@supacloud/lite 0.5.10 → 0.7.0

package/dist/cli.js

@@ -8,7 +8,7 @@ import { dirname as dirname5, join as join9, resolve as resolve4 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.5.10",
+  version: "0.7.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite",
   type: "module",
   license: "Apache-2.0",
@@ -910,6 +910,10 @@ var DEFAULT_AUTH_SETTINGS = {
   disabledProviders: [],
   otpLength: 6,
   otpExpirySeconds: 3600,
+  smsEnabled: true,
+  smsSignupEnabled: true,
+  smsOtpCooldownSeconds: 60,
+  smsTemplate: "Your one-time code is {{ .Code }}",
   maxEnrolledFactors: 10,
   totpEnrollEnabled: true,
   totpVerifyEnabled: true
@@ -934,6 +938,16 @@ function sanitize(raw) {
   if (typeof raw.otpExpirySeconds === "number" && Number.isFinite(raw.otpExpirySeconds) && raw.otpExpirySeconds > 0) {
     s.otpExpirySeconds = Math.floor(raw.otpExpirySeconds);
   }
+  if (typeof raw.smsEnabled === "boolean")
+    s.smsEnabled = raw.smsEnabled;
+  if (typeof raw.smsSignupEnabled === "boolean")
+    s.smsSignupEnabled = raw.smsSignupEnabled;
+  if (typeof raw.smsOtpCooldownSeconds === "number" && Number.isFinite(raw.smsOtpCooldownSeconds)) {
+    s.smsOtpCooldownSeconds = Math.max(0, Math.min(86400, Math.floor(raw.smsOtpCooldownSeconds)));
+  }
+  if (typeof raw.smsTemplate === "string" && raw.smsTemplate.length > 0 && raw.smsTemplate.length <= 1000 && /\{\{\s*\.Code\s*\}\}/.test(raw.smsTemplate)) {
+    s.smsTemplate = raw.smsTemplate;
+  }
   if (typeof raw.maxEnrolledFactors === "number" && Number.isFinite(raw.maxEnrolledFactors) && raw.maxEnrolledFactors > 0) {
     s.maxEnrolledFactors = Math.floor(raw.maxEnrolledFactors);
   }
@@ -959,7 +973,9 @@ var DEFAULT_AUTH_RATE_LIMITS = {
   token: { limit: 30, windowMs: 5 * 60 * 1000 },
   signup: { limit: 30, windowMs: 60 * 60 * 1000 },
   otp: { limit: 10, windowMs: 60 * 60 * 1000 },
-  recover: { limit: 10, windowMs: 60 * 60 * 1000 }
+  recover: { limit: 10, windowMs: 60 * 60 * 1000 },
+  sms: { limit: 10, windowMs: 60 * 60 * 1000 },
+  verify: { limit: 30, windowMs: 5 * 60 * 1000 }
 };
 
 class RateLimiter {
@@ -1083,13 +1099,55 @@ function authError(status, errorCode, msg) {
 }
 function randomOtp(length) {
   const n = Math.max(6, Math.min(10, Math.floor(length)));
-  const buf = new Uint32Array(n);
-  crypto.getRandomValues(buf);
   let code = "";
-  for (let i = 0;i < n; i++)
-    code += String(buf[i] % 10);
+  while (code.length < n) {
+    const bytes = crypto.getRandomValues(new Uint8Array(Math.max(16, n - code.length)));
+    for (const byte of bytes) {
+      if (byte >= 250)
+        continue;
+      code += String(byte % 10);
+      if (code.length === n)
+        break;
+    }
+  }
   return code;
 }
+async function sha256Hex(value) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function normalizePhone(value) {
+  if (typeof value !== "string")
+    return null;
+  const phone = value.trim();
+  return /^\+[1-9]\d{7,14}$/.test(phone) ? phone : null;
+}
+function recordValue(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
+}
+function databaseDiagnosticCode(error) {
+  const candidate = typeof error === "object" && error !== null && "code" in error ? error.code : null;
+  return typeof candidate === "string" && /^[0-9A-Z]{5}$/.test(candidate) ? candidate : "database_error";
+}
+async function keyedDigest(secret, domain, value) {
+  const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const digest = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${domain}\x00${value}`));
+  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function sendSmsUntilAbort(sender, message, signal) {
+  if (signal.aborted)
+    throw new Error("Phone delivery aborted");
+  let rejectForAbort;
+  const aborted = new Promise((_resolve, reject) => {
+    rejectForAbort = () => reject(new Error("Phone delivery aborted"));
+    signal.addEventListener("abort", rejectForAbort, { once: true });
+  });
+  try {
+    await Promise.race([sender.send(message, { signal }), aborted]);
+  } finally {
+    signal.removeEventListener("abort", rejectForAbort);
+  }
+}
 function json(status, body) {
   return new Response(status === 204 ? null : JSON.stringify(body), {
     status,
@@ -1111,9 +1169,14 @@ function timestampMs(value) {
 class AuthHandler {
   db;
   config;
+  static PHONE_DELIVERY_TIMEOUT_MS = 15000;
+  static PHONE_DELIVERY_DRAIN_MS = 250;
   oauth;
   settings;
   rateLimiter;
+  phoneDeliveries = new Set;
+  phoneDeliveryControllers = new Set;
+  stopping = false;
   constructor(db, config) {
     this.db = db;
     this.config = config;
@@ -1122,16 +1185,41 @@ class AuthHandler {
     this.rateLimiter = config.rateLimiter === undefined ? new RateLimiter : config.rateLimiter;
   }
   limit(action, req) {
+    const client = req.headers.get("x-supacloud-lite-remote-addr") ?? "local";
+    return this.limitKey(action, `ip:${client}`);
+  }
+  limitKey(action, key) {
     if (!this.rateLimiter)
       return null;
-    const client = req.headers.get("x-supacloud-lite-remote-addr") ?? "local";
-    const retryAfter = this.rateLimiter.check(action, client);
+    const retryAfter = this.rateLimiter.check(action, key);
     if (retryAfter === null)
       return null;
     return new Response(JSON.stringify({ code: 429, error_code: "over_request_rate_limit", msg: "Request rate limit reached" }), { status: 429, headers: { "content-type": "application/json; charset=utf-8", "retry-after": String(retryAfter) } });
   }
-  stop() {
+  async stop() {
     this.rateLimiter?.stop();
+    this.stopping = true;
+    if (await this.phoneDeliveriesSettledBeforeDeadline())
+      return;
+    for (const controller of this.phoneDeliveryControllers)
+      controller.abort();
+    await Promise.all(this.phoneDeliveries);
+  }
