@selvajs/supabase-provider 0.14.4-beta.0 → 0.15.0-beta.2

package/src/data/__tests__/compute-server-encryption.test.ts

@@ -1,173 +0,0 @@
-/**
- * CI-runnable (no live stack) unit tests for at-rest encryption of
- * `compute_servers.api_key`. Uses a minimal fake of the Supabase query builder
- * that records `insert` payloads and serves canned `select` rows, so we can
- * assert the exact bytes that would reach the DB without a real Postgres.
- *
- * The security property under test: a plaintext apiKey handed to the store is
- * NEVER written verbatim — the DB only ever sees an `enc:v1:` envelope — and it
- * round-trips back to plaintext on read.
- */
-
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { randomBytes } from 'node:crypto';
-import { isEncryptedSecret, decryptSecret } from '@selvajs/platform/computeServer';
-import type { RequestContext } from '@selvajs/platform';
-import { SupabaseComputeServerStore } from '../SupabaseComputeServerStore.js';
-import type { ClientBundle } from '../client.js';
-
-const SYSTEM_CTX = { userId: '', system: true } as unknown as RequestContext;
-const KEY = randomBytes(32);
-
-/**
- * Records every `insert` payload and returns canned rows for each table's
- * `select`. Only the fragments the store actually chains are implemented; the
- * builder is thenable so `await client.from(...).select(...)` resolves.
- */
-function fakeBundle(selectRows: Record<string, unknown[]> = {}) {
-	const inserted: Record<string, unknown[]> = {};
-
-	function builder(table: string) {
-		const result = { data: selectRows[table] ?? [], error: null };
-		const chain: Record<string, unknown> = {
-			select: () => ({
-				...chain,
-				eq: () => ({ ...chain, maybeSingle: async () => ({ data: null, error: null }) }),
-				then: (resolve: (v: unknown) => unknown) => resolve(result)
-			}),
-			insert: (rows: unknown) => {
-				inserted[table] = (inserted[table] ?? []).concat(rows as unknown[]);
-				return { error: null };
-			},
-			delete: () => ({ eq: () => ({ eq: () => ({ error: null }), error: null }) }),
-			update: () => ({ eq: () => ({ error: null }) }),
-			upsert: () => ({ error: null })
-		};
-		return chain;
-	}
-
-	const client = { from: (t: string) => builder(t) };
-	const bundle = {
-		serviceClient: client,
-		forRequest: () => client
-	} as unknown as ClientBundle;
-	return { bundle, inserted };
-}
-
-describe('SupabaseComputeServerStore — apiKey encryption at rest', () => {
-	beforeEach(() => vi.restoreAllMocks());
-
-	it('encrypts apiKey before insert — DB never sees plaintext', async () => {
-		const { bundle, inserted } = fakeBundle();
-		const store = new SupabaseComputeServerStore(bundle, KEY);
-
-		await store.savePlatformServers(
-			SYSTEM_CTX,
-			[
-				{
-					id: 's1',
-					label: 'prod',
-					serverUrl: 'https://compute.example.com',
-					apiKey: 'super-secret-key',
-					scope: 'platform',
-					sharedWith: 'all'
-				}
-			],
-			's1'
-		);
-
-		const rows = inserted['compute_servers'] as Array<{ api_key: string }>;
-		expect(rows).toHaveLength(1);
-		expect(rows[0].api_key).not.toBe('super-secret-key');
