@starci/hfs 4.9.11 → 4.10.0

package/templates/be/patterns/jobs/platform-lite/job-claim.service.ts.tpl

@@ -0,0 +1,114 @@
+import { Injectable } from "@nestjs/common"
+import type { EntityManager } from "typeorm"
+import { InjectClock } from "@modules/platform/clock"
+import type { Clock } from "@modules/platform/clock"
+import { JobsError, JobsErrorCode } from "./errors/jobs.error"
+import { callDbFunction } from "@modules/platform/database"
+import { isRunKey } from "./jobs.contracts"
+import type {
+    AdvanceWrite,
+    ClaimedJob,
+    ClaimParams,
+    ClaimResult,
+    FailWrite,
+    GuardedWrite,
+    RunKey,
+} from "./jobs.contracts"
+import { InjectJobsManagers } from "./jobs.decorators"
+import type { JobClaims } from "./jobs.port"
+
+/** The record job_claim returns (a bigint arrives as text). */
+interface ClaimedRecord {
+    /** The id of the job row. */
+    readonly id: string
+    /** The kind of the job. */
+    readonly kind: string
+    /** The fencing token after the claim. */
+    readonly fencing_token: string
+    /** The last recorded step, or null. */
+    readonly current_step: string | null
+    /** The payload, as the database returns the jsonb value. */
+    readonly payload: object
+}
+
+@Injectable()
+/**
+ * The one owner of the job row, through the job_* functions of its migration (R334). A claim is one atomic upsert that bumps the fencing token in the store, so two workers can never
+ * hold the same token; every other write is `WHERE fencing_token = <expected>`, so a worker that lost its claim (a zombie) changes
+ * nothing and learns it from `JobFencedOut`.
+ */
+export class JobClaimService implements JobClaims {
+    constructor(
+        @InjectJobsManagers() private readonly managers: ReadonlyArray<EntityManager>,
+        @InjectClock() private readonly clock: Clock,
+    ) {}
+
+    /** Claims the delivery; null when the job is done or another worker holds a claim that has not expired. */
+    async claim(params: ClaimParams): Promise<ClaimResult> {
+        const now = this.clock.now()
+        const rows = await callDbFunction<ClaimedRecord>(this.writer(), "job_claim", [
+            params.kind,
+            params.jobKey,
+            params.workerId,
+            new Date(now.getTime() + params.leaseMs),
+            JSON.stringify(params.payload),
+            now,
+        ])
+        const row = rows[0]
+        if (row === undefined) return null
+        // The durable delivery supplies the same request id on every retry; the job fence identifies a claim separately.
+        return {
+            jobId: row.id,
+            correlationId: params.correlationId,
+            kind: row.kind,
+            fencingToken: Number(row.fencing_token),
+            currentStep: row.current_step,
+            payload: row.payload,
+        }
+    }
+
+    /** Records a finished step under the token the caller holds. */
+    advance(write: AdvanceWrite): Promise<void> {
+        return this.guarded("job_advance", [write.jobId, write.expectedFencingToken, write.step, this.clock.now()], write)
+    }
+
+    /** Completes the job under the token the caller holds. */
+    complete(write: GuardedWrite): Promise<void> {
+        return this.guarded("job_complete", [write.jobId, write.expectedFencingToken, this.clock.now()], write)
+    }
+
+    /** Marks the job failed under the token the caller holds, so BullMQ can retry it. */
+    fail(write: FailWrite): Promise<void> {
+        return this.guarded("job_fail", [write.jobId, write.expectedFencingToken, write.reason, this.clock.now()], write)
+    }
+
+    /** The idempotency key of one step of this claim: it includes the token, so a zombie's repeat is a different key than the live worker's. */
+    runKey(job: ClaimedJob, step: string): RunKey {
+        const key = `${job.jobId}:${step}:${job.fencingToken}`
+        if (!isRunKey(key))
+            throw new JobsError({ code: JobsErrorCode.RunKeyInvalid, params: { jobId: job.jobId, step } })
+        return key
+    }
+
+    /** The entity manager of the connection that holds the job table. */
+    private writer(): EntityManager {
+        const [manager] = this.managers
+        if (manager === undefined) throw new JobsError({ code: JobsErrorCode.ConnectionMissing })
+        return manager
+    }
+
+    /** Runs a guarded function that updates only when the token still matches; no row back means a newer worker owns the job. */
+    private async guarded(
+        fn: "job_advance" | "job_complete" | "job_fail",
+        parameters: Array<unknown>,
+        write: GuardedWrite,
+    ): Promise<void> {
+        const rows = await callDbFunction<object>(this.writer(), fn, parameters)
+        if (rows.length === 0) {
+            throw new JobsError({
+                code: JobsErrorCode.FencedOut,
+                params: { jobId: write.jobId, token: write.expectedFencingToken },
+            })
+        }
+    }
+}