+  async phoneDeliveriesSettledBeforeDeadline() {
+    if (this.phoneDeliveries.size === 0)
+      return true;
+    let deadlineTimer;
+    const deadline = new Promise((resolve) => {
+      deadlineTimer = setTimeout(() => resolve(false), AuthHandler.PHONE_DELIVERY_DRAIN_MS);
+    });
+    try {
+      return await Promise.race([
+        Promise.all(this.phoneDeliveries).then(() => true),
+        deadline
+      ]);
+    } finally {
+      clearTimeout(deadlineTimer);
+    }
   }
   async handle(req, ctx, url) {
     const path = url.pathname.replace(/^\/auth\/v1\/?/, "").replace(/\/+$/, "");
@@ -1144,7 +1232,7 @@ class AuthHandler {
         return json(200, {
           external: {
             email: true,
-            phone: false,
+            phone: this.settings.smsEnabled && this.config.smsSender != null,
             anonymous_users: this.settings.anonymousUsers,
             ...Object.fromEntries(providers.map((p) => [p, !this.settings.disabledProviders.includes(p)]))
           },
@@ -1165,13 +1253,13 @@ class AuthHandler {
       if (path === "logout" && method === "POST")
         return await this.logout(req, url);
       if (path === "otp" && method === "POST")
-        return this.limit("otp", req) ?? await this.sendOtp(req);
+        return await this.sendOtp(req);
       if (path === "recover" && method === "POST")
         return this.limit("recover", req) ?? await this.sendRecovery(req);
       if (["magiclink", "resend"].includes(path) && method === "POST")
-        return this.limit("otp", req) ?? await this.sendOtp(req);
+        return await this.sendOtp(req);
       if (path === "verify" && method === "POST")
-        return await this.verifyToken(req);
+        return this.limit("verify", req) ?? await this.verifyToken(req);
       if (path === "verify" && method === "GET")
         return await this.verifyLink(url);
       if (path === "factors" && method === "POST")
@@ -1393,9 +1481,170 @@ Or sign in with this link: ${link}`
   }
   async sendOtp(req) {
     const body = await req.json().catch(() => ({}));
+    if (body.email && body.phone)
+      return authError(400, "validation_failed", "email and phone are mutually exclusive");
+    if (body.phone !== undefined) {
+      if (body.channel !== undefined && body.channel !== "sms") {
+        return authError(422, "unsupported_channel", "Only the sms phone channel is supported");
+      }
+      const phone = normalizePhone(body.phone);
+      if (!phone)
+        return authError(400, "validation_failed", "phone must be a valid E.164 number");
+      return this.limit("sms", req) ?? this.issuePhoneToken(phone, body.create_user !== false, recordValue(body.data));
+    }
     if (!body.email)
-      return authError(400, "validation_failed", "email is required");
-    return this.issueToken(body.email, "otp", body.create_user !== false);
+      return authError(400, "validation_failed", "email or phone is required");
+    return this.limit("otp", req) ?? this.issueToken(body.email, "otp", body.create_user !== false);
+  }
+  async issuePhoneToken(phone, createUser, metadata) {
+    const sender = this.config.smsSender;
+    if (!this.settings.smsEnabled || !sender) {
+      return authError(422, "phone_provider_disabled", "Phone sign-ins are disabled");
+    }
+    const fingerprint = await keyedDigest(this.config.jwtSecret, "supacloud-lite:phone-fingerprint:v1", phone);
+    const limited = this.limitKey("sms", `phone:${fingerprint}`);
+    if (limited)
+      return limited;
+    const code = randomOtp(this.settings.otpLength);
+    const tokenDigest = `hmac-sha256:v1:${await keyedDigest(this.config.jwtSecret, "supacloud-lite:phone-otp:v1", `${phone}\x00${code}`)}`;
+    const issuanceId = crypto.randomUUID();
+    const prepared = await this.preparePhoneOtp({
+      phone,
+      createUser,
+      metadata,
+      fingerprint,
+      tokenDigest,
+      issuanceId,
+      eligibleBefore: new Date(Date.now() - this.settings.smsOtpCooldownSeconds * 1000).toISOString(),
+      expiry: `${this.settings.otpExpirySeconds} seconds`
+    });
+    if (prepared.state === "cooldown") {
+      return authError(429, "over_sms_send_rate_limit", "SMS can only be requested after the cooldown");
+    }
+    if (prepared.state === "signup_disabled") {
+      return authError(422, "signup_disabled", "Signups not allowed for this instance");
+    }
+    if (prepared.state === "unknown")
+      return json(200, {});
+    const body = this.settings.smsTemplate.replace(/\{\{\s*\.Code\s*\}\}/g, code);
+    const delivery = createUser ? this.deliverPhoneOtp(prepared, sender, phone, body) : this.deferPhoneOtpDelivery(prepared, sender, phone, body);
+    this.trackPhoneDelivery(delivery);
+    if (!createUser) {
+      return json(200, {});
+    }
+    return await delivery ? json(200, {}) : authError(502, "sms_provider_failed", "Unable to send the verification code");
+  }
+  async preparePhoneOtp(request) {
+    try {
+      return await this.db.transaction(async (query) => {
+        const cooldown = await query(`insert into auth.phone_otp_cooldowns (phone_fingerprint, issuance_id, last_sent_at)
+           values ($1, $2, now())
+           on conflict (phone_fingerprint) do update
+           set issuance_id = excluded.issuance_id, last_sent_at = excluded.last_sent_at
+           where auth.phone_otp_cooldowns.last_sent_at <= $3::timestamptz
+           returning phone_fingerprint`, [request.fingerprint, request.issuanceId, request.eligibleBefore]);
+        if (cooldown.rows.length === 0)
+          return { state: "cooldown" };
+        const resolved = await this.phoneUser(query, request);
+        if (resolved === "unknown" || resolved === "signup_disabled")
+          return { state: resolved };