-		expect(isEncryptedSecret(rows[0].api_key)).toBe(true);
-		// And it's genuinely our plaintext under the envelope.
-		expect(decryptSecret(rows[0].api_key, KEY)).toBe('super-secret-key');
-	});
-
-	it('decrypts apiKey on read — callers see plaintext', async () => {
-		// Seed the "DB" with an already-encrypted row.
-		const { encryptSecret } = await import('@selvajs/platform/computeServer');
-		const envelope = encryptSecret('round-trip-key', KEY);
-		const { bundle } = fakeBundle({
-			compute_servers: [
-				{
-					id: 's1',
-					scope: 'platform',
-					owner_org_id: null,
-					shared_with_all: true,
-					label: 'prod',
-					server_url: 'https://compute.example.com',
-					api_key: envelope,
-					timeout_ms: null,
-					retry_count: null
-				}
-			]
-		});
-		const store = new SupabaseComputeServerStore(bundle, KEY);
-
-		const config = await store.getConfig(SYSTEM_CTX);
-		expect(config.servers).toHaveLength(1);
-		expect(config.servers[0].apiKey).toBe('round-trip-key');
-	});
-
-	it('throws rather than persist plaintext when no key is configured', async () => {
-		const { bundle } = fakeBundle();
-		const store = new SupabaseComputeServerStore(bundle); // no key
-
-		await expect(
-			store.savePlatformServers(
-				SYSTEM_CTX,
-				[
-					{
-						id: 's1',
-						label: 'prod',
-						serverUrl: 'https://compute.example.com',
-						apiKey: 'secret',
-						scope: 'platform',
-						sharedWith: 'all'
-					}
-				],
-				's1'
-			)
-		).rejects.toThrow(/SELVA_AT_REST_KEY/);
-	});
-
-	it('verifySecrets flags a plaintext row', async () => {
-		const { bundle } = fakeBundle({
-			compute_servers: [{ id: 's1', label: 'legacy', api_key: 'raw-plaintext' }]
-		});
-		const store = new SupabaseComputeServerStore(bundle, KEY);
-
-		const report = await store.verifySecrets();
-		expect(report.ok).toBe(false);
-		expect(report.plaintextFound).toBe(true);
-		expect(report.failures).toEqual([
-			{ serverId: 's1', serverLabel: 'legacy', reason: 'plaintext_on_disk' }
-		]);
-	});
-
-	it('verifySecrets reports key_mismatch when the at-rest key rotated', async () => {
-		const { encryptSecret } = await import('@selvajs/platform/computeServer');
-		const envelope = encryptSecret('secret', randomBytes(32)); // different key
-		const { bundle } = fakeBundle({
-			compute_servers: [{ id: 's1', label: 'prod', api_key: envelope }]
-		});
-		const store = new SupabaseComputeServerStore(bundle, KEY);
-
-		const report = await store.verifySecrets();
-		expect(report.ok).toBe(false);
-		expect(report.plaintextFound).toBe(false);
-		expect(report.failures[0]).toMatchObject({ serverId: 's1', reason: 'key_mismatch' });
-	});
-
-	it('verifySecrets returns ok when every apiKey decrypts', async () => {
-		const { encryptSecret } = await import('@selvajs/platform/computeServer');
-		const { bundle } = fakeBundle({
-			compute_servers: [{ id: 's1', label: 'prod', api_key: encryptSecret('k', KEY) }]
-		});
-		const store = new SupabaseComputeServerStore(bundle, KEY);
-
-		const report = await store.verifySecrets();
-		expect(report).toEqual({ ok: true, failures: [], plaintextFound: false });
-	});
-});