package/templates/be/patterns/jobs/platform-lite/jobs.sql.tpl

@@ -42,3 +42,54 @@ with check (kind is not null);
 
 revoke all on table public.jobs from public, anon, authenticated;
 grant select, insert, update on table public.jobs to app_be;
+
+-- The claim and the guarded writes, called through callDbFunction of platform/database (R334). A claim inserts a new key with
+-- token 1 or claims a failed or expired one again, bumping the token; a done job or a live claim returns no row. Every other
+-- write matches only the token the caller holds, so a worker that lost its claim changes nothing and gets no row back.
+create function public.job_claim(p_kind varchar, p_job_key varchar, p_worker varchar, p_lease_end timestamptz, p_payload jsonb, p_now timestamptz)
+returns table (id uuid, kind varchar, fencing_token bigint, current_step varchar, payload jsonb)
+language sql
+as $$
+    insert into public.jobs as j (kind, job_key, status, fencing_token, claimed_by, lease_expires_at, payload, created_at, updated_at)
+    values (p_kind, p_job_key, 'running', 1, p_worker, p_lease_end, p_payload, p_now, p_now)
+    on conflict (job_key) do update
+       set fencing_token = j.fencing_token + 1, claimed_by = p_worker, lease_expires_at = p_lease_end, status = 'running', error = null, updated_at = p_now
+     where j.status = 'failed' or (j.status = 'running' and j.lease_expires_at < p_now)
+    returning j.id, j.kind, j.fencing_token, j.current_step, j.payload
+$$;
+
+create function public.job_advance(p_id uuid, p_token bigint, p_step varchar, p_now timestamptz)
+returns table (id uuid)
+language sql
+as $$
+    update public.jobs as j set current_step = p_step, updated_at = p_now
+     where j.id = p_id and j.fencing_token = p_token and j.status = 'running'
+    returning j.id
+$$;
+
+create function public.job_complete(p_id uuid, p_token bigint, p_now timestamptz)
+returns table (id uuid)
+language sql
+as $$
+    update public.jobs as j set status = 'done', lease_expires_at = null, updated_at = p_now
+     where j.id = p_id and j.fencing_token = p_token and j.status = 'running'
+    returning j.id
+$$;
+
+create function public.job_fail(p_id uuid, p_token bigint, p_reason text, p_now timestamptz)
+returns table (id uuid)
+language sql
+as $$
+    update public.jobs as j set status = 'failed', error = p_reason, lease_expires_at = null, updated_at = p_now
+     where j.id = p_id and j.fencing_token = p_token and j.status = 'running'
+    returning j.id
+$$;
+
+revoke all on function public.job_claim(varchar, varchar, varchar, timestamptz, jsonb, timestamptz) from public;
+grant execute on function public.job_claim(varchar, varchar, varchar, timestamptz, jsonb, timestamptz) to app_be;
+revoke all on function public.job_advance(uuid, bigint, varchar, timestamptz) from public;
+grant execute on function public.job_advance(uuid, bigint, varchar, timestamptz) to app_be;
+revoke all on function public.job_complete(uuid, bigint, timestamptz) from public;
+grant execute on function public.job_complete(uuid, bigint, timestamptz) to app_be;
+revoke all on function public.job_fail(uuid, bigint, text, timestamptz) from public;
+grant execute on function public.job_fail(uuid, bigint, text, timestamptz) to app_be;

package/templates/be/patterns/queues/platform-lite/queue-outbox.service.spec.ts.tpl