+        await this.createPhoneIdentity(query, resolved);
+        await query(`delete from auth.one_time_tokens where phone = $1 and token_type = 'sms'`, [request.phone]);
+        await query(`insert into auth.one_time_tokens (id, user_id, phone, token_type, token, expires_at)
+           values ($1, $2, $3, 'sms', $4, now() + $5::interval)`, [request.issuanceId, resolved.id, request.phone, request.tokenDigest, request.expiry]);
+        return {
+          state: "issued",
+          id: request.issuanceId,
+          fingerprint: request.fingerprint,
+          tokenDigest: request.tokenDigest,
+          releaseCooldownOnFailure: request.createUser
+        };
+      });
+    } catch (error) {
+      this.reportPhoneFailure("issue", databaseDiagnosticCode(error));
+      throw new Error("Unable to issue the verification code", { cause: error });
+    }
+  }
+  async phoneUser(query, request) {
+    const existing = await this.phoneUserForUpdate(query, request.phone);
+    if (existing)
+      return existing.auth_eligible ? existing : "unknown";
+    if (!request.createUser)
+      return "unknown";
+    if (this.settings.disableSignup || !this.settings.smsSignupEnabled)
+      return "signup_disabled";
+    const inserted = await query(`insert into auth.users (aud, role, phone, raw_app_meta_data, raw_user_meta_data)
+       values ('authenticated', 'authenticated', $1, $2::jsonb, $3::jsonb)
+       on conflict (phone) do nothing returning *`, [
+      request.phone,
+      JSON.stringify({ provider: "phone", providers: ["phone"] }),
+      JSON.stringify(request.metadata)
+    ]);
+    if (inserted.rows[0])
+      return inserted.rows[0];
+    const concurrent = await this.phoneUserForUpdate(query, request.phone);
+    if (!concurrent)
+      throw new Error("phone user could not be resolved");
+    return concurrent.auth_eligible ? concurrent : "unknown";
+  }
+  async phoneUserForUpdate(query, phone) {
+    const users = await query(`select *, deleted_at is null and (banned_until is null or banned_until <= now()) as auth_eligible
+       from auth.users where phone = $1 for update`, [phone]);
+    return users.rows[0];
+  }
+  createPhoneIdentity(query, user) {
+    return query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
+       values ($1, 'phone', $2, $3::jsonb)
+       on conflict (provider, provider_id) do nothing`, [user.id, user.phone, JSON.stringify({ sub: user.id, phone: user.phone, phone_verified: user.phone_confirmed_at != null })]);
+  }
+  async deliverPhoneOtp(issuance, sender, phone, body) {
+    try {
+      await this.sendPhoneOtp(sender, phone, body);
+      return true;
+    } catch {
+      this.reportPhoneFailure("deliver", "provider_error");
+      await this.cleanupFailedPhoneOtp(issuance);
+      return false;
+    }
+  }
+  async sendPhoneOtp(sender, phone, body) {
+    const controller = new AbortController;
+    this.phoneDeliveryControllers.add(controller);
+    const deliveryTimer = setTimeout(() => controller.abort(), AuthHandler.PHONE_DELIVERY_TIMEOUT_MS);
+    if (this.stopping)
+      controller.abort();
+    try {
+      await sendSmsUntilAbort(sender, { to: phone, body }, controller.signal);
+    } finally {
+      clearTimeout(deliveryTimer);
+      this.phoneDeliveryControllers.delete(controller);
+    }
+  }
+  async cleanupFailedPhoneOtp(issuance) {
+    try {
+      await this.db.transaction(async (query) => {
+        await query(`delete from auth.one_time_tokens where id = $1 and token = $2`, [issuance.id, issuance.tokenDigest]);
+        if (issuance.releaseCooldownOnFailure) {
+          await query(`delete from auth.phone_otp_cooldowns where phone_fingerprint = $1 and issuance_id = $2`, [issuance.fingerprint, issuance.id]);
+        }
+      });
+    } catch (cleanupError) {
+      this.reportPhoneFailure("cleanup", databaseDiagnosticCode(cleanupError));
+    }
+  }
+  async deferPhoneOtpDelivery(issuance, sender, phone, body) {
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    return this.deliverPhoneOtp(issuance, sender, phone, body);
+  }
+  trackPhoneDelivery(delivery) {
+    let tracked;
+    tracked = delivery.then(() => {}).finally(() => this.phoneDeliveries.delete(tracked));
+    this.phoneDeliveries.add(tracked);
+  }
+  reportPhoneFailure(operation, code) {
+    try {
+      this.config.log?.(`[auth] phone_otp_${operation} failed code=${code}`);
+    } catch {}
   }
   async sendRecovery(req) {
     const body = await req.json().catch(() => ({}));
@@ -1405,36 +1654,116 @@ Or sign in with this link: ${link}`
   }
   static MAX_OTP_ATTEMPTS = 5;
   async redeem(token, types, email) {
-    const normalizedEmail = email?.toLowerCase().trim() ?? null;
-    const res = await this.db.query(`delete from auth.one_time_tokens
-       where token = $1 and token_type = any($2::text[])
-         and ($3::text is null or email = $3) and expires_at > now()
-         and attempts < $4
-       returning user_id, email`, [token, `{${types.join(",")}}`, normalizedEmail, AuthHandler.MAX_OTP_ATTEMPTS]);
-    const row = res.rows[0];
-    if (!row) {
-      if (normalizedEmail) {
-        await this.db.query(`update auth.one_time_tokens set attempts = attempts + 1
-           where email = $1 and token_type = any($2::text[]) and expires_at > now()`, [normalizedEmail, `{${types.join(",")}}`]);
-        await this.db.query(`delete from auth.one_time_tokens where email = $1 and attempts >= $2`, [normalizedEmail, AuthHandler.MAX_OTP_ATTEMPTS]);
-      }
+    const redemption = {
+      token,
+      tokenTypes: `{${types.join(",")}}`,
+      email: email?.toLowerCase().trim() ?? null
+    };
+    return this.db.transaction((query) => this.claimEmailToken(query, redemption));
+  }
+  async claimEmailToken(query, redemption) {