package/src/data/__tests__/definition-conformance.test.ts

@@ -1,89 +0,0 @@
-import { describe, beforeEach, it } from 'vitest';
-import { runDefinitionStoreConformance } from '@selvajs/platform/testing';
-import { DEFAULT_ORG_PERMISSIONS } from '@selvajs/platform';
-import { SupabaseDefinitionStore } from '../SupabaseDefinitionStore.js';
-import { readEnv, resetAllData, seedUser } from './test-helpers.js';
-
-const envCtx = readEnv();
-
-if (!envCtx) {
-	describe.skip('SupabaseDefinitionStore (skipped: no live stack)', () => {
-		it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => {});
-	});
-} else {
-	describe('SupabaseDefinitionStore', () => {
-		beforeEach(async () => {
-			await resetAllData(envCtx);
-		});
-
-		runDefinitionStoreConformance({
-			name: 'SupabaseDefinitionStore',
-			createStore: () => new SupabaseDefinitionStore(envCtx.bundle),
-			createScope: async () => {
-				// Seed: 1 owner + 1 secondary user + 1 org + 2 projects. Definitions
-				// created in the suite FK to one of those two projects.
-				const { userId: ownerId, sessionToken: ownerSessionToken } = await seedUser(envCtx, '');
-				const { userId: secondaryUserId, sessionToken: secondaryUserSessionToken } = await seedUser(
-					envCtx,
-					''
-				);
-				const orgId = crypto.randomUUID();
-				const projectId = crypto.randomUUID();
-				const secondaryProjectId = crypto.randomUUID();
-				const now = new Date().toISOString();
-				const admin = envCtx.adminClient;
-
-				const { error: orgError } = await admin.from('orgs').insert({
-					id: orgId,
-					name: 'Definition Test Org',
-					slug: `def-test-${orgId.slice(0, 8)}`,
-					owner_id: ownerId,
-					created_at: now,
-					updated_at: now
-				});
-				if (orgError) throw orgError;
-				const { error: memberError } = await admin.from('org_members').insert({
-					org_id: orgId,
-					user_id: ownerId,
-					role: 'owner',
-					permissions: [...DEFAULT_ORG_PERMISSIONS.owner],
-					joined_at: now
-				});
-				if (memberError) throw memberError;
-
-				const { error: p1Error } = await admin.from('projects').insert([
-					{
-						id: projectId,
-						org_id: orgId,
-						name: 'Project A',
-						slug: `proj-a-${projectId.slice(0, 8)}`,
-						visibility: 'public',
-						owner_id: ownerId,
-						created_at: now,
-						updated_at: now
-					},
-					{
-						id: secondaryProjectId,
-						org_id: orgId,
-						name: 'Project B',
-						slug: `proj-b-${secondaryProjectId.slice(0, 8)}`,
-						visibility: 'public',
-						owner_id: ownerId,
-						created_at: now,
-						updated_at: now
-					}
-				]);
-				if (p1Error) throw p1Error;
-
-				return {
-					ownerId,
-					ownerSessionToken,
-					projectId,
-					secondaryProjectId,
-					secondaryUserId,
-					secondaryUserSessionToken
-				};
-			}
-		});
-	});
-}

package/src/data/__tests__/event-sink-conformance.test.ts

@@ -1,32 +0,0 @@
-import { describe, beforeEach, it } from 'vitest';
-import { runEventSinkConformance, type RecordingEventSink } from '@selvajs/platform/testing';
-import { SupabaseDataProvider } from '../SupabaseDataProvider.js';
-import { readEnv, resetAllData, seedUser } from './test-helpers.js';
-
-const envCtx = readEnv();
-
-if (!envCtx) {
-	describe.skip('SupabaseDataProvider event-sink (skipped: no live stack)', () => {
-		it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => {});
-	});
-} else {
-	describe('SupabaseDataProvider event-sink', () => {
-		beforeEach(async () => {
-			await resetAllData(envCtx);
-		});
-
-		runEventSinkConformance({
-			name: 'SupabaseDataProvider',
-			createProvider: (sink: RecordingEventSink) =>
-				SupabaseDataProvider.create(
-					{
-						supabaseUrl: envCtx.url,
-						anonKey: envCtx.anonKey,
-						serviceRoleKey: envCtx.serviceRoleKey
-					},
-					sink
-				),
-			createActorId: () => seedUser(envCtx, '')
-		});
-	});
-}

package/src/data/__tests__/invite-conformance.test.ts

@@ -1,46 +0,0 @@
-import { describe, beforeEach, it } from 'vitest';
-import { runInviteStoreConformance } from '@selvajs/platform/testing';
-import { DEFAULT_ORG_PERMISSIONS } from '@selvajs/platform';
-import { SupabaseInviteStore } from '../SupabaseInviteStore.js';
-import { readEnv, resetAllData, seedUser } from './test-helpers.js';
-
-const envCtx = readEnv();
-
-if (!envCtx) {
-	describe.skip('SupabaseInviteStore (skipped: no live stack)', () => {
-		it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => {});
-	});
-} else {
-	describe('SupabaseInviteStore', () => {
-		beforeEach(async () => {
-			await resetAllData(envCtx);
-		});
-
-		runInviteStoreConformance({
-			name: 'SupabaseInviteStore',
-			createStore: () => new SupabaseInviteStore(envCtx.bundle),
-			createScope: async () => {
-				const { userId: adminId, sessionToken: adminSessionToken } = await seedUser(envCtx, '');
-				const orgId = crypto.randomUUID();
-				const now = new Date().toISOString();
-				await envCtx.adminClient.from('orgs').insert({
-					id: orgId,
-					name: 'Invite Test Org',
-					slug: `invite-test-${orgId.slice(0, 8)}`,
-					owner_id: adminId,
-					created_at: now,
-					updated_at: now
-				});
-				await envCtx.adminClient.from('org_members').insert({
-					org_id: orgId,
-					user_id: adminId,
-					role: 'owner',
-					permissions: [...DEFAULT_ORG_PERMISSIONS.owner],
-					joined_at: now
-				});
-				return { adminId, adminSessionToken, orgId };
-			},
-			seedUser: (id) => seedUser(envCtx, id)
-		});
-	});
-}