@@ -0,0 +1,62 @@
+import { Test } from "@nestjs/testing"
+import { FakeClock, fakeTransaction, mockEntityManager } from "@starci/jest-preset"
+import { CLOCK } from "@modules/platform/clock"
+import { QueueOutboxService } from "./queue-outbox.service"
+
+// The statement callDbFunction of platform/database sends for queue_write.
+const INSERT_QUEUE_ROW = "SELECT * FROM queue_write($1, $2, $3, $4)"
+import { QueueErrorCode } from "./errors/queue.error"
+
+const AT = "2026-02-03T04:05:06.000Z"
+
+const build = async () => {
+    const moduleRef = await Test.createTestingModule({
+        providers: [QueueOutboxService, { provide: CLOCK, useValue: new FakeClock(AT) }],
+    }).compile()
+    return { outbox: moduleRef.get(QueueOutboxService) }
+}
+
+describe("QueueOutboxService", () => {
+    describe("write", () => {
+        it("writes the job as a row of the outbox of the transaction it is given", async () => {
+            const { outbox } = await build()
+            const tx = fakeTransaction(mockEntityManager({ query: [INSERT_QUEUE_ROW, []] }))
+
+            await tx.em.transaction((manager) => outbox.write(manager, "mail", { id: "m-1" }, "request-1"))
+
+            expect(tx.em.query).toHaveBeenCalledWith(INSERT_QUEUE_ROW, [
+                "mail",
+                JSON.stringify({ id: "m-1" }),
+                new Date(AT),
+                "request-1",
+            ])
+            expect(tx.commits).toBe(1)
+        })
+
+        it("leaves no row behind when the transaction rolls back", async () => {
+            const { outbox } = await build()
+            const tx = fakeTransaction(mockEntityManager({ query: [INSERT_QUEUE_ROW, []] }))
+            const failure = new Error("the change failed")
+
+            await expect(
+                tx.em.transaction(async (manager) => {
+                    await outbox.write(manager, "mail", { id: "m-1" }, "request-1")
+                    return Promise.reject(failure)
+                }),
+            ).rejects.toBe(failure)
+
+            expect(tx.rollbacks).toBe(1)
+            expect(tx.committedWrites).toEqual([])
+        })
+
+        it("rejects an unsafe correlation id before writing any SQL", async () => {
+            const { outbox } = await build()
+            const tx = fakeTransaction(mockEntityManager())
+            await expect(
+                tx.em.transaction((manager) => outbox.write(manager, "mail", {}, "bad\nid")),
+            ).rejects.toMatchObject({ code: QueueErrorCode.CorrelationInvalid })
+            expect(tx.em.query).not.toHaveBeenCalled()
+            expect(tx.rollbacks).toBe(1)
+        })
+    })
+})

package/templates/be/patterns/queues/platform-lite/queue-outbox.service.ts.tpl

@@ -0,0 +1,20 @@
+import { Injectable } from "@nestjs/common"
+import type { EntityManager } from "typeorm"
+import { InjectClock } from "@modules/platform/clock"
+import type { Clock } from "@modules/platform/clock"
+import { isCorrelationId } from "@modules/platform/logging"
+import type { QueueOutbox } from "./queue.port"
+import { QueueError, QueueErrorCode } from "./errors/queue.error"
+import { callDbFunction } from "@modules/platform/database"
+
+@Injectable()
+/** The writing side of the queues: a job is a row of the outbox of the caller's transaction, so it exists exactly when the change that needs it commits. */
+export class QueueOutboxService implements QueueOutbox {
+    constructor(@InjectClock() private readonly clock: Clock) {}
+
+    /** Writes the job in the outbox of the transaction `tx`; the relay adds it to BullMQ after the commit. */
+    async write(tx: EntityManager, queue: string, payload: object, correlationId: string): Promise<void> {
+        if (!isCorrelationId(correlationId)) throw new QueueError({ code: QueueErrorCode.CorrelationInvalid })
+        await callDbFunction(tx, "queue_write", [queue, JSON.stringify(payload), this.clock.now(), correlationId])
+    }
+}

package/templates/be/patterns/queues/platform-lite/queue-outbox.sql.tpl

@@ -30,3 +30,38 @@ with check (queue is not null);
 