+    const candidate = await this.findEmailTokenCandidate(query, redemption);
+    if (!candidate) {
+      await this.recordFailedEmailTokenAttempt(query, redemption);
       return null;
     }
-    await this.db.query(`delete from auth.one_time_tokens where email = $1`, [row.email]);
-    const ures = await this.db.query(`update auth.users set email_confirmed_at = coalesce(email_confirmed_at, now()), last_sign_in_at = now()
-       where id = $1 returning *`, [row.user_id]);
-    return ures.rows[0] ?? null;
+    const claimedToken = await this.lockAndDeleteEmailToken(query, candidate, redemption);
+    return claimedToken ? this.confirmEmailTokenUser(query, claimedToken) : null;
+  }
+  async lockAndDeleteEmailToken(query, candidate, redemption) {
+    await query(`select id from auth.users where id = $1 for update`, [candidate.user_id]);
+    const claimedTokens = await query(`delete from auth.one_time_tokens
+       where id = $1 and token = $2 and token_type = any($3::text[])
+         and expires_at > now() and attempts < $4
+       returning id, user_id, email`, [candidate.id, redemption.token, redemption.tokenTypes, AuthHandler.MAX_OTP_ATTEMPTS]);
+    return claimedTokens.rows[0] ?? null;
+  }
+  async confirmEmailTokenUser(query, claimedToken) {
+    await query(`delete from auth.one_time_tokens where email = $1`, [claimedToken.email]);
+    const users = await query(`update auth.users set email_confirmed_at = coalesce(email_confirmed_at, now()), last_sign_in_at = now()
+       where id = $1 returning *`, [claimedToken.user_id]);
+    return users.rows[0] ?? null;
+  }
+  async findEmailTokenCandidate(query, redemption) {
+    const candidates = await query(`select id, user_id, email from auth.one_time_tokens
+       where token = $1 and token_type = any($2::text[])
+         and ($3::text is null or email = $3) and expires_at > now()
+         and attempts < $4`, [redemption.token, redemption.tokenTypes, redemption.email, AuthHandler.MAX_OTP_ATTEMPTS]);
+    return candidates.rows[0] ?? null;
+  }
+  async recordFailedEmailTokenAttempt(query, redemption) {
+    if (!redemption.email)
+      return;
+    await query(`update auth.one_time_tokens set attempts = attempts + 1
+       where email = $1 and token_type = any($2::text[]) and expires_at > now()`, [redemption.email, redemption.tokenTypes]);
+    await query(`delete from auth.one_time_tokens where email = $1 and attempts >= $2`, [redemption.email, AuthHandler.MAX_OTP_ATTEMPTS]);
   }
   async verifyToken(req) {
     const body = await req.json().catch(() => ({}));
-    if (!body.token)
-      return authError(400, "validation_failed", "token is required");
+    const token = body.token ?? body.token_hash;
+    if (!token)
+      return authError(400, "validation_failed", "token or token_hash is required");
+    if (body.type === "sms" || body.phone !== undefined) {
+      const phone = normalizePhone(body.phone);
+      if (body.type !== "sms" || !phone || !body.token || !/^\d{6,10}$/.test(body.token)) {
+        return authError(400, "validation_failed", "phone, token, and type=sms are required");
+      }
+      const fingerprint = await keyedDigest(this.config.jwtSecret, "supacloud-lite:phone-fingerprint:v1", phone);
+      const limited = this.limitKey("verify", `phone:${fingerprint}`);
+      if (limited)
+        return limited;
+      let session;
+      try {
+        session = await this.redeemPhoneOtp(phone, body.token);
+      } catch (error) {
+        this.reportPhoneFailure("verify", databaseDiagnosticCode(error));
+        return authError(500, "unexpected_failure", "Unable to verify the code");
+      }
+      if (!session)
+        return authError(403, "otp_expired", "Token has expired or is invalid");
+      return json(200, session);
+    }
     const types = body.type === "recovery" ? ["recovery"] : body.type === "magiclink" ? ["magiclink"] : ["otp", "magiclink"];
-    const user = await this.redeem(body.token, types, body.email);
+    const user = await this.redeem(token, types, body.email);
     if (!user)
       return authError(403, "otp_expired", "Token has expired or is invalid");
     return json(200, await this.sessionFor(user));
   }
+  async redeemPhoneOtp(phone, code) {
+    const tokenDigest = `hmac-sha256:v1:${await keyedDigest(this.config.jwtSecret, "supacloud-lite:phone-otp:v1", `${phone}\x00${code}`)}`;
+    return this.db.transaction(async (query) => {
+      const claimed = await query(`delete from auth.one_time_tokens
+         where phone = $1 and token_type = 'sms' and token = $2
+           and expires_at > now() and attempts < $3
+         returning user_id`, [phone, tokenDigest, AuthHandler.MAX_OTP_ATTEMPTS]);
+      const userId = claimed.rows[0]?.user_id;
+      if (!userId) {
+        const attempt = await query(`update auth.one_time_tokens set attempts = attempts + 1
+           where phone = $1 and token_type = 'sms' and expires_at > now()
+           returning id, attempts`, [phone]);
+        const row = attempt.rows[0];
+        if (row && row.attempts >= AuthHandler.MAX_OTP_ATTEMPTS) {
+          await query(`delete from auth.one_time_tokens where id = $1`, [row.id]);
+        }
+        await query(`delete from auth.one_time_tokens where phone = $1 and expires_at <= now()`, [phone]);
+        return null;
+      }
+      await query(`delete from auth.one_time_tokens where phone = $1`, [phone]);
+      const users = await query(`update auth.users
+         set phone_confirmed_at = coalesce(phone_confirmed_at, now()), last_sign_in_at = now(), updated_at = now()
+         where id = $1 and deleted_at is null
+           and (banned_until is null or banned_until <= now())
+         returning *`, [userId]);
+      const user = users.rows[0];
+      if (!user)
