@starci/hfs 4.9.11 → 4.10.1

package/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.config.ts

@@ -1,8 +0,0 @@
-import type { EnvSource } from "@modules/platform/config"
-import type { SupabaseOptions } from "./supabase.options"
-
-/** Reads Supabase configuration with no credential or localhost defaults. */
-export const parseSupabaseConfig = (env: EnvSource): SupabaseOptions => ({
-    url: env.url("SUPABASE_URL"),
-    serviceRoleKey: env.secret("SUPABASE_SERVICE_ROLE_KEY"),
-})

package/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.decorators.ts

@@ -1,17 +0,0 @@
-import { injector } from "@modules/platform/composition"
-import type { TypedParameterDecorator } from "@modules/platform/composition"
-import type { SupabaseAdminClient } from "./supabase.client"
-import type { VerifySupabaseAccessToken } from "./supabase.options"
-
-/** Token of the integration's Auth and Storage administrator. */
-export const SUPABASE_ADMIN_CLIENT: unique symbol = Symbol("integrations.supabase.admin-client")
-/** Token of the cryptographic Supabase access-token verifier. */
-export const SUPABASE_ACCESS_TOKEN_VERIFIER: unique symbol = Symbol("integrations.supabase.access-token-verifier")
-
-/** Injects the Auth and Storage administrator. Parameter type: SupabaseAdminClient. */
-export const InjectSupabaseAdminClient = (): TypedParameterDecorator<SupabaseAdminClient> =>
-    injector<SupabaseAdminClient>(SUPABASE_ADMIN_CLIENT)
-
-/** Injects the access-token verifier. Parameter type: VerifySupabaseAccessToken. */
-export const InjectSupabaseAccessTokenVerifier = (): TypedParameterDecorator<VerifySupabaseAccessToken> =>
-    injector<VerifySupabaseAccessToken>(SUPABASE_ACCESS_TOKEN_VERIFIER)

package/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.jwks.ts

@@ -1,32 +0,0 @@
-import { createRemoteJWKSet, jwtVerify } from "jose"
-import { ok, refused } from "@modules/platform/primitives"
-import { SupabaseErrorCode } from "./errors/supabase.error"
-import type { SupabaseOptions, SupabasePrincipal, VerifySupabaseAccessToken } from "./supabase.options"
-
-const AUDIENCE = "authenticated"
-
-/** Creates the verifier for this project's remote JWKS, exact issuer, authenticated audience and pinned algorithm. */
-export const createSupabaseAccessTokenVerifier = (options: SupabaseOptions): VerifySupabaseAccessToken => {
-    const issuer = `${options.url.replace(/\/$/, "")}/auth/v1`
-    const keys = createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`))
-    return async (token) => {
-        try {
-            const { payload } = await jwtVerify(token, keys, {
-                algorithms: ["ES256"],
-                audience: AUDIENCE,
-                issuer,
-            })
-            if (typeof payload.sub !== "string" || typeof payload.exp !== "number" || payload.role !== AUDIENCE) {
-                return refused(SupabaseErrorCode.AccessTokenInvalid)
-            }
-            const principal: SupabasePrincipal = {
-                id: payload.sub,
-                role: AUDIENCE,
-                ...(typeof payload.email === "string" ? { email: payload.email } : {}),
-            }
-            return ok(principal)
-        } catch (cause) {
-            return refused(SupabaseErrorCode.AccessTokenInvalid, { cause: String(cause) })
-        }
-    }
-}

package/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.options.ts

@@ -1,24 +0,0 @@
-import type { Secret } from "@modules/platform/config"
-import type { Outcome } from "@modules/platform/primitives"
-import type { SupabaseErrorCode } from "./errors/supabase.error"
-
-/** The verified identity claims admitted from a Supabase access token. */
-export interface SupabasePrincipal {
-    /** The Auth user identifier from the verified `sub` claim. */
-    readonly id: string
-    /** The verified email claim when the provider issued one. */
-    readonly email?: string
-    /** Supabase's authenticated role, required by the verifier. */
-    readonly role: "authenticated"
-}
-
-/** Verifies one bearer token and returns only claims that passed every cryptographic and semantic check. */
-export type VerifySupabaseAccessToken = (token: string) => Promise<Outcome<SupabasePrincipal, SupabaseErrorCode>>
-
-/** Supabase configuration parsed once at API boot. */
-export interface SupabaseOptions {
-    /** The project origin, used for Auth, Storage, issuer and JWKS endpoints. */
-    readonly url: string
-    /** The service-role credential, held only by the back-end integration. */
-    readonly serviceRoleKey: Secret
-}

package/templates/be/table/rows.ts.tpl

@@ -1,4 +0,0 @@
-import type { Database } from "../../../../../../supabase/types/database.types"
-
-/** One generated row of public.{{table}}. */
-export type {{Name}}Row = Database["public"]["Tables"]["{{table}}"]["Row"]

package/templates/be/table/sql.api.ts.tpl

@@ -1,7 +0,0 @@
-import { sql } from "@modules/platform/database"
-
-/** Reads one public.{{table}} row by id and owner through a branded SQL statement. */
-export const FIND_{{upper}} = sql`SELECT id FROM public.{{tableSql}} WHERE id = $1 AND owner_id = $2 LIMIT 1`
-
-/** Inserts one public.{{table}} row owned by the principal and returns its id. */
-export const INSERT_{{upper}} = sql`INSERT INTO public.{{tableSql}} (owner_id) VALUES ($1) RETURNING id`