 revoke all on table public.queue from public, anon, authenticated;
 grant select, insert, update on table public.queue to app_be;
+
+-- The outbox write, the relay's locked read of the waiting rows and its mark, called through callDbFunction of platform/database
+-- (R334). The read locks the rows it returns for the caller's transaction and skips rows another relay holds.
+create function public.queue_write(p_queue varchar, p_payload jsonb, p_created_at timestamptz, p_correlation_id varchar)
+returns void
+language sql
+as $$
+    insert into public.queue (queue, payload, created_at, correlation_id) values (p_queue, p_payload, p_created_at, p_correlation_id)
+$$;
+
+create function public.queue_waiting(p_batch integer)
+returns table (id uuid, queue varchar, payload jsonb, "correlationId" varchar)
+language sql
+as $$
+    select q.id, q.queue, q.payload, coalesce(q.correlation_id, q.id::text)
+      from public.queue as q
+     where q.sent_at is null
+     order by q.created_at, q.id
+     limit p_batch
+       for update skip locked
+$$;
+
+create function public.queue_mark_sent(p_ids uuid[], p_sent_at timestamptz)
+returns void
+language sql
+as $$
+    update public.queue set sent_at = p_sent_at where id = any(p_ids)
+$$;
+
+revoke all on function public.queue_write(varchar, jsonb, timestamptz, varchar) from public;
+grant execute on function public.queue_write(varchar, jsonb, timestamptz, varchar) to app_be;
+revoke all on function public.queue_waiting(integer) from public;
+grant execute on function public.queue_waiting(integer) to app_be;
+revoke all on function public.queue_mark_sent(uuid[], timestamptz) from public;
+grant execute on function public.queue_mark_sent(uuid[], timestamptz) to app_be;

package/templates/be/patterns/queues/platform-lite/queue-relay.service.spec.ts.tpl

@@ -9,7 +9,10 @@ import { OutboxLogEvent } from "@modules/platform/outbox"
 import type { QueueOptions } from "./queue.options"
 import { QueueRelayService } from "./queue-relay.service"
 import type { QueueTransport } from "./queue-transport.port"
-import { MARK_ROWS_SENT, SELECT_WAITING_ROWS } from "./persistence/queue.sql"
+
+// The statements callDbFunction of platform/database sends for the relay's functions.
+const SELECT_WAITING_ROWS = "SELECT * FROM queue_waiting($1)"
+const MARK_ROWS_SENT = "SELECT * FROM queue_mark_sent($1, $2)"
 
 const AT = "2026-02-03T04:05:06.000Z"
 

package/templates/be/patterns/queues/platform-lite/queue-relay.service.ts.tpl

@@ -9,8 +9,19 @@ import { OutboxRelayPolicy } from "@modules/platform/outbox"
 import { InjectQueueOptions, InjectQueueRelayManagers, InjectQueueTransport } from "./queue.decorators"
 import type { QueueOptions } from "./queue.options"
 import type { QueueTransport } from "./queue-transport.port"
-import { MARK_ROWS_SENT, SELECT_WAITING_ROWS } from "./persistence/queue.sql"
-import type { QueueRow } from "./persistence/queue.rows"
+import { callDbFunction } from "@modules/platform/database"
+
+/** One waiting row queue_waiting returns. */
+interface QueueRow {
+    /** The correlation id recorded by the producer's transaction. */
+    readonly correlationId: string
+    /** The row id: it is the BullMQ job id, so a repeated relay pass adds nothing. */
+    readonly id: string
+    /** The queue the job goes to. */
+    readonly queue: string
+    /** The payload, as the database returns the jsonb value. */
+    readonly payload: object
+}
 
 @Injectable()
 /**
@@ -32,8 +43,8 @@ export class QueueRelayService extends OutboxRelayPolicy<QueueRow> {
         super()
     }
 
-    protected select(tx: EntityManager): Promise<Array<QueueRow>> {
-        return tx.query(SELECT_WAITING_ROWS, [this.options.relayBatch])
+    protected async select(tx: EntityManager): Promise<Array<QueueRow>> {
+        return [...(await callDbFunction<QueueRow>(tx, "queue_waiting", [this.options.relayBatch]))]
     }
 
     protected async deliver(rows: ReadonlyArray<QueueRow>): Promise<void> {
@@ -42,7 +53,7 @@ export class QueueRelayService extends OutboxRelayPolicy<QueueRow> {
     }
 
     protected async mark(tx: EntityManager, rows: ReadonlyArray<QueueRow>): Promise<void> {
-        await tx.query(MARK_ROWS_SENT, [rows.map((row) => row.id), this.clock.now()])
+        await callDbFunction(tx, "queue_mark_sent", [rows.map((row) => row.id), this.clock.now()])
     }
 
     protected idle(): Promise<void> {

package/templates/be/patterns/realtime/channel.gateway.spec.ts.tpl

@@ -1,8 +1,8 @@
 import { Test } from "@nestjs/testing"
 import { MESSAGE_MAPPING_METADATA } from "@nestjs/websockets/constants"
 import { @@service@@ } from "@@serviceModule@@"
-import type { VerifySupabaseAccessToken } from "@modules/integrations/supabase"
-import { SupabaseErrorCode } from "@modules/integrations/supabase"
+import type { VerifyAccessToken } from "@modules/integrations/passport"
+import { PassportErrorCode } from "@modules/integrations/passport"
 import type { Principal } from "@modules/platform/cqrs"
 import { ok, refused } from "@modules/platform/primitives"
 import { REALTIME_HUB } from "@modules/platform/realtime"
@@ -79,7 +79,7 @@ const socketOf = (id: string, auth: Readonly<Record<string, unknown>> = { access
     return { socket, pushed }
 }
 