package/src/data/__tests__/org-conformance.test.ts

@@ -1,30 +0,0 @@
-import { describe, beforeEach, it } from 'vitest';
-import { runOrgStoreConformance } from '@selvajs/platform/testing';
-import { SupabaseOrgStore } from '../SupabaseOrgStore.js';
-import { SupabaseInviteStore } from '../SupabaseInviteStore.js';
-import { SupabaseComputeServerStore } from '../SupabaseComputeServerStore.js';
-import { readEnv, resetAllData, seedUser } from './test-helpers.js';
-
-const envCtx = readEnv();
-
-if (!envCtx) {
-	describe.skip('SupabaseOrgStore (skipped: no live stack)', () => {
-		it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => {});
-	});
-} else {
-	describe('SupabaseOrgStore', () => {
-		beforeEach(async () => {
-			await resetAllData(envCtx);
-		});
-
-		runOrgStoreConformance({
-			name: 'SupabaseOrgStore',
-			createStore: () => new SupabaseOrgStore(envCtx.bundle),
-			seedUser: (id) => seedUser(envCtx, id),
-			createCompanionStores: () => ({
-				invites: new SupabaseInviteStore(envCtx.bundle),
-				computeServer: new SupabaseComputeServerStore(envCtx.bundle)
-			})
-		});
-	});
-}

package/src/data/__tests__/project-conformance.test.ts

@@ -1,57 +0,0 @@
-import { describe, beforeEach, it } from 'vitest';
-import { runProjectStoreConformance } from '@selvajs/platform/testing';
-import { DEFAULT_ORG_PERMISSIONS } from '@selvajs/platform';
-import { SupabaseProjectStore } from '../SupabaseProjectStore.js';
-import { readEnv, resetAllData, seedUser } from './test-helpers.js';
-
-const envCtx = readEnv();
-
-if (!envCtx) {
-	describe.skip('SupabaseProjectStore (skipped: no live stack)', () => {
-		it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => {});
-	});
-} else {
-	describe('SupabaseProjectStore', () => {
-		beforeEach(async () => {
-			await resetAllData(envCtx);
-		});
-
-		runProjectStoreConformance({
-			name: 'SupabaseProjectStore',
-			createStore: async () => {
-				// Seed an owner + an org so the project tests have an anchor.
-				const { userId: ownerId, sessionToken: ownerSessionToken } = await seedUser(envCtx, '');
-				const orgId = crypto.randomUUID();
-				const now = new Date().toISOString();
-				const admin = envCtx.adminClient;
-				const { error: orgError } = await admin.from('orgs').insert({
-					id: orgId,
-					name: 'Conformance Org',
-					slug: `conformance-${orgId.slice(0, 8)}`,
-					owner_id: ownerId,
-					created_at: now,
-					updated_at: now
-				});
-				if (orgError) throw orgError;
-				// And an owner membership with `manage_projects` so project
-				// creates pass the `has_org_permission` policy under RLS.
-				const { error: memberError } = await admin.from('org_members').insert({
-					org_id: orgId,
-					user_id: ownerId,
-					role: 'owner',
-					permissions: [...DEFAULT_ORG_PERMISSIONS.owner],
-					joined_at: now
-				});
-				if (memberError) throw memberError;
-
-				return {
-					store: new SupabaseProjectStore(envCtx.bundle),
-					orgId,
-					ownerId,
-					ownerSessionToken
-				};
-			},
-			seedUser: (id) => seedUser(envCtx, id)
-		});
-	});
-}

