@selvajs/supabase-provider 0.14.4-beta.0 → 0.15.0-beta.2

package/src/data/SupabaseComputeServerStore.ts

@@ -1,382 +0,0 @@
-import {
-	isOrgServer,
-	isPlatformServer,
-	type IComputeServerStore,
-	type ComputeConfig,
-	type ComputeServerConfig,
-	type RequestContext,
-	type SecretVerificationFailure,
-	type SecretVerificationReport
-} from '@selvajs/platform';
-// Secret crypto functions come from the server-only subpath (they use
-// `node:crypto`, kept out of the root barrel so client bundles don't pull it in).
-import { decryptSecret, encryptSecret, isEncryptedSecret } from '@selvajs/platform/computeServer';
-import type { ClientBundle } from './client.js';
-import { mapPostgrestError } from './errors.js';
-
-/** Explicit column list for `compute_servers` — every field `rowToServer` consumes. */
-const SERVER_COLUMNS =
-	'id, scope, owner_org_id, shared_with_all, label, server_url, api_key, timeout_ms, retry_count';
-/** Columns from the share join table read in `getConfig`. */
-const SHARE_COLUMNS = 'server_id, org_id';
-/** Columns from the per-org default table read in `getConfig`. */
-const ORG_DEFAULT_COLUMNS = 'org_id, default_server_id';
-
-/**
- * Compute-server config backed by three tables:
- *   - `compute_servers`: one row per server. `scope = 'platform' | 'org'`.
- *     Platform rows carry a `shared_with_all` flag + `compute_server_shares`
- *     allowlist; org rows carry `owner_org_id`.
- *   - `compute_server_shares`: many-to-many for platform servers shared
- *     with specific orgs (when `shared_with_all = false`).
- *   - `compute_server_org_defaults`: per-org `orgDefaults[orgId]` choice.
- *   - `compute_server_platform_default`: single-row sentinel for the global
- *     `defaultServerId`.
- *
- * `getConfig` returns the full doc; the visibility predicate is applied by
- * callers (resolver, page loaders) using helpers in `@selvajs/platform`.
- */
-export class SupabaseComputeServerStore implements IComputeServerStore {
-	/**
-	 * `secretKey` (from `SELVA_AT_REST_KEY`) encrypts `api_key` before it is
-	 * written to `compute_servers.api_key` and decrypts it on read, so the
-	 * Rhino.Compute credential never sits in the DB as plaintext — matching the
-	 * local provider's on-disk envelope. Optional only for legacy construction
-	 * paths (tests that never touch apiKeys); a store built without a key throws
-	 * if asked to write or read a secret. Wire it via `SupabaseDataProvider`.
-	 */
-	constructor(
-		private readonly clients: ClientBundle,
-		private readonly secretKey?: Buffer
-	) {}
-
-	async getConfig(ctx: RequestContext): Promise<ComputeConfig> {
-		const client = this.clients.forRequest(ctx);
-
-		const [serversRes, sharesRes, orgDefRes, platDefRes] = await Promise.all([
-			client.from('compute_servers').select(SERVER_COLUMNS),
-			client.from('compute_server_shares').select(SHARE_COLUMNS),
-			client.from('compute_server_org_defaults').select(ORG_DEFAULT_COLUMNS),
-			client
-				.from('compute_server_platform_default')
-				.select('default_server_id')
-				.eq('singleton', true)
-				.maybeSingle()
-		]);
-
-		if (serversRes.error) throw mapPostgrestError(serversRes.error);
-		if (sharesRes.error) throw mapPostgrestError(sharesRes.error);
-		if (orgDefRes.error) throw mapPostgrestError(orgDefRes.error);
-		if (platDefRes.error) throw mapPostgrestError(platDefRes.error);
-
-		// Build per-server `sharedWith` allowlists from the join table.
-		const sharedByServer = new Map<string, string[]>();
-		for (const row of sharesRes.data ?? []) {
-			const list = sharedByServer.get(row.server_id) ?? [];
-			list.push(row.org_id);
-			sharedByServer.set(row.server_id, list);
-		}
-
-		const servers = (serversRes.data ?? []).map((row) =>
-			rowToServer(this.decryptRowApiKey(row), sharedByServer)
-		);
-
-		const orgDefaults: Record<string, string> = {};
-		for (const row of orgDefRes.data ?? []) {
-			if (row.default_server_id) orgDefaults[row.org_id] = row.default_server_id;
-		}
-
-		return {
-			servers,
-			defaultServerId: platDefRes.data?.default_server_id ?? undefined,
-			orgDefaults
-		};
-	}
-
-	async savePlatformServers(
-		ctx: RequestContext,
-		servers: ComputeServerConfig[],
-		defaultServerId: string | undefined
-	): Promise<void> {
-		const client = this.clients.forRequest(ctx);
-		const platformOnly = servers.filter(isPlatformServer);
-
-		// Replace-all of platform rows.
