@supacloud/lite 0.5.9 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [0.6.0](https://github.com/zuohuadong/supacloud/compare/supacloud-lite-v0.5.10...supacloud-lite-v0.6.0) (2026-08-11)
+
+
+### Features
+
+* **lite:** add secure phone OTP compatibility ([#790](https://github.com/zuohuadong/supacloud/issues/790)) ([b16b88d](https://github.com/zuohuadong/supacloud/commit/b16b88d36629fbb47e8afbfc25d2e75abf59b234))
+
+
+### Bug Fixes
+
+* **lite:** support storage owner_id compatibility ([#787](https://github.com/zuohuadong/supacloud/issues/787)) ([5fe92ea](https://github.com/zuohuadong/supacloud/commit/5fe92ea141a8fdc9328708ff8e2b565529fd8393))
+
+## [0.5.10](https://github.com/zuohuadong/supacloud/compare/supacloud-lite-v0.5.9...supacloud-lite-v0.5.10) (2026-08-10)
+
+
+### Bug Fixes
+
+* **lite:** default PGlite timezone to UTC ([#793](https://github.com/zuohuadong/supacloud/issues/793)) ([e79cb42](https://github.com/zuohuadong/supacloud/commit/e79cb421e970f94a06df01d4e325f75960803c6d))
+* **lite:** delegate function CORS preflights ([#792](https://github.com/zuohuadong/supacloud/issues/792)) ([5dd5f0f](https://github.com/zuohuadong/supacloud/commit/5dd5f0f290c6edf81c335bda8cdc27e857d4eabd))
+* **lite:** respect project function execution grants ([#795](https://github.com/zuohuadong/supacloud/issues/795)) ([becd0ec](https://github.com/zuohuadong/supacloud/commit/becd0ecc5cc255777a225d9378b5cd3135136fce))
+
 ## [0.5.9](https://github.com/zuohuadong/supacloud/compare/supacloud-lite-v0.5.8...supacloud-lite-v0.5.9) (2026-08-09)
 
 

package/README.md

@@ -87,6 +87,10 @@ enabled = false
 
 关闭后 `/auth/v1/*` 返回 `404`，但不会把 Lite 变成完整 GoTrue 运行时，也不会自动移除已有的 `auth` schema 或 API key。需要完整 GoTrue 行为、多项目鉴权或独立鉴权进程时，应使用完整 SupaCloud 平台。
 
+在 loopback 地址启动时，Lite 会启用兼容 `signInWithOtp({ phone })` / `verifyOtp({ type: 'sms' })` 的本地短信收件箱，可在 `/sms-inbox` 查看验证码。短信收件箱与邮件收件箱独立、内存有界，绑定到非 loopback 地址时绝不会挂载。网络暴露的嵌入式用法必须显式注入 `BackendConfig.smsSender`；Lite 没有会把验证码写入控制台的生产 fallback。
+
+手机号必须是 E.164 格式。短信验证码在数据库中保存为域分离的 keyed-HMAC，单次兑换、最多五次错误、按可信连接 IP/手机号指纹限流，并默认对同一手机号执行 60 秒持久化发送冷却。自定义 sender 的异常只返回净化错误，不记录手机号、验证码、短信正文或供应商响应。
+
 ### CLI
 
 ```text
@@ -173,6 +177,22 @@ bunx supacloud-lite upgrade
 
 替换程序文件与数据库迁移是两个独立动作。`upgrade` 不会联网、自我替换二进制或修改 `package.json`；它默认先把升级前快照写入 `.supacloud-lite/backups/pre-upgrade-<timestamp>.tar.gz`，快照成功后才执行尚未记录的 migrations 和 seed。升级失败时快照会保留，并打印恢复命令。需要回滚时，停止候选进程，用升级前快照恢复状态，再重新启动上一个已验证版本。
 
+旧版 Lite 曾在 `public` schema 中直接给 `anon`、`authenticated` 和 `service_role` 授予函数执行权。已有持久化项目可能仍保留这些 ACL 和默认 ACL。升级不会自动批量撤销，因为 PostgreSQL 不能可靠区分旧版 Lite 注入的权限与项目显式授权。升级后应先创建快照，再审计 `pg_proc.proacl` 和 `pg_default_acl`。如果确认三个角色的默认函数权限不是项目意图，请先在新 migration 中撤销它们，再为需要收紧的每个已有函数增加带完整签名的显式 `REVOKE` / `GRANT`。不要对整个 schema 的已有函数执行无差别 `REVOKE`。可丢弃的本地项目可以使用 `supacloud-lite db reset` 在新的默认权限上重放 migrations；仅重启旧状态不会清理历史 ACL。
+
+```sql
+select n.nspname, p.proname, pg_get_function_identity_arguments(p.oid), p.proacl
+from pg_proc p
+join pg_namespace n on n.oid = p.pronamespace
+where n.nspname = 'public'
+order by p.proname, pg_get_function_identity_arguments(p.oid);
+
+select defaclrole, defaclnamespace, defaclobjtype, defaclacl
+from pg_default_acl;
+
+alter default privileges in schema public
+  revoke execute on functions from anon, authenticated, service_role;
+```
+
 也可以单独创建可移植快照：
 