+        return null;
+      await query(`insert into auth.identities (user_id, provider, provider_id, identity_data, last_sign_in_at)
+         values ($1, 'phone', $2, $3::jsonb, now())
+         on conflict (provider, provider_id) do update
+         set identity_data = excluded.identity_data, last_sign_in_at = now(), updated_at = now()`, [user.id, phone, JSON.stringify({ sub: user.id, phone, phone_verified: true })]);
+      return this.sessionFor(user, undefined, { amr: [{ method: "otp", timestamp: Math.floor(Date.now() / 1000) }] }, query);
+    });
+  }
   async verifyLink(url) {
     const token = url.searchParams.get("token") ?? "";
     const type = url.searchParams.get("type") ?? "magiclink";
@@ -1453,6 +1782,9 @@ Or sign in with this link: ${link}`
     }
     const idMatch = path.match(/^admin\/users\/([0-9a-f-]{36})$/);
     const exportMatch = path.match(/^admin\/users\/([0-9a-f-]{36})\/export$/);
+    if (path === "admin/generate_link" && method === "POST") {
+      return await this.generateAdminMagicLink(req);
+    }
     if (path === "admin/audit" && method === "GET") {
       const res = await this.db.query(`select id, payload, created_at, ip_address from auth.audit_log_entries
          order by created_at desc limit 200`);
@@ -1523,6 +1855,50 @@ Or sign in with this link: ${link}`
     }
     return authError(404, "not_found", `unknown admin endpoint`);
   }
+  async generateAdminMagicLink(req) {
+    const body = await req.json().catch(() => ({}));
+    if (body.type !== "magiclink") {
+      return authError(422, "unsupported_link_type", "Only magiclink generation is supported");
+    }
+    if (!body.email)
+      return authError(400, "validation_failed", "email is required");
+    const email = body.email.toLowerCase().trim();
+    const emailOtp = randomOtp(this.settings.otpLength);
+    const hashedToken = await sha256Hex(randomToken(32));
+    const expiry = `${this.settings.otpExpirySeconds} seconds`;
+    const requestUrl = new URL(req.url);
+    const redirectTo = resolveRedirect(requestUrl.searchParams.get("redirect_to") ?? body.redirect_to, this.config.siteUrl, this.config.uriAllowList, this.config.enforceRedirectAllowList);
+    const user = await this.db.transaction(async (query) => {
+      const result = await query(`insert into auth.users
+           (aud, role, email, raw_app_meta_data, raw_user_meta_data)
+         values ('authenticated', 'authenticated', $1, '{"provider":"email","providers":["email"]}', $2::jsonb)
+         on conflict (email) do update set email = excluded.email
+         returning *`, [email, JSON.stringify(body.data ?? {})]);
+      const linkedUser = result.rows[0];
+      await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
+         values ($1::uuid, 'email', $1::text, $2::jsonb)
+         on conflict (provider, provider_id) do nothing`, [linkedUser.id, JSON.stringify({ sub: linkedUser.id, email })]);
+      await query(`delete from auth.one_time_tokens
+         where email = $1 and token_type = any($2::text[])`, [email, "{otp,magiclink}"]);
+      await query(`insert into auth.one_time_tokens (user_id, email, token_type, token, expires_at)
+         values ($1, $2, 'otp', $3, now() + $5::interval),
+                ($1, $2, 'magiclink', $4, now() + $5::interval)`, [linkedUser.id, email, emailOtp, hashedToken, expiry]);
+      return linkedUser;
+    });
+    const actionUrl = new URL(`${this.config.apiUrl}/auth/v1/verify`);
+    actionUrl.searchParams.set("token", hashedToken);
+    actionUrl.searchParams.set("type", "magiclink");
+    actionUrl.searchParams.set("redirect_to", redirectTo);
+    await this.audit("user_magiclink_requested", { actorId: user.id, actorEmail: email, type: "admin" });
+    return json(200, {
+      ...this.userJson(user, [], await this.getUserIdentities(user.id)),
+      action_link: actionUrl.toString(),
+      email_otp: emailOtp,
+      hashed_token: hashedToken,
+      redirect_to: redirectTo,
+      verification_type: "magiclink"
+    });
+  }
   async audit(action, opts = {}) {
     try {
       const payload = {
@@ -1777,7 +2153,8 @@ Or sign in with this link: ${link}`
       email: u.email ?? "",
       email_confirmed_at: iso(u.email_confirmed_at),
       phone: u.phone ?? "",
-      confirmed_at: iso(u.email_confirmed_at),
+      phone_confirmed_at: iso(u.phone_confirmed_at),
+      confirmed_at: iso(u.email_confirmed_at ?? u.phone_confirmed_at),
       last_sign_in_at: iso(u.last_sign_in_at),
       app_metadata: u.raw_app_meta_data ?? {},
       user_metadata: u.raw_user_meta_data ?? {},
@@ -1941,6 +2318,58 @@ var INBOX_HTML = `<!doctype html>
 </body>
 </html>`;
 
+// src/runtime/auth/sms-inbox.ts
+var CAP2 = 200;
+
+class SmsInbox {
+  messages = [];
+  async send(msg) {
+    const id = crypto.randomUUID();
+    this.messages.unshift({
+      ...msg,
+      id,
+      created_at: new Date().toISOString(),
+      code: msg.body.match(/\b\d{6,10}\b/)?.[0] ?? null
+    });
+    if (this.messages.length > CAP2)
+      this.messages.length = CAP2;
+    return { messageId: id };
+  }
+  list() {
+    return this.messages;
+  }
+  clear() {
+    this.messages = [];
+  }
+  serve(req, url) {
+    const method = req.method.toUpperCase();
+    if (url.pathname === "/sms-inbox/api/messages") {
+      if (method === "DELETE") {
+        this.clear();
+        return new Response(null, { status: 204 });
+      }
+      return Response.json({ messages: this.messages });
+    }
+    if (url.pathname === "/sms-inbox" || url.pathname === "/sms-inbox/") {
+      return new Response(SMS_INBOX_HTML, { headers: { "content-type": "text/html; charset=utf-8" } });
+    }
+    return Response.json({ error: "not found" }, { status: 404 });
+  }
+}