-		const { error: delErr } = await client.from('compute_servers').delete().eq('scope', 'platform');
-		if (delErr) throw mapPostgrestError(delErr);
-
-		if (platformOnly.length > 0) {
-			const { error: insErr } = await client
-				.from('compute_servers')
-				.insert(platformOnly.map((s) => serverToRow(this.encryptServerApiKey(s))));
-			if (insErr) throw mapPostgrestError(insErr);
-
-			// Rebuild the share rows for any non-`all` platform servers.
-			const shareRows = platformOnly.flatMap((s) =>
-				s.sharedWith === 'all'
-					? []
-					: s.sharedWith.map((orgId) => ({ server_id: s.id, org_id: orgId }))
-			);
-			if (shareRows.length > 0) {
-				const { error: shErr } = await client.from('compute_server_shares').insert(shareRows);
-				if (shErr) throw mapPostgrestError(shErr);
-			}
-		}
-
-		const { error: defErr } = await client
-			.from('compute_server_platform_default')
-			.update({ default_server_id: defaultServerId ?? null })
-			.eq('singleton', true);
-		if (defErr) throw mapPostgrestError(defErr);
-	}
-
-	async saveOrgServers(
-		ctx: RequestContext,
-		orgId: string,
-		servers: ComputeServerConfig[],
-		defaultServerId?: string | null
-	): Promise<void> {
-		const client = this.clients.forRequest(ctx);
-		const orgOnly = servers.filter(isOrgServer).map((s) => ({ ...s, ownerOrgId: orgId }));
-
-		const { error: delErr } = await client
-			.from('compute_servers')
-			.delete()
-			.eq('scope', 'org')
-			.eq('owner_org_id', orgId);
-		if (delErr) throw mapPostgrestError(delErr);
-
-		if (orgOnly.length > 0) {
-			const { error: insErr } = await client
-				.from('compute_servers')
-				.insert(orgOnly.map((s) => serverToRow(this.encryptServerApiKey(s))));
-			if (insErr) throw mapPostgrestError(insErr);
-		}
-
-		if (defaultServerId === null) {
-			const { error } = await client
-				.from('compute_server_org_defaults')
-				.delete()
-				.eq('org_id', orgId);
-			if (error) throw mapPostgrestError(error);
-		} else if (typeof defaultServerId === 'string') {
-			const { error } = await client
-				.from('compute_server_org_defaults')
-				.upsert({ org_id: orgId, default_server_id: defaultServerId });
-			if (error) throw mapPostgrestError(error);
-		}
-	}
-
-	async setOrgDefault(ctx: RequestContext, orgId: string, serverId: string | null): Promise<void> {
-		const client = this.clients.forRequest(ctx);
-		if (serverId === null) {
-			const { error } = await client
-				.from('compute_server_org_defaults')
-				.delete()
-				.eq('org_id', orgId);
-			if (error) throw mapPostgrestError(error);
-			return;
-		}
-		const { error } = await client
-			.from('compute_server_org_defaults')
-			.upsert({ org_id: orgId, default_server_id: serverId });
-		if (error) throw mapPostgrestError(error);
-	}
-
-	async deleteByOrg(ctx: RequestContext, orgId: string): Promise<void> {
-		const client = this.clients.forRequest(ctx);
-
-		// orgDefaults entry — FK on org_id cascades from orgs(id), but org
-		// soft-delete doesn't trigger the cascade, so do it explicitly.
-		const { error: defErr } = await client
-			.from('compute_server_org_defaults')
-			.delete()
-			.eq('org_id', orgId);
-		if (defErr) throw mapPostgrestError(defErr);
-
-		// Org-private servers owned by this org.
-		const { error: srvErr } = await client
-			.from('compute_servers')
-			.delete()
-			.eq('scope', 'org')
-			.eq('owner_org_id', orgId);
-		if (srvErr) throw mapPostgrestError(srvErr);
-
-		// Strip this org from any platform server share allowlist.