-const build = async (hub: RealtimeHub, verify: VerifySupabaseAccessToken) => {
+const build = async (hub: RealtimeHub, verify: VerifyAccessToken) => {
     const moduleRef = await Test.createTestingModule({
         imports: [@@Channel@@WebsocketModule.register({ verifyAccessToken: verify })],
     })
@@ -96,7 +96,7 @@ const build = async (hub: RealtimeHub, verify: VerifySupabaseAccessToken) => {
 describe("@@Channel@@Gateway", () => {
     it("builds the topic only from the verified principal, ignoring handshake principal and topic claims", async () => {
         const { hub, topics } = hubAnswering()
-        const verify: VerifySupabaseAccessToken = jest.fn().mockResolvedValue(ok(principal))
+        const verify: VerifyAccessToken = jest.fn().mockResolvedValue(ok(principal))
         const { transport, adapter } = await build(hub, verify)
         const { socket } = socketOf("socket-1", { accessToken: "signed-token", principal: { id: "p-2" }, topic: "foreign" })
 
@@ -111,7 +111,7 @@ describe("@@Channel@@Gateway", () => {
 
     it("isolates another authenticated principal's topic", async () => {
         const { hub, topics } = hubAnswering()
-        const verify: VerifySupabaseAccessToken = jest.fn().mockResolvedValue(ok({ id: "p-2", role: "authenticated" }))
+        const verify: VerifyAccessToken = jest.fn().mockResolvedValue(ok({ id: "p-2", role: "authenticated" }))
         const { transport, adapter } = await build(hub, verify)
         const { socket } = socketOf("socket-2")
 
@@ -126,7 +126,7 @@ describe("@@Channel@@Gateway", () => {
     it("pushes a hub frame automatically and releases the iterator on disconnect", async () => {
         const frame = { id: "x-1" }
         const { hub, released } = hubAnswering(frame)
-        const verify: VerifySupabaseAccessToken = jest.fn().mockResolvedValue(ok(principal))
+        const verify: VerifyAccessToken = jest.fn().mockResolvedValue(ok(principal))
         const { transport, adapter } = await build(hub, verify)
         const { socket, pushed } = socketOf("socket-1")
 
@@ -142,7 +142,7 @@ describe("@@Channel@@Gateway", () => {
 
     it.each([{}, { accessToken: "" }, { accessToken: 42 }])("refuses a missing or malformed access token without invoking the verifier", async (auth) => {
         const { hub, topics } = hubAnswering()
-        const verify: VerifySupabaseAccessToken = jest.fn()
+        const verify: VerifyAccessToken = jest.fn()
         const { adapter } = await build(hub, verify)
         const { socket } = socketOf("socket-1", auth)
         socket.data.principal = principal
@@ -156,7 +156,7 @@ describe("@@Channel@@Gateway", () => {
 
     it("refuses a rejected token and clears a prior principal", async () => {
         const { hub, topics } = hubAnswering()
-        const verify: VerifySupabaseAccessToken = jest.fn().mockResolvedValue(refused(SupabaseErrorCode.AccessTokenInvalid))
+        const verify: VerifyAccessToken = jest.fn().mockResolvedValue(refused(PassportErrorCode.AccessTokenInvalid))
         const { adapter } = await build(hub, verify)
         const { socket } = socketOf("socket-1")
         socket.data.principal = principal

package/templates/be/patterns/realtime/channel.websocket.module.ts.tpl

@@ -1,7 +1,7 @@
 import { Module } from "@nestjs/common"
 import type { OnModuleDestroy, OnModuleInit } from "@nestjs/common"
 import type { @@Channel@@Frame } from "@@serviceModule@@"
-import type { VerifySupabaseAccessToken } from "@modules/integrations/supabase"
+import type { VerifyAccessToken } from "@modules/integrations/passport"
 import { injector } from "@modules/platform/composition"
 import type { Principal } from "@modules/platform/cqrs"
 import { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN } from "./@@channel@@-websocket.module-definition"
@@ -48,8 +48,8 @@ export class @@Channel@@WebsocketModule extends ConfigurableModuleClass implemen
 
