
- */
-class SupabaseOAuthAuth implements IOAuthAuth {
-	constructor(
-		private readonly anon: SupabaseClient,
-		private readonly hydrate: (user: User) => AuthUser,
-		private readonly providers: readonly string[]
-	) {}
-
-	listProviders(): readonly string[] {
-		return this.providers;
-	}
-
-	async getOAuthAuthorizationUrl(
-		provider: 'google' | 'github' | 'azure' | 'gitlab',
-		redirectTo: string
-	): Promise<string> {
-		const { data, error } = await this.anon.auth.signInWithOAuth({
-			provider,
-			options: { redirectTo, skipBrowserRedirect: true }
-		});
-		if (error || !data.url) throw error ?? new Error('signInWithOAuth returned no URL');
-		return data.url;
-	}
-
-	async exchangeOAuthCode(code: string): Promise<{
-		user: AuthUser;
-		sessionToken: string;
-		refreshToken: string;
-	} | null> {
-		const { data, error } = await this.anon.auth.exchangeCodeForSession(code);
-		if (error || !data.user || !data.session) return null;
-		if (data.user.user_metadata?.disabled === true) return null;
-		return {
-			user: this.hydrate(data.user),
-			sessionToken: data.session.access_token,
-			refreshToken: data.session.refresh_token
-		};
-	}
-
-	async refreshSession(refreshToken: string): Promise<{
-		sessionToken: string;
-		refreshToken: string;
-	} | null> {
-		const { data, error } = await this.anon.auth.refreshSession({ refresh_token: refreshToken });
-		if (error || !data.session) return null;
-		return {
-			sessionToken: data.session.access_token,
-			refreshToken: data.session.refresh_token
-		};
-	}
-}
-
-/**
- * Supabase-backed `IEmailLinkAuth`. Wraps GoTrue's `signInWithOtp` (send the
- * link) and `verifyOtp` with `type: 'magiclink' | 'email' | 'signup'`
- * (verify on click).
- *
- * Token shape: Supabase emails the user `{callbackUrl}?token_hash=…&type=…`.
- * `verifyMagicLink` accepts either the full URL or just the raw `token_hash`
- * — adapters MAY support either to give the route layer flexibility. The
- * `type` query param decides which OTP variant `verifyOtp` runs (signup vs
- * magic-link returning user vs invite acceptance), so we pass it through.
- */
-class SupabaseEmailLinkAuth implements IEmailLinkAuth {
-	constructor(
-		private readonly anon: SupabaseClient,
-		private readonly hydrate: (user: User) => AuthUser,
-		private readonly allowSignup: boolean
-	) {}
-
-	async sendMagicLink(
-		email: string,
-		callbackUrl: string
-	): Promise<
-		{ ok: true } | { ok: false; reason: 'rate_limited' | 'signup_disabled' | 'invalid_email' }
-	> {
-		const { error } = await this.anon.auth.signInWithOtp({
-			email,
-			options: {
-				emailRedirectTo: callbackUrl,
-				shouldCreateUser: this.allowSignup
-			}
-		});
-		if (!error) return { ok: true };
-
-		// Map GoTrue's classified errors to our coarse reasons. Anything we
-		// don't recognize we throw — the route returns 500 and we get a stack
-		// trace, instead of swallowing a real bug as "rate limited".
-		const status = (error as { status?: number }).status;
-		const code = (error as { code?: string }).code;
-		const message = error.message ?? '';
-		if (status === 429 || /rate.?limit/i.test(message))
-			return { ok: false, reason: 'rate_limited' };
-		if (
-			code === 'otp_disabled' ||
-			code === 'signup_disabled' ||
-			/signup.*disabled/i.test(message)
-		) {
-			return { ok: false, reason: 'signup_disabled' };
-		}
-		if (code === 'validation_failed' || /invalid.*email|email.*invalid/i.test(message)) {
-			return { ok: false, reason: 'invalid_email' };
-		}
-		throw error;
-	}
-
-	async verifyMagicLink(rawCallbackUrl: string): Promise<{
-		user: AuthUser;
-		sessionToken: string;
-		refreshToken?: string;
-	} | null> {
-		const params = parseCallbackParams(rawCallbackUrl);
-		if (!params) return null;
-		const { tokenHash, type } = params;
-
-		const { data, error } = await this.anon.auth.verifyOtp({
-			token_hash: tokenHash,
-			type
-		});
-		if (error || !data.user || !data.session) return null;
-		if (data.user.user_metadata?.disabled === true) return null;
-		return {
-			user: this.hydrate(data.user),
-			sessionToken: data.session.access_token,
-			refreshToken: data.session.refresh_token
-		};
-	}
-}
-
-/**
- * Pull `token_hash` + `type` from either a full callback URL or a bare
- * `token_hash=…&type=…` query string. Tolerant of both shapes so the route
- * layer can pass whichever form is convenient.
- *
- * Returns null when the inputs aren't recognizable — the caller treats null
- * as "send the user back to /login".
- */
-function parseCallbackParams(
-	raw: string
-): { tokenHash: string; type: 'magiclink' | 'email' | 'signup' | 'invite' | 'recovery' } | null {
-	let search: URLSearchParams;
-	try {
-		// Full URL path
-		search = new URL(raw).searchParams;
-	} catch {
-		// Query-string-only path — treat as bare params.
-		search = new URLSearchParams(raw.startsWith('?') ? raw.slice(1) : raw);
-	}
-	const tokenHash = search.get('token_hash');
-	const type = search.get('type');
-	if (!tokenHash) return null;
-	const allowed = new Set(['magiclink', 'email', 'signup', 'invite', 'recovery']);
-	if (!type || !allowed.has(type)) return null;
-	return {
-		tokenHash,
-		type: type as 'magiclink' | 'email' | 'signup' | 'invite' | 'recovery'
-	};
-}