@supacloud/lite 0.8.0 → 0.8.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.8.1](https://github.com/zuohuadong/supacloud/compare/supacloud-lite-v0.8.0...supacloud-lite-v0.8.1) (2026-08-15)
+
+
+### Bug Fixes
+
+* **lite:** complete extended auth compatibility ([#912](https://github.com/zuohuadong/supacloud/issues/912)) ([dd657f5](https://github.com/zuohuadong/supacloud/commit/dd657f5b52f2f3d65c0178f76fd78d027c153c5a))
+
 ## [0.8.0](https://github.com/zuohuadong/supacloud/compare/supacloud-lite-v0.7.3...supacloud-lite-v0.8.0) (2026-08-15)
 
 

package/dist/cli.js

@@ -8,7 +8,7 @@ import { dirname as dirname7, join as join10, resolve as resolve4 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.8.0",
+  version: "0.8.1",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -1296,7 +1296,8 @@ class AuthHandler {
         return await this.oauth.authorize(url);
       }
       if (path === "callback" && (method === "GET" || method === "POST")) {
-        return await this.oauth.callback(url, (userId) => this.sessionTokensFor(userId));
+        const callbackUrl = method === "POST" ? await this.oauthCallbackUrl(req, url) : url;
+        return await this.oauth.callback(callbackUrl, (userId) => this.oauthSessionTokensFor(userId));
       }
       if (path.startsWith("admin/"))
         return await this.admin(req, ctx, path, method);
@@ -1306,6 +1307,16 @@ class AuthHandler {
       return authError(500, "unexpected_failure", msg);
     }
   }
+  async oauthCallbackUrl(req, url) {
+    const callbackUrl = new URL(url);
+    const form = await req.formData();
+    for (const field of ["code", "state"]) {
+      const value = form.get(field);
+      if (typeof value === "string" && value)
+        callbackUrl.searchParams.set(field, value);
+    }
+    return callbackUrl;
+  }
   async signup(req) {
     const body = await req.json().catch(() => ({}));
     if (!body.email && !body.password) {
@@ -1383,7 +1394,7 @@ class AuthHandler {
       if (!userId)
         return authError(403, "flow_state_not_found", "invalid or expired auth code");
       const ures = await this.db.query(`select * from auth.users where id = $1`, [userId]);
-      return json(200, await this.sessionFor(ures.rows[0]));
+      return json(200, await this.sessionForOAuth(ures.rows[0]));
     }
     return authError(400, "invalid_grant", `unsupported grant_type: ${grantType}`);
   }
@@ -1428,17 +1439,18 @@ class AuthHandler {
       sets.push(`is_anonymous = false`);
       sets.push(`raw_app_meta_data = coalesce(raw_app_meta_data, '{}'::jsonb) || '{"provider":"email","providers":["email"]}'::jsonb`);
     }
-    if (sets.length === 0)
-      return json(200, this.userJson(user));
-    params.push(user.id);
-    const res = await this.db.query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
-    const updated = res.rows[0];
-    if (upgradingAnon) {
-      await this.db.query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
-         values ($1, 'email', $2, $3)
-         on conflict (provider, provider_id) do nothing`, [updated.id, updated.id, JSON.stringify({ sub: updated.id, email: updated.email })]);
+    if (sets.length === 0) {
+      return json(200, this.userJson(user, await this.getUserFactors(user.id), await this.getUserIdentities(user.id)));
     }
-    return json(200, this.userJson(updated));
+    params.push(user.id);
+    const payload = await this.db.transaction(async (query) => {
+      const res = await query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
+      const updated = res.rows[0];
+      if (body.email)
+        await this.ensureEmailIdentity(updated, query);
+      return this.userJsonWithRelations(updated, query);
+    });
+    return json(200, payload);
   }
   async logout(req, url) {
     const claims = await this.claimsFromBearer(req);
@@ -1468,7 +1480,7 @@ class AuthHandler {
     let user = res.rows[0];
     if (!user) {
       if (!createUser)
-        return authError(422, "otp_disabled", "Signups not allowed for otp");
+        return json(200, {});
       if (this.settings.disableSignup)
         return authError(422, "signup_disabled", "Signups not allowed for this instance");
       res = await this.db.query(`insert into auth.users (aud, role, email, raw_app_meta_data, raw_user_meta_data)
@@ -1800,6 +1812,8 @@ Or sign in with this link: ${link}`
     }
     const idMatch = path.match(/^admin\/users\/([0-9a-f-]{36})$/);
     const exportMatch = path.match(/^admin\/users\/([0-9a-f-]{36})\/export$/);