-		const { error: shErr } = await client
-			.from('compute_server_shares')
-			.delete()
-			.eq('org_id', orgId);
-		if (shErr) throw mapPostgrestError(shErr);
-	}
-
-	// ==========================================================================
-	// At-rest secret handling
-	// ==========================================================================
-
-	/**
-	 * Encrypt a server's `apiKey` before it is written to the DB. Idempotent —
-	 * an already-enveloped value is passed through, so a round-trip (read →
-	 * save) never double-encrypts. Throws if the store was built without a key
-	 * but a real secret needs writing, so we never silently persist plaintext.
-	 */
-	private encryptServerApiKey(s: ComputeServerConfig): ComputeServerConfig {
-		if (!s.apiKey) return s;
-		if (isEncryptedSecret(s.apiKey)) return s;
-		if (!this.secretKey) {
-			throw new Error(
-				'Cannot store a compute-server apiKey: SELVA_AT_REST_KEY is not configured. ' +
-					'Set it so secrets are encrypted at rest.'
-			);
-		}
-		return { ...s, apiKey: encryptSecret(s.apiKey, this.secretKey) };
-	}
-
-	/**
-	 * Decrypt a row's `api_key` on read. Tolerant, mirroring the local provider:
-	 * a row whose ciphertext can't be authenticated under the current key is
-	 * returned with `api_key: null` and a warning logged, so the page keeps
-	 * rendering (solves against that server fail later at Rhino.Compute). A
-	 * plaintext value that predates encryption is passed through unchanged and
-	 * surfaced by `verifySecrets()` — never silently dropped.
-	 */
-	private decryptRowApiKey(row: ServerRow): ServerRow {
-		if (!row.api_key) return row;
-		if (!isEncryptedSecret(row.api_key)) {
-			// Legacy/hand-inserted plaintext. Pass through so an existing key
-			// keeps working; verifySecrets() flags it for re-save via /admin/compute.
-			console.warn(
-				`[selva] compute_servers row "${row.label}" (${row.id}) has a plaintext api_key. ` +
-					'Re-save it via /admin/compute so it is stored encrypted.'
-			);
-			return row;
-		}
-		if (!this.secretKey) {
-			console.warn(
-				`[selva] Cannot decrypt api_key for compute server "${row.label}" (${row.id}): ` +
-					'SELVA_AT_REST_KEY is not configured. Returning without a key; solves will fail.'
-			);
-			return { ...row, api_key: null };
-		}
-		try {
-			return { ...row, api_key: decryptSecret(row.api_key, this.secretKey) };
-		} catch (cause) {
-			console.warn(
-				`[selva] Could not decrypt api_key for compute server "${row.label}" (${row.id}). ` +
-					'The stored ciphertext does not match the current SELVA_AT_REST_KEY. ' +
-					'This server will be returned without an apiKey; solves against it will fail. ' +
-					'Re-enter the key via /admin/compute, or restore the original SELVA_AT_REST_KEY.',
-				cause
-			);
-			return { ...row, api_key: null };
-		}
-	}
-
-	/**
-	 * Boot-time integrity check over every `compute_servers` row. Uses the
-	 * service client (no request context at boot) to read raw ciphertext, then
-	 * attempts to decrypt each `api_key`. Does NOT throw — returns a structured
-	 * report for boot health to drive `/api/health`.
-	 */
-	async verifySecrets(): Promise<SecretVerificationReport> {
-		const { data, error } = await this.clients.serviceClient
-			.from('compute_servers')
-			.select('id, label, api_key');
-		if (error) throw mapPostgrestError(error);
-
-		const failures: SecretVerificationFailure[] = [];
-		let plaintextFound = false;
-
-		for (const row of data ?? []) {
-			const apiKey = (row as { api_key: string | null }).api_key;
-			const id = (row as { id: string }).id;
-			const label = (row as { label: string }).label;
-			if (!apiKey) continue;
-			if (!isEncryptedSecret(apiKey)) {
-				plaintextFound = true;
-				failures.push({ serverId: id, serverLabel: label, reason: 'plaintext_on_disk' });
-				continue;
-			}
-			if (!this.secretKey) {
-				failures.push({
-					serverId: id,
-					serverLabel: label,
-					reason: 'key_mismatch',
-					cause: 'SELVA_AT_REST_KEY is not configured'
-				});
-				continue;
-			}
-			try {