+var SMS_INBOX_HTML = `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>SupaCloud Lite \xB7 SMS Inbox</title><style>
+:root{color-scheme:dark}body{margin:0;background:#0a0a0a;color:#fafafa;font:14px/1.5 system-ui,sans-serif}
+header,main{max-width:760px;margin:auto;padding:20px}.msg{border:1px solid #27272a;border-radius:12px;padding:16px;margin:12px 0}
+.code{font:20px ui-monospace,monospace;letter-spacing:3px;color:#34d399}.muted{color:#a1a1aa}button{padding:6px 12px}
+</style></head><body><header><h1>SupaCloud Lite \xB7 SMS Inbox</h1><p class="muted">Loopback local development only</p>
+<button id="clear">Clear</button></header><main id="list">Loading\u2026</main><script>
+const esc=s=>s.replace(/[&<>]/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;'}[c]));
+async function load(){const r=await fetch('/sms-inbox/api/messages');const {messages}=await r.json();
+document.getElementById('list').innerHTML=messages.length?messages.map(m=>'<div class="msg"><div class="muted">to '+esc(m.to)+' \xB7 '+esc(new Date(m.created_at).toLocaleTimeString())+'</div><div class="code">'+esc(m.code||'')+'</div></div>').join(''):'No SMS messages yet.'}
+document.getElementById('clear').onclick=async()=>{await fetch('/sms-inbox/api/messages',{method:'DELETE'});load()};load();setInterval(load,4000)
+</script></body></html>`;
+
 // src/runtime/log-buffer.ts
 class LogBuffer {
   cap;
@@ -2262,12 +2691,34 @@ create table if not exists auth.refresh_tokens (
 create table if not exists auth.one_time_tokens (
   id uuid primary key default gen_random_uuid(),
   user_id uuid,
-  email text not null,
+  email text,
+  phone text,
   token_type text not null,
   token text not null,
   attempts int not null default 0,
   created_at timestamptz default now(),
-  expires_at timestamptz not null
+  expires_at timestamptz not null,
+  constraint one_time_tokens_contact_check check (
+    (email is not null and phone is null) or (email is null and phone is not null)
+  )
+);
+
+-- Minimal engines can persist a database created by an older Lite version.
+-- Standard ALTER statements keep that path compatible without requiring plpgsql.
+alter table auth.one_time_tokens add column if not exists phone text;
+alter table auth.one_time_tokens alter column email drop not null;
+alter table auth.one_time_tokens drop constraint if exists one_time_tokens_contact_check;
+alter table auth.one_time_tokens add constraint one_time_tokens_contact_check check (
+  (email is not null and phone is null) or (email is null and phone is not null)
+);
+
+create unique index if not exists one_time_tokens_phone_type_idx
+  on auth.one_time_tokens(phone, token_type) where phone is not null;
+
+create table if not exists auth.phone_otp_cooldowns (
+  phone_fingerprint text primary key,
+  issuance_id uuid not null,
+  last_sent_at timestamptz not null default now()
 );
 
 create table if not exists auth.identities (
@@ -2332,6 +2783,7 @@ create table if not exists storage.buckets (
   id text primary key,
   name text not null unique,
   owner uuid,
+  owner_id text,
   public boolean default false,
   file_size_limit bigint,
   allowed_mime_types text[],
@@ -2339,11 +2791,17 @@ create table if not exists storage.buckets (
   updated_at timestamptz default now()
 );
 
+alter table storage.buckets add column if not exists owner_id text;
+update storage.buckets
+set owner_id = owner::text
+where owner_id is null and owner is not null;
+
 create table if not exists storage.objects (
   id uuid primary key default gen_random_uuid(),
   bucket_id text not null,
   name text not null,
   owner uuid,
+  owner_id text,
   version text,
   metadata jsonb default '{}'::jsonb,
   created_at timestamptz default now(),
@@ -2352,6 +2810,11 @@ create table if not exists storage.objects (
   unique (bucket_id, name)
 );
 
+alter table storage.objects add column if not exists owner_id text;
+update storage.objects
+set owner_id = owner::text
+where owner_id is null and owner is not null;
+
 create table if not exists supabase_migrations.schema_migrations (
   version text primary key,
   name text,
@@ -2498,12 +2961,43 @@ create index if not exists refresh_tokens_user_id_idx on auth.refresh_tokens(use
 create table if not exists auth.one_time_tokens (
   id uuid primary key default gen_random_uuid(),
   user_id uuid references auth.users(id) on delete cascade,
-  email text not null,
-  token_type text not null, -- otp | magiclink | recovery
+  email text,
+  phone text,
+  token_type text not null, -- otp | magiclink | recovery | sms
   token text not null,
   attempts int not null default 0,
   created_at timestamptz default now(),
-  expires_at timestamptz not null
+  expires_at timestamptz not null,
+  constraint one_time_tokens_contact_check check (
+    (email is not null and phone is null) or (email is null and phone is not null)
+  )
+);
+
+-- Upgrade databases created by Lite <=0.5.9 without touching existing email tokens.
+alter table auth.one_time_tokens add column if not exists phone text;
+alter table auth.one_time_tokens alter column email drop not null;
+do $phone_otp_contact_constraint$
+begin
+  if not exists (
+    select 1 from pg_constraint
+    where conrelid = 'auth.one_time_tokens'::regclass
+      and conname = 'one_time_tokens_contact_check'
+  ) then
+    alter table auth.one_time_tokens add constraint one_time_tokens_contact_check check (
+      (email is not null and phone is null) or (email is null and phone is not null)
+    );
+  end if;
+end $phone_otp_contact_constraint$;
+
+create unique index if not exists one_time_tokens_phone_type_idx
+  on auth.one_time_tokens(phone, token_type) where phone is not null;
+
+-- Only a keyed phone fingerprint is persisted for cooldown enforcement; the
+-- normalized phone number never enters this table.