+    const factorsMatch = path.match(/^admin\/users\/([0-9a-f-]{36})\/factors$/);
+    const factorMatch = path.match(/^admin\/users\/([0-9a-f-]{36})\/factors\/([0-9a-f-]{36})$/);
     if (path === "admin/generate_link" && method === "POST") {
       return await this.generateAdminMagicLink(req);
     }
@@ -1811,32 +1825,49 @@ Or sign in with this link: ${link}`
     if (exportMatch && method === "GET") {
       return await this.exportUser(exportMatch[1]);
     }
+    if (factorsMatch && method === "GET") {
+      const user = await this.db.query(`select 1 from auth.users where id = $1`, [factorsMatch[1]]);
+      if (user.rows.length === 0)
+        return authError(404, "user_not_found", "User not found");
+      return json(200, await this.getUserFactors(factorsMatch[1]));
+    }
+    if (factorMatch && method === "DELETE") {
+      const deleted = await this.db.query(`delete from auth.mfa_factors where user_id = $1 and id = $2 returning id`, [factorMatch[1], factorMatch[2]]);
+      if (deleted.rows.length === 0)
+        return authError(404, "mfa_factor_not_found", "MFA factor not found");
+      return json(200, { id: factorMatch[2] });
+    }
     if (path === "admin/users" && method === "GET") {
       const res = await this.db.query(`select * from auth.users order by created_at desc limit 1000`);
-      return json(200, { users: res.rows.map((u) => this.userJson(u)), aud: "authenticated" });
+      return json(200, { users: res.rows.map((user) => this.userJson(user)), aud: "authenticated" });
     }
     if (path === "admin/users" && method === "POST") {
       const body = await req.json().catch(() => ({}));
       if (!body.email)
         return authError(400, "validation_failed", "email is required");
       const hashed = body.password ? await hashPassword(body.password) : null;
-      const res = await this.db.query(`insert into auth.users
-           (aud, role, email, encrypted_password, email_confirmed_at, raw_app_meta_data, raw_user_meta_data)
-         values ('authenticated', 'authenticated', $1, $2, case when $3 then now() else null end, $4, $5)
-         returning *`, [
-        body.email.toLowerCase().trim(),
-        hashed,
-        body.email_confirm ?? true,
-        JSON.stringify({ provider: "email", providers: ["email"], ...body.app_metadata ?? {} }),
-        JSON.stringify(body.user_metadata ?? {})
-      ]);
-      return json(200, this.userJson(res.rows[0]));
+      const created = await this.db.transaction(async (query) => {
+        const res = await query(`insert into auth.users
+             (aud, role, email, encrypted_password, email_confirmed_at, raw_app_meta_data, raw_user_meta_data)
+           values ('authenticated', 'authenticated', $1, $2, case when $3 then now() else null end, $4, $5)
+           returning *`, [
+          body.email.toLowerCase().trim(),
+          hashed,
+          body.email_confirm ?? true,
+          JSON.stringify({ provider: "email", providers: ["email"], ...body.app_metadata ?? {} }),
+          JSON.stringify(body.user_metadata ?? {})
+        ]);
+        const user = res.rows[0];
+        await this.ensureEmailIdentity(user, query);
+        return this.userJsonWithRelations(user, query);
+      });
+      return json(200, created);
     }
     if (idMatch && method === "GET") {
       const res = await this.db.query(`select * from auth.users where id = $1`, [idMatch[1]]);
       if (res.rows.length === 0)
         return authError(404, "user_not_found", "User not found");
-      return json(200, this.userJson(res.rows[0]));
+      return json(200, await this.userJsonWithRelations(res.rows[0]));
     }
     if (idMatch && method === "PUT") {
       const body = await req.json().catch(() => ({}));
@@ -1863,10 +1894,18 @@ Or sign in with this link: ${link}`
       if (sets.length === 0)
         return authError(400, "validation_failed", "nothing to update");
       params.push(idMatch[1]);
-      const res = await this.db.query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
-      if (res.rows.length === 0)
+      const updated = await this.db.transaction(async (query) => {
+        const res = await query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
+        const user = res.rows[0];
+        if (!user)
+          return null;
+        if (typeof body.email === "string")
+          await this.ensureEmailIdentity(user, query);
+        return this.userJsonWithRelations(user, query);
+      });