package/templates/be/table/sql.ts.tpl

@@ -1,4 +0,0 @@
-import { sql } from "@modules/platform/database"
-
-/** Reads one public.{{table}} row by id and owner through a branded SQL statement. */
-export const FIND_{{upper}} = sql`SELECT id FROM public.{{tableSql}} WHERE id = $1 AND owner_id = $2 LIMIT 1`

package/templates/fe/auth/supabase-client.ts.tpl

@@ -1,38 +0,0 @@
-const sessionOf = (session: Session | null): AuthSession | undefined =>
-    session === null
-        ? undefined
-        : { userId: session.user.id, ...(session.user.email === undefined ? {} : { email: session.user.email }) }
-
-/** A Supabase Auth error as the provider reports it: its HTTP status, its code and its message. */
-type ProviderError = {
-    readonly status: number | undefined
-    readonly code: string | undefined
-    readonly message: string
-}
-
-/** The failure kind of a Supabase Auth error: refused credentials, rejected input, or the provider unavailable. */
-const kindOf = (status: number | undefined): string => {
-    if (status === 400 || status === 401 || status === 403) return "refused"
-    return status === 422 ? "invalid" : "unavailable"
-}
-
-/** The failure of a Supabase Auth call, or undefined when it succeeded. */
-const failureOf = (error: ProviderError | null): AuthFailure | undefined =>
-    error === null
-        ? undefined
-        : { code: error.code ?? String(error.status ?? "auth"), kind: kindOf(error.status), message: error.message }
-
-/** The Supabase Auth adapter shared by browser and cookie-backed PKCE flows. */
-export const authClient: AuthClient = {
-    session: async () => sessionOf((await authOf().getSession()).data.session),
-    accessToken: async () => (await authOf().getSession()).data.session?.access_token,
-    refreshAccessToken: async () => (await authOf().refreshSession()).data.session?.access_token,
-    signInWithPassword: async (email, password) =>
-        failureOf((await authOf().signInWithPassword({ email, password })).error),
-    signOut: async () => failureOf((await authOf().signOut()).error),
-    // Supabase reports INITIAL_SESSION on subscribe, then every change: the subscription alone keeps the session current.
-    onChange: (listener) => {
-        const { data } = authOf().onAuthStateChange((_event, session) => listener(sessionOf(session)))
-        return () => data.subscription.unsubscribe()
-    },
-}

package/templates/fe/skeleton/apps/__app__/src/app/auth/callback/route.ts

@@ -1,11 +0,0 @@
-import { NextResponse } from "next/server"
-import { exchangeAuthCode } from "@/modules/auth/server"
-import { APP_ROUTES } from "@/modules/routes"
-
-/** The opt-in Supabase PKCE callback only exchanges the code and redirects home. */
-export const GET = async (request: Request): Promise<NextResponse> => {
-    const url = new URL(request.url)
-    const code = url.searchParams.get("code")
-    if (code) await exchangeAuthCode(code)
-    return NextResponse.redirect(new URL(APP_ROUTES.home, url.origin))
-}

package/templates/fe/skeleton/apps/__app__/src/modules/auth/pkce-client.ts

@@ -1,18 +0,0 @@
-import { createBrowserClient } from "@supabase/ssr"
-import type { Session, SupabaseClient } from "@supabase/supabase-js"
-import { supabaseAnonKey, supabaseUrl } from "@/modules/config"
-import type { AuthClient, AuthFailure, AuthSession } from "./contracts"
-
-let client: SupabaseClient | undefined
-
-/**
- * The cookie-backed browser client of the opt-in server PKCE flow, used for Supabase Auth only.
- * The callback exchanges the code; this client shares its verifier and session cookies. It never calls `.from()`, `.rpc()` or storage:
- * data goes through modules/api to the back end, which verifies the access token.
- */
-const supabase = (): SupabaseClient =>
-    (client ??= createBrowserClient(supabaseUrl(), supabaseAnonKey(), {
-        auth: { flowType: "pkce", detectSessionInUrl: false, persistSession: true, autoRefreshToken: true },
-    }))
-
-// {{> fe/auth/supabase-client.ts.tpl}}

package/templates/fe/skeleton/apps/__app__/src/modules/auth/server.ts

@@ -1,19 +0,0 @@
-import "server-only"
-import { createServerClient } from "@supabase/ssr"
-import { cookies } from "next/headers"
-import { supabaseAnonKey, supabaseUrl } from "@/modules/config"
-
-/** The server auth owner reads the PKCE verifier and persists the exchanged session in cookies. */
-export const exchangeAuthCode = async (code: string): Promise<void> => {
-    const cookieStore = await cookies()
-    const client = createServerClient(supabaseUrl(), supabaseAnonKey(), {
-        cookies: {
-            getAll: () => cookieStore.getAll(),
-            setAll: (values) => {
-                for (const { name, value, options } of values) cookieStore.set(name, value, options)
-            },
-        },
-    })
-    const { error } = await client.auth.exchangeCodeForSession(code)
-    if (error) throw error
-}