     constructor(
         private readonly gateway: @@Channel@@Gateway,
-        @injector<VerifySupabaseAccessToken>(ACCESS_TOKEN_VERIFIER)
-        private readonly verifyAccessToken: VerifySupabaseAccessToken,
+        @injector<VerifyAccessToken>(ACCESS_TOKEN_VERIFIER)
+        private readonly verifyAccessToken: VerifyAccessToken,
     ) {
         super()
     }

package/templates/be/patterns/realtime/channel.websocket.options.ts.tpl

@@ -1,7 +1,7 @@
-import type { VerifySupabaseAccessToken } from "@modules/integrations/supabase"
+import type { VerifyAccessToken } from "@modules/integrations/passport"
 
 /** The options of the @@channel@@ socket transport: the cryptographic verifier that authenticates each connection. */
 export interface @@Channel@@WebsocketOptions {
     /** Verifies the access token of a handshake with the same verifier identity uses. */
-    readonly verifyAccessToken: VerifySupabaseAccessToken
+    readonly verifyAccessToken: VerifyAccessToken
 }

package/templates/be/skeleton-lite/apps/api/Dockerfile

@@ -18,7 +18,6 @@ RUN npm ci --ignore-scripts
 
 COPY be/tsconfig.json be/tsconfig.build.json be/
 COPY be/src be/src
-COPY supabase/types supabase/types
 COPY be/apps/api be/apps/api
 RUN npm run build:be
 

package/templates/be/skeleton-lite/apps/api/src/api.env.ts

@@ -2,7 +2,8 @@ import type { EnvSource } from "@modules/platform/config"
 import { parseServerConfig } from "@modules/platform/config"
 import { parsePrimaryDatabaseConfig } from "@modules/platform/database"
 import { parseHttpSecurityConfig } from "@modules/platform/http-security"
-import { parseSupabaseConfig } from "@modules/integrations/supabase"
+import { parsePassportConfig } from "@modules/integrations/passport"
+import { parseObjectStorageConfig } from "@modules/integrations/object-storage"
 
 /** The API environment values required before composition. */
 export interface ApiEnv {
@@ -10,10 +11,12 @@ export interface ApiEnv {
     readonly server: ReturnType<typeof parseServerConfig>
     /** The origin allowlist and rate limits. */
     readonly httpSecurity: ReturnType<typeof parseHttpSecurityConfig>
-    /** The least-privilege PostgreSQL connection to the Supabase project. */
+    /** The least-privilege PostgreSQL connection to the app's own database. */
     readonly database: ReturnType<typeof parsePrimaryDatabaseConfig>
-    /** Supabase Auth, Storage and token-verification configuration. */
-    readonly supabase: ReturnType<typeof parseSupabaseConfig>
+    /** Google OAuth, the app's own access tokens and the refresh cookie. */
+    readonly passport: ReturnType<typeof parsePassportConfig>
+    /** S3-compatible object storage. */
+    readonly objectStorage: ReturnType<typeof parseObjectStorageConfig>
 }
 
 /** Reads the API environment; missing or invalid values fail boot, and secrets use `_FILE` first. */
@@ -21,5 +24,6 @@ export const readApiEnv = (env: EnvSource): ApiEnv => ({
     server: parseServerConfig(env),
     httpSecurity: parseHttpSecurityConfig(env),
     database: parsePrimaryDatabaseConfig(env),
-    supabase: parseSupabaseConfig(env),
+    passport: parsePassportConfig(env),
+    objectStorage: parseObjectStorageConfig(env),
 })