+      if (!updated)
         return authError(404, "user_not_found", "User not found");
-      return json(200, this.userJson(res.rows[0]));
+      return json(200, updated);
     }
     if (idMatch && method === "DELETE") {
       return await this.eraseUser(idMatch[1]);
@@ -2062,17 +2101,26 @@ Or sign in with this link: ${link}`
     if (!await verifyTotp(factor.secret, body.code ?? "")) {
       return authError(422, "mfa_verification_failed", "Invalid TOTP code entered");
     }
-    await this.db.query(`update auth.mfa_challenges set verified_at = now() where id = $1`, [challenge.id]);
-    if (factor.status !== "verified") {
-      await this.db.query(`update auth.mfa_factors set status = 'verified', updated_at = now() where id = $1`, [factorId]);
-    }
-    const session = await this.sessionFor(user, undefined, {
-      aal: "aal2",
-      amr: [
-        { method: "password", timestamp: Math.floor(Date.now() / 1000) },
-        { method: "totp", timestamp: Math.floor(Date.now() / 1000) }
-      ]
+    const session = await this.db.transaction(async (query) => {
+      const claimed = await query(`update auth.mfa_challenges set verified_at = now()
+         where id = $1 and factor_id = $2 and verified_at is null and expires_at >= now()
+         returning id`, [challenge.id, factorId]);
+      if (claimed.rows.length === 0)
+        return null;
+      if (factor.status !== "verified") {
+        await query(`update auth.mfa_factors set status = 'verified', updated_at = now() where id = $1`, [factorId]);
+      }
+      return this.sessionFor(user, undefined, {
+        aal: "aal2",
+        amr: [
+          { method: "password", timestamp: Math.floor(Date.now() / 1000) },
+          { method: "totp", timestamp: Math.floor(Date.now() / 1000) }
+        ]
+      }, query);
     });
+    if (!session) {
+      return authError(422, "mfa_verification_failed", "This challenge has already been verified");
+    }
     return json(200, session);
   }
   async unenrollFactor(req, factorId) {
@@ -2110,6 +2158,17 @@ Or sign in with this link: ${link}`
       updated_at: iso(r.updated_at)
     }));
   }
+  async ensureEmailIdentity(user, query = (sql, params) => this.db.query(sql, params)) {
+    if (!user.email)
+      return;
+    await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
+       values ($1::uuid, 'email', $1::text, $2::jsonb)
+       on conflict (provider, provider_id) do update
+       set identity_data = excluded.identity_data, updated_at = now()`, [user.id, JSON.stringify({ sub: user.id, email: user.email })]);
+  }
+  async userJsonWithRelations(user, query = (sql, params) => this.db.query(sql, params)) {
+    return this.userJson(user, await this.getUserFactors(user.id, query), await this.getUserIdentities(user.id, query));
+  }
   async rotateRefreshToken(token) {
     return this.db.transaction(async (query) => {
       const claimedToken = await this.claimRefreshToken(query, token);
@@ -2183,9 +2242,14 @@ Or sign in with this link: ${link}`
       is_anonymous: u.is_anonymous ?? false
     };
   }
-  async sessionTokensFor(userId) {
+  sessionForOAuth(user) {
+    return this.sessionFor(user, undefined, {
+      amr: [{ method: "oauth", timestamp: Math.floor(Date.now() / 1000) }]
+    });
+  }
+  async oauthSessionTokensFor(userId) {
     const res = await this.db.query(`select * from auth.users where id = $1`, [userId]);
-    const session = await this.sessionFor(res.rows[0]);
+    const session = await this.sessionForOAuth(res.rows[0]);
     return { access_token: session.access_token, refresh_token: session.refresh_token, expires_in: session.expires_in };
   }
   async sessionFor(user, parentToken, opts, query = (sql, params) => this.db.query(sql, params)) {

package/dist/index.js

@@ -85,7 +85,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.8.0",
+  version: "0.8.1",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -1301,7 +1301,8 @@ class AuthHandler {
         return await this.oauth.authorize(url);
       }
       if (path === "callback" && (method === "GET" || method === "POST")) {
-        return await this.oauth.callback(url, (userId) => this.sessionTokensFor(userId));
+        const callbackUrl = method === "POST" ? await this.oauthCallbackUrl(req, url) : url;
+        return await this.oauth.callback(callbackUrl, (userId) => this.oauthSessionTokensFor(userId));
       }
       if (path.startsWith("admin/"))
         return await this.admin(req, ctx, path, method);
