@selvajs/supabase-provider 0.14.4-beta.0 → 0.15.0-beta.2

package/src/auth/__tests__/conformance.test.ts

@@ -1,78 +0,0 @@
-import { describe, beforeEach, it } from 'vitest';
-import { runAuthProviderConformance, runEmailLinkAuthConformance } from '@selvajs/platform/testing';
-import { SupabaseAuthProvider } from '../SupabaseAuthProvider.js';
-import { readEnv, resetAllData } from '../../data/__tests__/test-helpers.js';
-
-const envCtx = readEnv();
-
-if (!envCtx) {
-	describe.skip('SupabaseAuthProvider (skipped: no live stack)', () => {
-		it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => {});
-	});
-} else {
-	const ctx = envCtx; // non-null in this branch
-	// The auth conformance suite expects `verifyLogin('', adminPassword)` to
-	// succeed. Supabase requires a non-empty email, so we seed a deterministic
-	// admin email and have the suite use that via the `adminEmail` option.
-	const ADMIN_EMAIL = 'admin@conformance.test';
-	const ADMIN_PASSWORD = 'conformance-admin-password-1234';
-
-	async function ensureAdmin() {
-		const { data: existing } = await ctx.adminClient.auth.admin.listUsers({ perPage: 1000 });
-		const match = existing.users.find((u) => u.email === ADMIN_EMAIL);
-		if (match) return match.id;
-		const { data, error } = await ctx.adminClient.auth.admin.createUser({
-			email: ADMIN_EMAIL,
-			password: ADMIN_PASSWORD,
-			email_confirm: true
-		});
-		if (error) throw error;
-		return data.user.id;
-	}
-
-	async function makeProvider() {
-		const provider = new SupabaseAuthProvider({
-			supabaseUrl: ctx.url,
-			anonKey: ctx.anonKey,
-			serviceRoleKey: ctx.serviceRoleKey
-		});
-		// Ensure the admin account exists + has instance_admin.
-		const id = await ensureAdmin();
-		const { error: upError } = await ctx.adminClient
-			.from('user_profiles')
-			.update({ platform_permissions: ['instance_admin'] })
-			.eq('user_id', id);
-		if (upError) throw upError;
-		return { provider, adminPassword: ADMIN_PASSWORD };
-	}
-
-	describe('SupabaseAuthProvider', () => {
-		beforeEach(async () => {
-			await resetAllData(ctx);
-		});
-
-		runAuthProviderConformance({
-			name: 'SupabaseAuthProvider',
-			createProvider: async () => {
-				const { provider, adminPassword } = await makeProvider();
-				return { provider, adminPassword, adminEmail: ADMIN_EMAIL };
-			},
-			userManagement: true
-		});
-
-		runEmailLinkAuthConformance({
-			name: 'SupabaseEmailLinkAuth',
-			createAdapter: async () => {
-				const { provider } = await makeProvider();
-				return {
-					adapter: provider.emailLink,
-					// `validEmail` isn't used by the suite for live mail delivery;
-					// it just needs to look like a real address. The malformed
-					// case is what we actually assert on.
-					validEmail: 'real-looking@conformance.test',
-					invalidEmail: 'not-an-email-address'
-				};
-			}
-		});
-	});
-}