-				decryptSecret(apiKey, this.secretKey);
-			} catch (cause) {
-				failures.push({
-					serverId: id,
-					serverLabel: label,
-					reason: 'key_mismatch',
-					cause: cause instanceof Error ? cause.message : String(cause)
-				});
-			}
-		}
-
-		return { ok: failures.length === 0, failures, plaintextFound };
-	}
-}
-
-interface ServerRow {
-	id: string;
-	scope: 'platform' | 'org';
-	owner_org_id: string | null;
-	shared_with_all: boolean;
-	label: string;
-	server_url: string;
-	api_key: string | null;
-	timeout_ms: number | null;
-	retry_count: number | null;
-}
-
-function rowToServer(row: ServerRow, sharedByServer: Map<string, string[]>): ComputeServerConfig {
-	const common = {
-		id: row.id,
-		label: row.label,
-		serverUrl: row.server_url,
-		apiKey: row.api_key ?? undefined,
-		timeoutMs: row.timeout_ms ?? undefined,
-		retryCount: row.retry_count ?? undefined
-	};
-	if (row.scope === 'platform') {
-		return {
-			...common,
-			scope: 'platform',
-			sharedWith: row.shared_with_all ? 'all' : (sharedByServer.get(row.id) ?? [])
-		};
-	}
-	if (!row.owner_org_id) {
-		throw new Error(`compute_servers row ${row.id} has scope='org' but null owner_org_id`);
-	}
-	return { ...common, scope: 'org', ownerOrgId: row.owner_org_id };
-}
-
-function serverToRow(s: ComputeServerConfig): ServerRow {
-	const base = {
-		id: s.id,
-		label: s.label,
-		server_url: s.serverUrl,
-		api_key: s.apiKey ?? null,
-		timeout_ms: s.timeoutMs ?? null,
-		retry_count: s.retryCount ?? null
-	};
-	if (isPlatformServer(s)) {
-		return {
-			...base,
-			scope: 'platform',
-			owner_org_id: null,
-			shared_with_all: s.sharedWith === 'all'
-		};
-	}
-	return {
-		...base,
-		scope: 'org',
-		owner_org_id: s.ownerOrgId,
-		shared_with_all: false
-	};
-}

package/src/data/SupabaseDataProvider.ts

@@ -1,153 +0,0 @@
-import type { IDataProvider, IEventSink, IPlatformProjectGrantStore } from '@selvajs/platform';
-import { ProviderError } from '@selvajs/platform';
-import { decodeSecretKey } from '@selvajs/platform/computeServer';
-import type { ClientBundle, BuildClientOptions } from './client.js';
-import { buildClientBundle, clientBundleFromEnv } from './client.js';
-import { SupabaseEventSink } from './SupabaseEventSink.js';
-import { SupabaseSolveMetricSink } from './SupabaseSolveMetricSink.js';
-import { SupabaseAuditQuery } from './SupabaseAuditQuery.js';
-import { SupabaseOrgStore } from './SupabaseOrgStore.js';
-import { SupabaseProjectStore } from './SupabaseProjectStore.js';
-import { SupabaseDefinitionStore } from './SupabaseDefinitionStore.js';
-import { SupabaseInviteStore } from './SupabaseInviteStore.js';
-import { SupabaseComputeServerStore } from './SupabaseComputeServerStore.js';
-import { SupabaseShareLinkStore } from './SupabaseShareLinkStore.js';
-import { SupabaseUserProfileProvider } from '../userProfile/SupabaseUserProfileProvider.js';
-import { SupabasePlatformPermissionStore } from '../permissions/SupabasePlatformPermissionStore.js';
-
-/**
- * Stub until the Supabase implementation lands. Reads and mutations surface a
- * clear 501; cascade hooks are silent no-ops so deleting an org or project on
- * a Supabase deployment without the feature wired does not blow up.
- */
-const NOT_IMPLEMENTED_MSG = 'Platform projects are not supported on this deployment yet.';
-const notImplementedGrantStore: IPlatformProjectGrantStore = {
-	listByProject: async () => {
-		throw new ProviderError(NOT_IMPLEMENTED_MSG, 501);
-	},
-	create: async () => {
-		throw new ProviderError(NOT_IMPLEMENTED_MSG, 501);
-	},
-	delete: async () => {
-		throw new ProviderError(NOT_IMPLEMENTED_MSG, 501);
-	},
-	deleteByProject: async () => {
-		// No-op: nothing to clean up on a deployment that never accepted grants.
-	},
-	deleteByGranteeOrg: async () => {
-		// No-op: same reasoning.
-	}
-};
-
-/**
- * Composition of every data store for the Supabase backend. Instantiates one
- * `ClientBundle` (service-role + per-request factory) and wires each store
- * against it so every store in a single process shares the same pooled clients.