@@ -1311,6 +1312,16 @@ class AuthHandler {
       return authError(500, "unexpected_failure", msg);
     }
   }
+  async oauthCallbackUrl(req, url) {
+    const callbackUrl = new URL(url);
+    const form = await req.formData();
+    for (const field of ["code", "state"]) {
+      const value = form.get(field);
+      if (typeof value === "string" && value)
+        callbackUrl.searchParams.set(field, value);
+    }
+    return callbackUrl;
+  }
   async signup(req) {
     const body = await req.json().catch(() => ({}));
     if (!body.email && !body.password) {
@@ -1388,7 +1399,7 @@ class AuthHandler {
       if (!userId)
         return authError(403, "flow_state_not_found", "invalid or expired auth code");
       const ures = await this.db.query(`select * from auth.users where id = $1`, [userId]);
-      return json(200, await this.sessionFor(ures.rows[0]));
+      return json(200, await this.sessionForOAuth(ures.rows[0]));
     }
     return authError(400, "invalid_grant", `unsupported grant_type: ${grantType}`);
   }
@@ -1433,17 +1444,18 @@ class AuthHandler {
       sets.push(`is_anonymous = false`);
       sets.push(`raw_app_meta_data = coalesce(raw_app_meta_data, '{}'::jsonb) || '{"provider":"email","providers":["email"]}'::jsonb`);
     }
-    if (sets.length === 0)
-      return json(200, this.userJson(user));
-    params.push(user.id);
-    const res = await this.db.query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
-    const updated = res.rows[0];
-    if (upgradingAnon) {
-      await this.db.query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
-         values ($1, 'email', $2, $3)
-         on conflict (provider, provider_id) do nothing`, [updated.id, updated.id, JSON.stringify({ sub: updated.id, email: updated.email })]);
+    if (sets.length === 0) {
+      return json(200, this.userJson(user, await this.getUserFactors(user.id), await this.getUserIdentities(user.id)));
     }
-    return json(200, this.userJson(updated));
+    params.push(user.id);
+    const payload = await this.db.transaction(async (query) => {
+      const res = await query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
+      const updated = res.rows[0];
+      if (body.email)
+        await this.ensureEmailIdentity(updated, query);
+      return this.userJsonWithRelations(updated, query);
+    });
+    return json(200, payload);
   }
   async logout(req, url) {
     const claims = await this.claimsFromBearer(req);
@@ -1473,7 +1485,7 @@ class AuthHandler {
     let user = res.rows[0];
     if (!user) {
       if (!createUser)
-        return authError(422, "otp_disabled", "Signups not allowed for otp");
+        return json(200, {});
       if (this.settings.disableSignup)
         return authError(422, "signup_disabled", "Signups not allowed for this instance");
       res = await this.db.query(`insert into auth.users (aud, role, email, raw_app_meta_data, raw_user_meta_data)
@@ -1805,6 +1817,8 @@ Or sign in with this link: ${link}`
     }
     const idMatch = path.match(/^admin\/users\/([0-9a-f-]{36})$/);
     const exportMatch = path.match(/^admin\/users\/([0-9a-f-]{36})\/export$/);
+    const factorsMatch = path.match(/^admin\/users\/([0-9a-f-]{36})\/factors$/);
+    const factorMatch = path.match(/^admin\/users\/([0-9a-f-]{36})\/factors\/([0-9a-f-]{36})$/);
     if (path === "admin/generate_link" && method === "POST") {
       return await this.generateAdminMagicLink(req);
     }
@@ -1816,32 +1830,49 @@ Or sign in with this link: ${link}`
     if (exportMatch && method === "GET") {
       return await this.exportUser(exportMatch[1]);
     }
+    if (factorsMatch && method === "GET") {
+      const user = await this.db.query(`select 1 from auth.users where id = $1`, [factorsMatch[1]]);
+      if (user.rows.length === 0)
+        return authError(404, "user_not_found", "User not found");
+      return json(200, await this.getUserFactors(factorsMatch[1]));
+    }
+    if (factorMatch && method === "DELETE") {
+      const deleted = await this.db.query(`delete from auth.mfa_factors where user_id = $1 and id = $2 returning id`, [factorMatch[1], factorMatch[2]]);
+      if (deleted.rows.length === 0)
+        return authError(404, "mfa_factor_not_found", "MFA factor not found");
+      return json(200, { id: factorMatch[2] });
+    }
     if (path === "admin/users" && method === "GET") {
       const res = await this.db.query(`select * from auth.users order by created_at desc limit 1000`);