package/src/data/__tests__/share-link-concurrency.test.ts

@@ -1,124 +0,0 @@
-/**
- * Audit Q4/Q5 — the concurrent-solve guarantee for share-link caps.
- *
- * `tryIncrementSolveCount` is the load-bearing race-sensitive method: the
- * `/api/compute` endpoint calls it BEFORE solving and turns a `null` return
- * (cap hit) into HTTP 429. Under concurrent solves against one capped link, the
- * cap must hold exactly — no overshoot, no lost update handing two solves the
- * same slot. Supabase provides this via the SECURITY DEFINER
- * `try_increment_share_link_solve_count` RPC, which does the check-and-increment
- * in a single statement.
- *
- * This lives in the Supabase suite (not the shared conformance suite or the app
- * route tests) because it is the ONLY backend that actually provides the
- * guarantee: the local provider's whole-file read-modify-write is a documented
- * dev-scale tradeoff and is not concurrency-safe. Skipped without a live stack,
- * matching the other conformance tests here.
- *
- * Complements the sequential cap/count tests at
- * `packages/selva/src/routes/api/compute/__tests__/solve-cap-and-count.test.ts`.
- */
-
-import { describe, it, expect, beforeEach } from 'vitest';
-import type { RequestContext, ShareLink } from '@selvajs/platform';
-import { SupabaseShareLinkStore } from '../SupabaseShareLinkStore.js';
-import { readEnv, resetAllData, seedUser } from './test-helpers.js';
-
-const envCtx = readEnv();
-
-if (!envCtx) {
-	describe.skip('SupabaseShareLinkStore concurrency (skipped: no live stack)', () => {
-		it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => {});
-	});
-} else {
-	const ctx: RequestContext = { userId: '', system: true } as RequestContext;
-
-	/** Seed org → project → definition → share link, all via service-role. */
-	async function seedCappedLink(maxSolves: number): Promise<{ linkId: string }> {
-		const { userId: ownerId } = await seedUser(envCtx!, '');
-		const admin = envCtx!.adminClient;
-		const orgId = crypto.randomUUID();
-		const projectId = crypto.randomUUID();
-		const definitionId = crypto.randomUUID();
-		const linkId = crypto.randomUUID();
-		const now = new Date().toISOString();
-
-		const { error: orgErr } = await admin.from('orgs').insert({
-			id: orgId,
-			name: 'Concurrency Org',
-			slug: `conc-${orgId.slice(0, 8)}`,
-			owner_id: ownerId,
-			created_at: now,
-			updated_at: now
-		});
-		if (orgErr) throw orgErr;
-		const { error: projErr } = await admin.from('projects').insert({
-			id: projectId,
-			org_id: orgId,
-			name: 'Project',
-			slug: `proj-${projectId.slice(0, 8)}`,
-			visibility: 'public',
-			owner_id: ownerId,
-			created_at: now,
-			updated_at: now
-		});
-		if (projErr) throw projErr;
-		const { error: defErr } = await admin.from('definitions').insert({
-			guid: definitionId,
-			project_id: projectId,
-			owner_id: ownerId,
-			display_name: 'Def',
-			status: 'published',
-			created_at: now,
-			updated_at: now
-		});
-		if (defErr) throw defErr;
-
-		const link: ShareLink = {
-			id: linkId,
-			definitionId,
-			channel: 'live',
-			tokenHash: crypto.randomUUID().replace(/-/g, ''),
-			createdBy: ownerId,
-			createdAt: now,
-			expiresAt: null,
-			revokedAt: null,
-			allowSolve: true,
-			maxSolves,
-			solveCount: 0
-		};
-		const store = new SupabaseShareLinkStore(envCtx!.bundle);
-		await store.create(ctx, link);
-		return { linkId };
-	}
-
-	describe('SupabaseShareLinkStore — concurrent solve-cap enforcement', () => {
-		beforeEach(async () => {
-			await resetAllData(envCtx!);
-		});
-
-		it('N concurrent solves against a cap-K link admit exactly K, refuse the rest', async () => {
-			const CAP = 5;
-			const ATTEMPTS = 25;
-			const { linkId } = await seedCappedLink(CAP);
-			const store = new SupabaseShareLinkStore(envCtx!.bundle);
-
-			const outcomes = await Promise.all(
-				Array.from({ length: ATTEMPTS }, () => store.tryIncrementSolveCount(ctx, linkId))
-			);
-
-			const admitted = outcomes.filter((n): n is number => n !== null);
-			const refused = outcomes.filter((n) => n === null);
-			// Exactly CAP admitted — the atomic RPC never lets a concurrent burst
-			// overshoot the cap.
-			expect(admitted).toHaveLength(CAP);
-			expect(refused).toHaveLength(ATTEMPTS - CAP);
-			// Each admitted solve got a distinct slot 1..CAP — no lost update.
-			expect([...admitted].sort((a, b) => a - b)).toEqual([1, 2, 3, 4, 5]);
-
-			// The persisted count settles at exactly the cap.
-			const finalLink = await store.getById(ctx, linkId);
-			expect(finalLink?.solveCount).toBe(CAP);
-		});
-	});
-}