+create table if not exists auth.phone_otp_cooldowns (
+  phone_fingerprint text primary key,
+  issuance_id uuid not null,
+  last_sent_at timestamptz not null default now()
 );
 
 create table if not exists auth.identities (
@@ -2603,6 +3097,7 @@ create table if not exists storage.buckets (
   id text primary key,
   name text not null unique,
   owner uuid,
+  owner_id text,
   public boolean default false,
   file_size_limit bigint,
   allowed_mime_types text[],
@@ -2610,11 +3105,17 @@ create table if not exists storage.buckets (
   updated_at timestamptz default now()
 );
 
+alter table storage.buckets add column if not exists owner_id text;
+update storage.buckets
+set owner_id = owner::text
+where owner_id is null and owner is not null;
+
 create table if not exists storage.objects (
   id uuid primary key default gen_random_uuid(),
   bucket_id text not null references storage.buckets(id),
   name text not null,
   owner uuid,
+  owner_id text,
   version text,
   metadata jsonb default '{}'::jsonb,
   created_at timestamptz default now(),
@@ -2623,6 +3124,14 @@ create table if not exists storage.objects (
   unique (bucket_id, name)
 );
 
+-- storage-api keeps the legacy UUID owner and the current text owner_id in
+-- parallel. Re-running bootstrap upgrades existing Lite databases and retains
+-- object ownership for rows created before owner_id support was added.
+alter table storage.objects add column if not exists owner_id text;
+update storage.objects
+set owner_id = owner::text
+where owner_id is null and owner is not null;
+
 create index if not exists objects_bucket_name_idx on storage.objects(bucket_id, name);
 
 grant usage on schema storage to anon, authenticated, service_role;
@@ -3715,7 +4224,7 @@ class Database {
       }
     }
     if (seedSql) {
-      const hash = await sha256Hex(seedSql);
+      const hash = await sha256Hex2(seedSql);
       const seen = await this.engine.query(`select 1 from supabase_migrations.seed_files where path = 'supabase/seed.sql' and hash = $1`, [hash]);
       if (seen.rows.length === 0) {
         await this.engine.transaction(async (tx) => {
@@ -4008,7 +4517,7 @@ function quoteIdent(name) {
 function quoteLiteral(value) {
   return `'${value.replaceAll("'", "''")}'`;
 }
-async function sha256Hex(text) {
+async function sha256Hex2(text) {
   const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
   return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
 }
@@ -6028,6 +6537,12 @@ function invalidObjectKey(key) {
     return "object key must not contain . or .. segments";
   return null;
 }
+var LEGACY_OWNER_UUID_PATTERN = /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i;
+function storageObjectOwnership(ctx) {
+  const ownerId = typeof ctx.claims?.sub === "string" ? ctx.claims.sub : null;
+  const legacyOwner = ownerId !== null && LEGACY_OWNER_UUID_PATTERN.test(ownerId) ? ownerId : null;
+  return { legacyOwner, ownerId };
+}
 function storageError(status, error, message) {
   return json3(status, { statusCode: String(status), error, message });
 }
@@ -6366,16 +6881,18 @@ class StorageHandler {
   }
   async persistObject(ctx, bucketId, key, bytes, contentType, cacheControl, upsert) {
     const metadata = objectMetadata(bytes.length, contentType, cacheControl);
+    const ownership = storageObjectOwnership(ctx);
     const previous = (await this.db.query(`select * from storage.objects where bucket_id = $1 and name = $2`, [bucketId, key])).rows[0];
     const objectId = previous?.id ?? crypto.randomUUID();
     const version = createObjectVersion();
     const stagedKey = await this.stageObjectBytes(version, bytes);
     const conflictClause = upsert ? `on conflict (bucket_id, name) do update
-           set metadata = excluded.metadata, owner = excluded.owner, updated_at = now(), version = excluded.version` : "";
+           set metadata = excluded.metadata, owner = excluded.owner, owner_id = excluded.owner_id,
+               updated_at = now(), version = excluded.version` : "";
     let inserted;
     try {
-      const result = await this.db.withContext(ctx, (query) => query(`insert into storage.objects (id, bucket_id, name, owner, metadata, version)
-           values ($1, $2, $3, $4, $5::jsonb, $6) ${conflictClause} returning *`, [objectId, bucketId, key, ctx.claims?.sub ?? null, JSON.stringify(metadata), version]));
+      const result = await this.db.withContext(ctx, (query) => query(`insert into storage.objects (id, bucket_id, name, owner, owner_id, metadata, version)
+           values ($1, $2, $3, $4::uuid, $5, $6::jsonb, $7) ${conflictClause} returning *`, [objectId, bucketId, key, ownership.legacyOwner, ownership.ownerId, JSON.stringify(metadata), version]));
       inserted = result.rows[0];
     } catch (error) {
       if (isRlsDenied(error)) {
@@ -6599,15 +7116,18 @@ class StorageHandler {
     return bucket.file_size_limit != null ? Number(bucket.file_size_limit) : this.config.defaultFileSizeLimit ?? DEFAULT_FILE_SIZE_LIMIT;
   }
   async preflightObjectWrite(ctx, bucketId, key, size, contentType, cacheControl, upsert) {
+    const ownership = storageObjectOwnership(ctx);
     const conflictClause = upsert ? `on conflict (bucket_id, name) do update
-           set metadata = excluded.metadata, owner = excluded.owner, updated_at = now(), version = excluded.version` : "";
+           set metadata = excluded.metadata, owner = excluded.owner, owner_id = excluded.owner_id,
+               updated_at = now(), version = excluded.version` : "";
     try {
       await this.db.withContext(ctx, async (query) => {
-        await query(`insert into storage.objects (bucket_id, name, owner, metadata, version)
-           values ($1, $2, $3, $4::jsonb, $5) ${conflictClause} returning id`, [
+        await query(`insert into storage.objects (bucket_id, name, owner, owner_id, metadata, version)