package/src/auth/__tests__/token-verification.test.ts

@@ -1,158 +0,0 @@
-/**
- * CI-runnable (no live stack) tests for §1b hybrid token verification. Stubs
- * the internal anon client's `getClaims` (local JWT verify) and `getUser`
- * (network GoTrue verify) so we can assert the network-call behavior directly.
- *
- * Contract:
- *  - hybrid (default): verify locally via getClaims on every request; hit
- *    getUser at most once per `revalidateMs` per session; a getUser rejection
- *    during that recheck (sign-out / disabled) denies immediately.
- *  - strict: getUser on every request.
- */
-
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { SupabaseAuthProvider } from '../SupabaseAuthProvider.js';
-
-const URL = 'https://example.supabase.co';
-const ANON = 'anon-key';
-const SERVICE = 'service-key';
-
-interface AuthStub {
-	getClaims: ReturnType<typeof vi.fn>;
-	getUser: ReturnType<typeof vi.fn>;
-}
-
-/** Reach into the provider's private anon client and replace its auth surface. */
-function stubAnonAuth(provider: SupabaseAuthProvider): AuthStub {
-	const stub: AuthStub = { getClaims: vi.fn(), getUser: vi.fn() };
-	// eslint-disable-next-line @typescript-eslint/no-explicit-any
-	(provider as any).anon.auth.getClaims = stub.getClaims;
-	// eslint-disable-next-line @typescript-eslint/no-explicit-any
-	(provider as any).anon.auth.getUser = stub.getUser;
-	return stub;
-}
-
-function okClaims(overrides: Record<string, unknown> = {}) {
-	return {
-		data: {
-			claims: {
-				sub: 'user-1',
-				session_id: 'sess-1',
-				email: 'u@example.com',
-				exp: Math.floor(Date.now() / 1000) + 3600,
-				...overrides
-			},
-			header: {},
-			signature: new Uint8Array()
-		},
-		error: null
-	};
-}
-
-function okUser() {
-	return {
-		data: { user: { id: 'user-1', email: 'u@example.com', user_metadata: {} } },
-		error: null
-	};
-}
-
-describe('SupabaseAuthProvider — hybrid token verification', () => {
-	beforeEach(() => vi.restoreAllMocks());
-
-	it('verifies locally via getClaims and rechecks getUser once per window', async () => {
-		const provider = new SupabaseAuthProvider({
-			supabaseUrl: URL,
-			anonKey: ANON,
-			serviceRoleKey: SERVICE,
-			revalidateMs: 60_000
-		});
-		const stub = stubAnonAuth(provider);
-		stub.getClaims.mockResolvedValue(okClaims());
-		stub.getUser.mockResolvedValue(okUser());
-
-		// First call: local verify + one recheck (never seen this session).
-		const a = await provider.verifyToken('tok');
-		expect(a?.id).toBe('user-1');
-		expect(stub.getClaims).toHaveBeenCalledTimes(1);
-		expect(stub.getUser).toHaveBeenCalledTimes(1);
-
-		// Subsequent calls within the window: local only, NO more getUser.
-		await provider.verifyToken('tok');
-		await provider.verifyToken('tok');
-		expect(stub.getClaims).toHaveBeenCalledTimes(3);
-		expect(stub.getUser).toHaveBeenCalledTimes(1); // still just the first
-	});
-
-	it('denies immediately when the periodic getUser recheck rejects (signed out / revoked)', async () => {
-		const provider = new SupabaseAuthProvider({
-			supabaseUrl: URL,
-			anonKey: ANON,
-			serviceRoleKey: SERVICE
-		});
-		const stub = stubAnonAuth(provider);
-		stub.getClaims.mockResolvedValue(okClaims());
-		stub.getUser.mockResolvedValue({ data: { user: null }, error: { message: 'signed out' } });
-
-		const result = await provider.verifyToken('tok');
-		expect(result).toBeNull();
-	});
-
-	it('denies when the claims already mark the user disabled (no getUser needed)', async () => {
-		const provider = new SupabaseAuthProvider({
-			supabaseUrl: URL,
-			anonKey: ANON,
-			serviceRoleKey: SERVICE
-		});
-		const stub = stubAnonAuth(provider);
-		stub.getClaims.mockResolvedValue(okClaims({ user_metadata: { disabled: true } }));
-
-		const result = await provider.verifyToken('tok');
-		expect(result).toBeNull();
-		expect(stub.getUser).not.toHaveBeenCalled();
-	});
-
-	it('denies when getClaims fails (bad signature / expired)', async () => {
-		const provider = new SupabaseAuthProvider({
-			supabaseUrl: URL,
-			anonKey: ANON,
-			serviceRoleKey: SERVICE
-		});
-		const stub = stubAnonAuth(provider);
-		stub.getClaims.mockResolvedValue({ data: null, error: { message: 'invalid JWT' } });
-
-		expect(await provider.verifyToken('tok')).toBeNull();
-		expect(stub.getUser).not.toHaveBeenCalled();
-	});
-
-	it('returns null for an empty token without any network call', async () => {
-		const provider = new SupabaseAuthProvider({
-			supabaseUrl: URL,
-			anonKey: ANON,
-			serviceRoleKey: SERVICE
-		});
-		const stub = stubAnonAuth(provider);
-		expect(await provider.verifyToken('')).toBeNull();
-		expect(stub.getClaims).not.toHaveBeenCalled();
-		expect(stub.getUser).not.toHaveBeenCalled();
-	});
-});
-
-describe('SupabaseAuthProvider — strict token verification', () => {
-	beforeEach(() => vi.restoreAllMocks());
-
-	it('calls getUser on every request and never getClaims', async () => {
-		const provider = new SupabaseAuthProvider({
-			supabaseUrl: URL,
-			anonKey: ANON,
-			serviceRoleKey: SERVICE,
-			tokenVerification: 'strict'
-		});
-		const stub = stubAnonAuth(provider);
-		stub.getUser.mockResolvedValue(okUser());
-
-		await provider.verifyToken('tok');
-		await provider.verifyToken('tok');
-		expect(stub.getUser).toHaveBeenCalledTimes(2);
-		expect(stub.getClaims).not.toHaveBeenCalled();
-	});
-});