 ```bash
@@ -399,6 +419,10 @@ enabled = false
 
 When disabled, `/auth/v1/*` returns `404`, but this does not turn Lite into a full GoTrue runtime, nor does it automatically remove the existing `auth` schema or API keys. When you need full GoTrue behavior, multi-project authentication, or a standalone authentication process, use the full SupaCloud platform.
 
+When bound to loopback, Lite enables a local SMS inbox compatible with `signInWithOtp({ phone })` / `verifyOtp({ type: 'sms' })`; open `/sms-inbox` to inspect codes. The SMS inbox is independent from email, memory-bounded, and never mounted on a network-exposed bind. Embedded network deployments must inject `BackendConfig.smsSender`; there is no production console fallback for OTP bodies.
+
+Phone numbers must use E.164. SMS codes are stored as domain-separated keyed HMACs, are single-use, burn after five wrong attempts, and are limited by trusted connection IP plus a keyed phone fingerprint, with a persistent 60-second per-phone send cooldown by default. Provider failures are sanitized and never log the phone, code, SMS body, or raw provider response.
+
 ### CLI
 
 ```text
@@ -485,6 +509,22 @@ For single-binary installs, download and verify the candidate file first, then h
 
 Replacing the program file and migrating the database are two separate actions. `upgrade` does not go online, self-replace the binary, or modify `package.json`; it first writes a pre-upgrade snapshot to `.supacloud-lite/backups/pre-upgrade-<timestamp>.tar.gz` by default, and only after the snapshot succeeds does it apply the unrecorded migrations and seed. If the upgrade fails, the snapshot is retained and a restore command is printed. To roll back, stop the candidate process, restore state from the pre-upgrade snapshot, and restart the last verified version.
 
+Older Lite versions directly granted function execution in the `public` schema to `anon`, `authenticated`, and `service_role`. Existing persistent projects may retain those ACLs and default ACLs. Upgrades do not revoke them in bulk because PostgreSQL cannot reliably distinguish an old Lite-injected grant from an intentional project grant. After taking a snapshot, audit `pg_proc.proacl` and `pg_default_acl`. If the three roles' default function privileges are not project intent, revoke them in a new migration, then add an explicit `REVOKE` / `GRANT` with the complete signature for each existing function that needs tighter access. Do not issue an indiscriminate schema-wide `REVOKE` against existing functions. Disposable local projects can use `supacloud-lite db reset` to replay migrations on the corrected defaults; merely restarting an old state does not remove historical ACLs.
+
+```sql
+select n.nspname, p.proname, pg_get_function_identity_arguments(p.oid), p.proacl
+from pg_proc p
+join pg_namespace n on n.oid = p.pronamespace
+where n.nspname = 'public'
+order by p.proname, pg_get_function_identity_arguments(p.oid);
+
+select defaclrole, defaclnamespace, defaclobjtype, defaclacl
+from pg_default_acl;
+
+alter default privileges in schema public
+  revoke execute on functions from anon, authenticated, service_role;
+```
+
 You can also create a portable snapshot separately:
 
 ```bash