- */
-export class SupabaseDataProvider implements IDataProvider {
-	readonly orgs: SupabaseOrgStore;
-	readonly projects: SupabaseProjectStore;
-	readonly definitions: SupabaseDefinitionStore;
-	readonly invites: SupabaseInviteStore;
-	readonly computeServer: SupabaseComputeServerStore;
-	readonly shareLinks: SupabaseShareLinkStore;
-	readonly userProfile: SupabaseUserProfileProvider;
-	readonly permissions: SupabasePlatformPermissionStore;
-	readonly platformProjectGrants: IPlatformProjectGrantStore;
-	readonly auditQuery: SupabaseAuditQuery;
-	/**
-	 * Per-solve timing sink, built from the same client bundle. Exposed so the
-	 * app's provider wiring can hand it to `SelvaConfig.solveMetrics` without
-	 * constructing a second Supabase client.
-	 */
-	readonly solveMetrics: SupabaseSolveMetricSink;
-
-	private constructor(
-		private readonly clients: ClientBundle,
-		events: IEventSink,
-		secretKey?: Buffer
-	) {
-		this.solveMetrics = new SupabaseSolveMetricSink(clients);
-		this.orgs = new SupabaseOrgStore(clients, events);
-		this.projects = new SupabaseProjectStore(clients, events);
-		this.definitions = new SupabaseDefinitionStore(clients, events);
-		this.invites = new SupabaseInviteStore(clients, events);
-		this.computeServer = new SupabaseComputeServerStore(clients, secretKey);
-		this.shareLinks = new SupabaseShareLinkStore(clients, events);
-		this.userProfile = new SupabaseUserProfileProvider(clients);
-		this.permissions = new SupabasePlatformPermissionStore(clients);
-		this.platformProjectGrants = notImplementedGrantStore;
-		this.auditQuery = new SupabaseAuditQuery(clients);
-	}
-
-	static fromEnv(
-		env: Record<string, string | undefined>,
-		events?: IEventSink
-	): SupabaseDataProvider {
-		// Bundle-only env parse (URL + anon + service-role) is shared with
-		// `clientBundleFromEnv`; the full data provider additionally requires the
-		// at-rest key below.
-		const bundle = clientBundleFromEnv(env);
-		// Required so compute-server apiKeys are encrypted at rest in the DB —
-		// same guarantee (and same key) as the local provider's on-disk envelope.
-		if (!env.SELVA_AT_REST_KEY) {
-			throw new Error(
-				'Missing required env var: SELVA_AT_REST_KEY (32-byte hex or base64). ' +
-					'Required to encrypt compute-server API keys at rest. ' +
-					"Generate one with: node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\""
-			);
-		}
-		const secretKey = decodeSecretKey(env.SELVA_AT_REST_KEY);
-		return new SupabaseDataProvider(bundle, events ?? new SupabaseEventSink(bundle), secretKey);
-	}
-
-	static create(
-		opts: BuildClientOptions,
-		events?: IEventSink,
-		secretKey?: Buffer
-	): SupabaseDataProvider {
-		const bundle = buildClientBundle(opts);
-		return new SupabaseDataProvider(bundle, events ?? new SupabaseEventSink(bundle), secretKey);
-	}
-
-	/**
-	 * Build from a pre-existing `ClientBundle`. Useful for tests or advanced
-	 * cases that need to inject a custom event sink or share a bundle externally.
-	 * `secretKey` is optional here — omit it only when the caller never touches
-	 * compute-server apiKeys (writes without a key throw rather than persist
-	 * plaintext).
-	 */
-	static fromBundle(
-		bundle: ClientBundle,
-		events?: IEventSink,
-		secretKey?: Buffer
-	): SupabaseDataProvider {
-		return new SupabaseDataProvider(bundle, events ?? new SupabaseEventSink(bundle), secretKey);
-	}
-
-	/**
-	 * Expose the underlying bundle so other providers in the same package
-	 * (storage, user profile, auth) can share one set of clients per process.
-	 */
-	getClientBundle(): ClientBundle {
-		return this.clients;
-	}
-
-	/**
-	 * No-op: `public.user_profiles` is auto-seeded by the `handle_new_auth_user`
-	 * trigger on every `auth.users` insert (see `0001_initial.sql`). The data
-	 * layer always has a row for any authenticated user without per-request work.
-	 */
-	async ensureUser(): Promise<void> {
-		// Trigger handles it.
-	}
-
-	/**
-	 * No-op: `public.user_profiles.user_id` references `auth.users(id)` with
-	 * `on delete cascade`. Deleting the auth user removes the profile row
-	 * automatically.
-	 */
-	async onUserDeleted(): Promise<void> {
-		// FK cascade handles it.
-	}
-}