package/src/auth/index.ts

@@ -1,2 +0,0 @@
-export { SupabaseAuthProvider } from './SupabaseAuthProvider.js';
-export type { SupabaseAuthProviderConfig } from './SupabaseAuthProvider.js';

package/src/cli/sync-migrations.ts

@@ -1,133 +0,0 @@
-#!/usr/bin/env node
-// ============================================================================
-// sync-migrations — copy this package's Supabase migrations into a consuming
-// app's supabase/migrations/ directory.
-//
-// Migrations ship with deterministic timestamp-prefixed filenames
-// (<UTCtimestamp>_selva_<name>.sql) so they slot into a consuming app's own
-// migration timeline without colliding, and so every machine/CI produces a
-// byte-identical migration history. We copy verbatim — no rename at copy time,
-// which is what keeps the history stable.
-//
-// Usage:
-//   npx @selvajs/supabase-provider sync-migrations [--dir <path>] [--force]
-//
-//   --dir <path>   Target migrations dir (default: ./supabase/migrations)
-//   --force        Overwrite files that exist with differing content
-// ============================================================================
-
-import { fileURLToPath } from 'node:url';
-import { dirname, join, resolve } from 'node:path';
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
-
-const here = dirname(fileURLToPath(import.meta.url));
-
-// dist/cli/ -> package root is two levels up; migrations ship alongside src/dist.
-const packageRoot = resolve(here, '..', '..');
-const sourceDir = join(packageRoot, 'supabase', 'migrations');
-
-interface Options {
-	targetDir: string;
-	force: boolean;
-}
-
-function parseArgs(argv: string[]): Options {
-	let targetDir = resolve(process.cwd(), 'supabase', 'migrations');
-	let force = false;
-
-	for (let i = 0; i < argv.length; i++) {
-		const arg = argv[i];
-		if (arg === '--dir') {
-			const value = argv[++i];
-			if (!value) fail('--dir requires a path argument');
-			targetDir = resolve(process.cwd(), value);
-		} else if (arg === '--force') {
-			force = true;
-		} else if (arg === '--help' || arg === '-h') {
-			printHelp();
-			process.exit(0);
-		} else {
-			fail(`unknown argument: ${arg}`);
-		}
-	}
-
-	return { targetDir, force };
-}
-
-function printHelp(): void {
-	console.log(
-		[
-			'sync-migrations — copy @selvajs/supabase-provider migrations into your app.',
-			'',
-			'Usage:',
-			'  npx @selvajs/supabase-provider sync-migrations [--dir <path>] [--force]',
-			'',
-			'  --dir <path>   Target migrations dir (default: ./supabase/migrations)',
-			'  --force        Overwrite files that exist with differing content',
-			'',
-			'After syncing, apply with: npx supabase db push'
-		].join('\n')
-	);
-}
-
-function fail(message: string): never {
-	console.error(`error: ${message}`);
-	process.exit(1);
-}
-
-function main(): void {
-	const { targetDir, force } = parseArgs(process.argv.slice(2));
-
-	if (!existsSync(sourceDir)) {
-		fail(`could not locate packaged migrations at ${sourceDir}`);
-	}
-
-	const files = readdirSync(sourceDir)
-		.filter((name) => name.endsWith('.sql'))
-		.sort();
-
-	if (files.length === 0) {
-		fail(`no .sql migrations found in ${sourceDir}`);
-	}
-
-	mkdirSync(targetDir, { recursive: true });
-
-	let copied = 0;
-	let skipped = 0;
-	let conflicts = 0;
-
-	for (const name of files) {
-		const from = join(sourceDir, name);
-		const to = join(targetDir, name);
-		const contents = readFileSync(from);
-
-		if (existsSync(to)) {
-			const existing = readFileSync(to);
-			if (existing.equals(contents)) {
-				skipped++;
-				continue;
-			}
-			if (!force) {
-				console.warn(
-					`  conflict  ${name} exists with different content (use --force to overwrite)`
-				);
-				conflicts++;
-				continue;
-			}
-		}
-
-		writeFileSync(to, contents);
-		console.log(`  copied    ${name}`);
-		copied++;
-	}
-
-	console.log(`\n${copied} copied, ${skipped} unchanged, ${conflicts} conflict(s) -> ${targetDir}`);
-
-	if (conflicts > 0) {
-		process.exit(1);
-	}
-
-	console.log('\nNext: review the files, then run  npx supabase db push');
-}
-
-main();