package/src/data/__tests__/share-link-conformance.test.ts

@@ -1,87 +0,0 @@
-import { describe, beforeEach, it } from 'vitest';
-import { runShareLinkStoreConformance } from '@selvajs/platform/testing';
-import { DEFAULT_ORG_PERMISSIONS } from '@selvajs/platform';
-import { SupabaseShareLinkStore } from '../SupabaseShareLinkStore.js';
-import { readEnv, resetAllData, seedUser } from './test-helpers.js';
-
-const envCtx = readEnv();
-
-if (!envCtx) {
-	describe.skip('SupabaseShareLinkStore (skipped: no live stack)', () => {
-		it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => {});
-	});
-} else {
-	describe('SupabaseShareLinkStore', () => {
-		beforeEach(async () => {
-			await resetAllData(envCtx);
-		});
-
-		runShareLinkStoreConformance({
-			name: 'SupabaseShareLinkStore',
-			createStore: () => new SupabaseShareLinkStore(envCtx.bundle),
-			createScope: async () => {
-				// Seed: 1 owner + 1 org + 1 project + 2 definitions. Share links
-				// FK to definitions, definitions FK to projects, projects FK to orgs.
-				const { userId: ownerId, sessionToken: ownerSessionToken } = await seedUser(envCtx, '');
-				const orgId = crypto.randomUUID();
-				const projectId = crypto.randomUUID();
-				const definitionId = crypto.randomUUID();
-				const otherDefinitionId = crypto.randomUUID();
-				const now = new Date().toISOString();
-				const admin = envCtx.adminClient;
-
-				const { error: orgError } = await admin.from('orgs').insert({
-					id: orgId,
-					name: 'Share Link Test Org',
-					slug: `sl-test-${orgId.slice(0, 8)}`,
-					owner_id: ownerId,
-					created_at: now,
-					updated_at: now
-				});
-				if (orgError) throw orgError;
-				const { error: memberError } = await admin.from('org_members').insert({
-					org_id: orgId,
-					user_id: ownerId,
-					role: 'owner',
-					permissions: [...DEFAULT_ORG_PERMISSIONS.owner],
-					joined_at: now
-				});
-				if (memberError) throw memberError;
-				const { error: projError } = await admin.from('projects').insert({
-					id: projectId,
-					org_id: orgId,
-					name: 'Project',
-					slug: `proj-${projectId.slice(0, 8)}`,
-					visibility: 'public',
-					owner_id: ownerId,
-					created_at: now,
-					updated_at: now
-				});
-				if (projError) throw projError;
-				const { error: defError } = await admin.from('definitions').insert([
-					{
-						guid: definitionId,
-						project_id: projectId,
-						owner_id: ownerId,
-						display_name: 'Def A',
-						status: 'published',
-						created_at: now,
-						updated_at: now
-					},
-					{
-						guid: otherDefinitionId,
-						project_id: projectId,
-						owner_id: ownerId,
-						display_name: 'Def B',
-						status: 'published',
-						created_at: now,
-						updated_at: now
-					}
-				]);
-				if (defError) throw defError;
-
-				return { ownerId, ownerSessionToken, definitionId, otherDefinitionId };
-			}
-		});
-	});
-}