+           values ($1, $2, $3::uuid, $4, $5::jsonb, $6) ${conflictClause} returning id`, [
           bucketId,
           key,
-          ctx.claims?.sub ?? null,
+          ownership.legacyOwner,
+          ownership.ownerId,
           JSON.stringify(objectMetadata(size, contentType ?? "application/octet-stream", cacheControl ?? "no-cache")),
           createObjectVersion()
         ]);
@@ -6732,11 +7252,21 @@ class StorageHandler {
       return json3(200, { message: "Successfully moved" });
     }
     const copyId = crypto.randomUUID();
+    const ownership = storageObjectOwnership(ctx);
     try {
-      const copied = await this.db.withContext(ctx, (query) => query(`insert into storage.objects (id, bucket_id, name, owner, metadata, version)
-           select $1, $4, $5, $6, metadata, $7
+      const copied = await this.db.withContext(ctx, (query) => query(`insert into storage.objects (id, bucket_id, name, owner, owner_id, metadata, version)
+           select $1, $4, $5, $6::uuid, $7, metadata, $8
            from storage.objects where bucket_id = $2 and name = $3
-           returning *`, [copyId, body.bucketId, body.sourceKey, dstBucket, body.destinationKey, ctx.claims?.sub ?? null, version]));
+           returning *`, [
+        copyId,
+        body.bucketId,
+        body.sourceKey,
+        dstBucket,
+        body.destinationKey,
+        ownership.legacyOwner,
+        ownership.ownerId,
+        version
+      ]));
       if (copied.rows.length === 0)
         throw new Error("storage copy source disappeared");
     } catch (error) {
@@ -7572,6 +8102,7 @@ class RetentionService {
   async runSweep() {
     const now = this.now();
     await this.run(`delete from auth.one_time_tokens where expires_at < now()`);
+    await this.run(`delete from auth.phone_otp_cooldowns where last_sent_at < now() - interval '1 day'`);
     await this.run(`delete from auth.mfa_challenges where expires_at < now()`);
     await this.run(`delete from auth.flow_state where expires_at < now()`);
     await this.run(`delete from public.supacloud_pgredis_kv where expires_at <= now()`);
@@ -8073,6 +8604,8 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
       log(`[mail] to=${msg.to} subject="${msg.subject}"`);
     }
   };
+  const smsInbox = config.smsSender || exposed ? null : new SmsInbox;
+  const smsSender = config.smsSender ?? smsInbox;
   const authSettings = await loadAuthSettings(db, config.authSettings);
   const storage = new StorageHandler(db, config.storageDriver ?? new MemoryStorageDriver, {
     jwtSecret,
@@ -8089,6 +8622,8 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
     sessionTimeboxSeconds: config.sessionTimeboxSeconds,
     sessionInactivitySeconds: config.sessionInactivitySeconds,
     mailer,
+    smsSender,
+    log,
     oauthProviders: config.oauthProviders,
     oauthFetch: config.oauthFetch,
     uriAllowList: config.uriAllowList,
@@ -8177,6 +8712,9 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
     if (inbox && (path === "/inbox" || path.startsWith("/inbox/"))) {
       return withCors(inbox.serve(req, url));
     }
+    if (smsInbox && (path === "/sms-inbox" || path.startsWith("/sms-inbox/"))) {
+      return withCors(smsInbox.serve(req, url));
+    }
     if (path.startsWith("/storage/v1/object/public/") || path.startsWith("/storage/v1/object/sign/") || path.startsWith("/storage/v1/render/image/public/") || path.startsWith("/storage/v1/render/image/sign/")) {
       if (req.method === "GET" || req.method === "HEAD") {
         return withCors(await storage.handle(req, { role: "anon", claims: null }, url));
@@ -8271,6 +8809,7 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
     jwtSecret,
     logs,
     inbox,
+    smsInbox,
     migrate: (migrations, seedSql) => db.runMigrations(migrations, seedSql),
     close: () => {
       closePromise ??= (async () => {
@@ -8724,6 +9263,7 @@ function readAuth(root, env) {
 function readAuthSettings(root) {
   const auth = tableAt(root, "auth");
   const email = tableAt(root, "auth.email");
+  const sms = tableAt(root, "auth.sms");
   const mfa = tableAt(root, "auth.mfa");
   const mfaTotp = tableAt(root, "auth.mfa.totp");
   const out = {};
@@ -8748,6 +9288,18 @@ function readAuthSettings(root) {
   const otpExpiry = getInt(email, "otp_expiry");
   if (otpExpiry !== undefined)
     out.otpExpirySeconds = otpExpiry;
+  const smsEnabled = getBool(sms, "enabled");
+  if (smsEnabled !== undefined)
+    out.smsEnabled = smsEnabled;
+  const smsSignup = getBool(sms, "enable_signup");
+  if (smsSignup !== undefined)
+    out.smsSignupEnabled = smsSignup;
+  const smsFrequency = getDurationSeconds(sms, "max_frequency");
+  if (smsFrequency !== undefined)
+    out.smsOtpCooldownSeconds = smsFrequency;
+  const smsTemplate = getString(sms, "template");
+  if (smsTemplate !== undefined)
+    out.smsTemplate = smsTemplate;
   const maxFactors = getInt(mfa, "max_enrolled_factors");
   if (maxFactors !== undefined)
     out.maxEnrolledFactors = maxFactors;
@@ -8779,6 +9331,9 @@ function readRateLimits(root) {
     out.otp = { limit: email, windowMs: ONE_HOUR };
     out.recover = { limit: email, windowMs: ONE_HOUR };
   }
+  const sms = getInt(rl, "sms_sent");
+  if (sms !== undefined)
+    out.sms = { limit: sms, windowMs: ONE_HOUR };
   return Object.keys(out).length ? out : undefined;
 }
 function readOAuthProviders(root, env) {
@@ -9316,6 +9871,7 @@ async function createProjectBackend(options = {}) {
     sessionTimeboxSeconds: config.auth.sessionTimeboxSeconds,
     sessionInactivitySeconds: config.auth.sessionInactivitySeconds,
     oauthProviders: config.auth.oauthProviders,
+    smsSender: options.smsSender,
     dbSchemas: config.api.schemas,
     maxRows: config.api.maxRows,
     storageFileSizeLimit: config.storage.fileSizeLimit,