package/templates/be/skeleton-lite/apps/api/src/api.options.ts

@@ -1,4 +1,5 @@
-import type { SupabaseOptions } from "@modules/integrations/supabase"
+import type { PassportOptions } from "@modules/integrations/passport"
+import type { ObjectStorageOptions } from "@modules/integrations/object-storage"
 import type { ServerOptions } from "@modules/platform/config"
 import type { DatabaseConnectionOptions } from "@modules/platform/database"
 import type { HttpSecurityOptions } from "@modules/platform/http-security"
@@ -9,8 +10,10 @@ export interface ApiOptions {
     readonly server: ServerOptions
     /** The origin allowlist and rate limits. */
     readonly httpSecurity: HttpSecurityOptions
-    /** The least-privilege PostgreSQL connection to the Supabase project. */
+    /** The least-privilege PostgreSQL connection to the app's own database. */
     readonly database: DatabaseConnectionOptions
-    /** Supabase Auth, Storage and token-verification configuration. */
-    readonly supabase: SupabaseOptions
+    /** Google OAuth, the app's own access tokens and the refresh cookie. */
+    readonly passport: PassportOptions
+    /** S3-compatible object storage. */
+    readonly objectStorage: ObjectStorageOptions
 }

package/templates/be/skeleton-lite/apps/api/src/app.module.ts

@@ -2,7 +2,7 @@ import { Module } from "@nestjs/common"
 import type { DynamicModule } from "@nestjs/common"
 import { APP_FILTER, APP_GUARD } from "@nestjs/core"
 import { AuthGuard, CredentialGuard } from "@modules/domain/identity"
-import { createSupabaseAccessTokenVerifier } from "@modules/integrations/supabase"
+import { tokenKit } from "@modules/integrations/passport"
 import { ErrorsFilter } from "@modules/platform/errors"
 import { OriginGuard, RateLimitGuard } from "@modules/platform/http-security"
 import { platformModules } from "./compose/platform"
@@ -18,18 +18,18 @@ import type { ApiOptions } from "./api.options"
 export class AppModule {
     /** Builds the module from options parsed once at boot; nothing here reads the environment. */
     static register(options: ApiOptions): DynamicModule {
-        const verifyAccessToken = createSupabaseAccessTokenVerifier(options.supabase)
+        const tokens = tokenKit(options.passport.tokens)
         return {
             module: AppModule,
             imports: [
                 ...platformModules(options),
-                ...domainModules(verifyAccessToken),
+                ...domainModules(tokens.verify),
                 ...systemModules(),
                 ...apiModules(),
                 ...webhooksModules(),
             ],
             providers: [
-                ...integrationProviders(options.supabase, verifyAccessToken),
+                ...integrationProviders(options, tokens.verify),
                 { provide: APP_FILTER, useClass: ErrorsFilter },
                 { provide: APP_GUARD, useClass: RateLimitGuard },
                 { provide: APP_GUARD, useClass: OriginGuard },

package/templates/be/skeleton-lite/apps/api/src/compose/domain.ts

@@ -1,10 +1,10 @@
 import type { DynamicModule, Type } from "@nestjs/common"
 import { IdentityModule } from "@modules/domain/identity"
 import { LivenessModule } from "@modules/domain/liveness"
-import type { VerifySupabaseAccessToken } from "@modules/integrations/supabase"
+import type { VerifyAccessToken } from "@modules/integrations/passport"
 
-/** The domain capabilities of the API, with the app's verified Supabase identity adapter. */
-export const domainModules = (verifyAccessToken: VerifySupabaseAccessToken): Array<Type<unknown> | DynamicModule> => [
+/** The domain capabilities of the API, with the verifier of the app's own access tokens. */
+export const domainModules = (verifyAccessToken: VerifyAccessToken): Array<Type<unknown> | DynamicModule> => [
     IdentityModule.register({ isGlobal: true, verifyAccessToken }),
     LivenessModule.register({ isGlobal: true }),
 ]

package/templates/be/skeleton-lite/apps/api/src/compose/integrations.ts

@@ -1,16 +1,12 @@
 import type { Provider } from "@nestjs/common"
-import {
-    SUPABASE_ACCESS_TOKEN_VERIFIER,
-    SUPABASE_ADMIN_CLIENT,
-    createSupabaseAdminClient,
-} from "@modules/integrations/supabase"
-import type { SupabaseOptions, VerifySupabaseAccessToken } from "@modules/integrations/supabase"
+import { OWN_TOKEN_VERIFIER, PASSPORT_OPTIONS } from "@modules/integrations/passport"
+import type { VerifyAccessToken } from "@modules/integrations/passport"
+import { OBJECT_STORAGE, createObjectStorage } from "@modules/integrations/object-storage"
+import type { ApiOptions } from "../api.options"
 