package/src/data/SupabaseAuditQuery.ts

@@ -1,103 +0,0 @@
-import type {
-	AuditEventRow,
-	AuditQueryFilters,
-	AuditQueryResult,
-	DomainEvent,
-	IAuditQuery,
-	RequestContext
-} from '@selvajs/platform';
-import type { ClientBundle } from './client.js';
-
-const MAX_LIMIT = 200;
-const DEFAULT_LIMIT = 100;
-
-// Cursor values are interpolated into PostgREST filter strings — both formats
-// must be validated before any string concatenation reaches the query.
-const ISO_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})$/;
-const UUID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
-
-/**
- * Read-side for `audit_events`. Always uses the service-role client — RLS
- * blocks all read access by design, so the route layer is the single trust
- * boundary (callers must gate on `instance_admin`).
- *
- * Pagination is keyset on `(occurred_at desc, id desc)`. The `id` tie-breaker
- * prevents skipped rows when multiple events land in the same millisecond.
- */
-export class SupabaseAuditQuery implements IAuditQuery {
-	constructor(private readonly clients: ClientBundle) {}
-
-	async list(_ctx: RequestContext, filters: AuditQueryFilters): Promise<AuditQueryResult> {
-		const limit = clampLimit(filters.limit);
-
-		let q = this.clients.serviceClient
-			.from('audit_events')
-			.select('id, type, actor_id, occurred_at, data')
-			.order('occurred_at', { ascending: false })
-			.order('id', { ascending: false })
-			// Fetch one extra row to detect "has next page" without a count query.
-			.limit(limit + 1);
-
-		if (filters.types && filters.types.length > 0) {
-			q = q.in('type', [...filters.types]);
-		}
-		if (filters.actorId) {
-			q = q.eq('actor_id', filters.actorId);
-		}
-		if (filters.sinceIso) {
-			q = q.gte('occurred_at', filters.sinceIso);
-		}
-		if (filters.untilIso) {
-			q = q.lte('occurred_at', filters.untilIso);
-		}
-		if (filters.cursor) {
-			// `(occurred_at, id) < (cursorTs, cursorId)` expressed for PostgREST:
-			// strictly older OR same timestamp with a strictly smaller id.
-			//
-			// Both values are interpolated into a `.or()` filter string. Validate
-			// shape before interpolation — without these guards a malformed cursor
-			// (or a hand-crafted URL by a route caller) could break out of the
-			// filter and combine with arbitrary PostgREST operators.
-			const ts = filters.cursor.occurredAt;
-			const id = filters.cursor.id;
-			if (!ISO_RE.test(ts) || !UUID_RE.test(id)) {
-				throw new Error('audit_events query: malformed cursor');
-			}
-			q = q.or(`occurred_at.lt.${ts},and(occurred_at.eq.${ts},id.lt.${id})`);
-		}
-
-		const { data, error } = await q;
-		if (error) {
-			throw new Error(`audit_events query failed: ${error.message}`);
-		}
-
-		const fetched = (data ?? []) as Array<{
-			id: string;
-			type: string;
-			actor_id: string;
-			occurred_at: string;
-			data: DomainEvent;
-		}>;
-
-		const hasMore = fetched.length > limit;
-		const page = hasMore ? fetched.slice(0, limit) : fetched;
-		const last = page[page.length - 1];
-
-		return {
-			rows: page.map((r) => ({
-				id: r.id,
-				type: r.type as DomainEvent['type'],
-				actorId: r.actor_id,
-				occurredAt: r.occurred_at,
-				data: r.data
-			})) satisfies AuditEventRow[],
-			nextCursor: hasMore && last ? { occurredAt: last.occurred_at, id: last.id } : null
-		};
-	}
-}
-
-function clampLimit(requested: number | undefined): number {
-	if (!requested || requested <= 0) return DEFAULT_LIMIT;
-	if (requested > MAX_LIMIT) return MAX_LIMIT;
-	return Math.floor(requested);
-}