@supa-media/convex 1.2.1 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supa-media/convex",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "description": "Backend package for the Supa framework — OTP auth, schema helpers, and backend utilities for Convex",
   "main": "src/index.ts",
   "types": "src/index.ts",

package/src/auth/index.ts

@@ -1,8 +1,13 @@
-export { createSupaAuth, MAGIC_LINK_PROVIDER_ID } from "./setup";
+export {
+  createSupaAuth,
+  MAGIC_LINK_PROVIDER_ID,
+  TEST_EMAIL_PROVIDER_ID,
+} from "./setup";
 export type {
   SupaAuthConfig,
   SupaAuthMagicLinkConfig,
   SupaAuthResendConfig,
+  SupaAuthTestEmailConfig,
   SupaAuthTwilioConfig,
 } from "./setup";
 export {

package/src/auth/setup.ts

@@ -57,6 +57,16 @@ export interface SupaAuthTwilioConfig {
  */
 export const MAGIC_LINK_PROVIDER_ID = "magic-link";
 
+/** Provider id for an explicitly scoped production test account. */
+export const TEST_EMAIL_PROVIDER_ID = "test-email";
+
+export interface SupaAuthTestEmailConfig {
+  /** The only email address allowed to use the fixed test code. */
+  email: string;
+  /** Fixed verification code. Defaults to `000000`. */
+  code?: string;
+}
+
 export interface SupaAuthMagicLinkConfig {
   /**
    * How long a link stays live, in seconds. Defaults to one hour.
@@ -100,6 +110,12 @@ export interface SupaAuthConfig {
    * `MAGIC_LINK_PROVIDER_ID` for what it does and does not change.
    */
   magicLink?: SupaAuthMagicLinkConfig;
+  /**
+   * Register a fixed-code provider for one exact test account.
+   * Unlike `DEV_OTP_BYPASS`, this may be used in production because every
+   * other email address is refused by a distinct provider.
+   */
+  testEmail?: SupaAuthTestEmailConfig;
   /** Resend email OTP configuration. */
   resend?: SupaAuthResendConfig;
   /** Twilio phone OTP configuration. */
@@ -193,6 +209,41 @@ function createEmailOtp(config: SupaAuthConfig) {
   });
 }
 
+/** Build the fixed-code provider separately so its security boundary is testable. */
+export function createTestEmailOtp(config: SupaAuthTestEmailConfig) {
+  const email = config.email.trim().toLowerCase();
+  const code = config.code ?? DEV_BYPASS_CODE;
+  if (!/^\d{6}$/.test(code)) {
+    throw new Error("testEmail.code must be exactly six digits");
+  }
+  if (email.length === 0) {
+    throw new Error("testEmail.email must not be empty");
+  }
+
+  const provider = Email({
+    maxAge: 10 * 60,
+    generateVerificationToken: () => code,
+    sendVerificationRequest: async ({ identifier }) => {
+      if (identifier.trim().toLowerCase() !== email) {
+        throw new Error("This test sign-in provider is not available for that email.");
+      }
+    },
+  });
+  return {
+    ...provider,
+    id: TEST_EMAIL_PROVIDER_ID,
+    authorize: async (params: Record<string, unknown>, account: { providerAccountId: string }) => {
+      if (
+        typeof params.email !== "string" ||
+        params.email.trim().toLowerCase() !== email ||
+        account.providerAccountId.trim().toLowerCase() !== email
+      ) {
+        throw new Error("This test sign-in provider is not available for that email.");
+      }
+    },
+  };
+}
+
 /**
  * The link-only email provider.
  *
@@ -407,6 +458,9 @@ export function createSupaAuth(config: SupaAuthConfig = {}) {
     ...(methods.includes("email") && config.magicLink !== undefined
       ? [createMagicLink(config)]
       : []),
+    ...(methods.includes("email") && config.testEmail !== undefined
+      ? [createTestEmailOtp(config.testEmail)]
+      : []),
     ...(methods.includes("phone") ? [createPhoneOtp(config)] : []),
   ];
 

package/src/index.ts

@@ -9,6 +9,7 @@
 export {
   createSupaAuth,
   MAGIC_LINK_PROVIDER_ID,
+  TEST_EMAIL_PROVIDER_ID,
   requireAuth,
   requireAuthId,
   getOptionalAuth,
@@ -18,6 +19,7 @@ export type {
   SupaAuthConfig,
   SupaAuthMagicLinkConfig,
   SupaAuthResendConfig,
+  SupaAuthTestEmailConfig,
   SupaAuthTwilioConfig,
 } from "./auth";