-/** The Supabase integration ports bound once for this app. */
-export const integrationProviders = (
-    options: SupabaseOptions,
-    verifyAccessToken: VerifySupabaseAccessToken,
-): Array<Provider> => [
-    { provide: SUPABASE_ADMIN_CLIENT, useValue: createSupabaseAdminClient(options) },
-    { provide: SUPABASE_ACCESS_TOKEN_VERIFIER, useValue: verifyAccessToken },
+/** The passport and object-storage integration ports bound once for this app. */
+export const integrationProviders = (options: ApiOptions, verifyAccessToken: VerifyAccessToken): Array<Provider> => [
+    { provide: PASSPORT_OPTIONS, useValue: options.passport },
+    { provide: OWN_TOKEN_VERIFIER, useValue: verifyAccessToken },
+    { provide: OBJECT_STORAGE, useValue: createObjectStorage(options.objectStorage) },
 ]

package/templates/be/skeleton-lite/apps/api/src/compose/platform.ts

@@ -1,10 +1,11 @@
 import type { DynamicModule } from "@nestjs/common"
 import { IDENTITY_ERROR_KINDS, IDENTITY_MESSAGES } from "@modules/domain/identity"
-import { SUPABASE_ERROR_KINDS } from "@modules/integrations/supabase"
+import { PASSPORT_ERROR_KINDS } from "@modules/integrations/passport"
 import { ClockModule } from "@modules/platform/clock"
 import { CONFIG_ERROR_KINDS } from "@modules/platform/config"
 import { CqrsModule } from "@modules/platform/cqrs"
 import { DATABASE_ERROR_KINDS, DatabaseModule } from "@modules/platform/database"
+import { PRIMARY_ENTITIES } from "@modules/platform/database/entities"
 import { ERRORS_MESSAGES, ErrorsModule } from "@modules/platform/errors"
 import { HTTP_SECURITY_ERROR_KINDS, HTTP_SECURITY_MESSAGES, HttpSecurityModule } from "@modules/platform/http-security"
 import { I18nModule } from "@modules/platform/i18n"
@@ -37,7 +38,7 @@ export const platformModules = (options: ApiOptions): Array<DynamicModule> => [
             DATABASE_ERROR_KINDS,
             HTTP_SECURITY_ERROR_KINDS,
             IDENTITY_ERROR_KINDS,
-            SUPABASE_ERROR_KINDS,
+            PASSPORT_ERROR_KINDS,
         ],
     }),
     CqrsModule.register({ isGlobal: true }),
@@ -48,5 +49,6 @@ export const platformModules = (options: ApiOptions): Array<DynamicModule> => [
     DatabaseModule.register({
         isGlobal: true,
         connections: [options.database],
+        entities: PRIMARY_ENTITIES,
     }),
 ]

package/templates/be/skeleton-lite/apps/cli/src/cli.env.ts

@@ -5,8 +5,8 @@ import { parsePrimaryDatabaseConfig } from "@modules/platform/database"
 export interface CliEnv {
     /** The logical connection name declared in `hfs.json`. */
     readonly name: string
-    /** The Supabase PostgreSQL provider. */
-    readonly provider: "supabase"
+    /** The PostgreSQL provider. */
+    readonly provider: "postgres"
     /** The least-privilege database connection URL, read through the secret source. */
     readonly url: Secret
     /** The isolated PostgreSQL schema. */

package/templates/be/skeleton-lite/apps/cli/src/compose/platform.ts

@@ -1,16 +1,17 @@
 import type { DynamicModule } from "@nestjs/common"
 import { ClockModule } from "@modules/platform/clock"
 import { DatabaseModule } from "@modules/platform/database"
+import { PRIMARY_ENTITIES } from "@modules/platform/database/entities"
 import { IdsModule } from "@modules/platform/ids"
 import { HTTP_ERROR_KINDS, HTTP_MESSAGES, HttpModule } from "@modules/platform/http"
 import { LoggingModule } from "@modules/platform/logging"
 import type { CliAppOptions } from "../cli.options"
 
-/** The shared clock, logger and least-privilege connection used by Supabase CLI commands. */
+/** The shared clock, logger and least-privilege connection used by the operator commands. */
 export const platformModules = (options: CliAppOptions): Array<DynamicModule> => [
     ClockModule.register({ isGlobal: true }),
     IdsModule.register({ isGlobal: true }),
     LoggingModule.register({ isGlobal: true }),
     HttpModule.register({ isGlobal: true }),
-    DatabaseModule.register({ isGlobal: true, connections: options.connections }),
+    DatabaseModule.register({ isGlobal: true, connections: options.connections, entities: PRIMARY_ENTITIES }),
 ]