-      return json(200, { users: res.rows.map((u) => this.userJson(u)), aud: "authenticated" });
+      return json(200, { users: res.rows.map((user) => this.userJson(user)), aud: "authenticated" });
     }
     if (path === "admin/users" && method === "POST") {
       const body = await req.json().catch(() => ({}));
       if (!body.email)
         return authError(400, "validation_failed", "email is required");
       const hashed = body.password ? await hashPassword(body.password) : null;
-      const res = await this.db.query(`insert into auth.users
-           (aud, role, email, encrypted_password, email_confirmed_at, raw_app_meta_data, raw_user_meta_data)
-         values ('authenticated', 'authenticated', $1, $2, case when $3 then now() else null end, $4, $5)
-         returning *`, [
-        body.email.toLowerCase().trim(),
-        hashed,
-        body.email_confirm ?? true,
-        JSON.stringify({ provider: "email", providers: ["email"], ...body.app_metadata ?? {} }),
-        JSON.stringify(body.user_metadata ?? {})
-      ]);
-      return json(200, this.userJson(res.rows[0]));
+      const created = await this.db.transaction(async (query) => {
+        const res = await query(`insert into auth.users
+             (aud, role, email, encrypted_password, email_confirmed_at, raw_app_meta_data, raw_user_meta_data)
+           values ('authenticated', 'authenticated', $1, $2, case when $3 then now() else null end, $4, $5)
+           returning *`, [
+          body.email.toLowerCase().trim(),
+          hashed,
+          body.email_confirm ?? true,
+          JSON.stringify({ provider: "email", providers: ["email"], ...body.app_metadata ?? {} }),
+          JSON.stringify(body.user_metadata ?? {})
+        ]);
+        const user = res.rows[0];
+        await this.ensureEmailIdentity(user, query);
+        return this.userJsonWithRelations(user, query);
+      });
+      return json(200, created);
     }
     if (idMatch && method === "GET") {
       const res = await this.db.query(`select * from auth.users where id = $1`, [idMatch[1]]);
       if (res.rows.length === 0)
         return authError(404, "user_not_found", "User not found");
-      return json(200, this.userJson(res.rows[0]));
+      return json(200, await this.userJsonWithRelations(res.rows[0]));
     }
     if (idMatch && method === "PUT") {
       const body = await req.json().catch(() => ({}));
@@ -1868,10 +1899,18 @@ Or sign in with this link: ${link}`
       if (sets.length === 0)
         return authError(400, "validation_failed", "nothing to update");
       params.push(idMatch[1]);
-      const res = await this.db.query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
-      if (res.rows.length === 0)
+      const updated = await this.db.transaction(async (query) => {
+        const res = await query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
+        const user = res.rows[0];
+        if (!user)
+          return null;
+        if (typeof body.email === "string")
+          await this.ensureEmailIdentity(user, query);
+        return this.userJsonWithRelations(user, query);
+      });
+      if (!updated)
         return authError(404, "user_not_found", "User not found");
-      return json(200, this.userJson(res.rows[0]));
+      return json(200, updated);
     }
     if (idMatch && method === "DELETE") {
       return await this.eraseUser(idMatch[1]);
@@ -2067,17 +2106,26 @@ Or sign in with this link: ${link}`
     if (!await verifyTotp(factor.secret, body.code ?? "")) {
       return authError(422, "mfa_verification_failed", "Invalid TOTP code entered");
     }
-    await this.db.query(`update auth.mfa_challenges set verified_at = now() where id = $1`, [challenge.id]);
-    if (factor.status !== "verified") {
-      await this.db.query(`update auth.mfa_factors set status = 'verified', updated_at = now() where id = $1`, [factorId]);
-    }
-    const session = await this.sessionFor(user, undefined, {
-      aal: "aal2",
-      amr: [
-        { method: "password", timestamp: Math.floor(Date.now() / 1000) },
-        { method: "totp", timestamp: Math.floor(Date.now() / 1000) }
-      ]
+    const session = await this.db.transaction(async (query) => {
+      const claimed = await query(`update auth.mfa_challenges set verified_at = now()
+         where id = $1 and factor_id = $2 and verified_at is null and expires_at >= now()
+         returning id`, [challenge.id, factorId]);
+      if (claimed.rows.length === 0)
+        return null;
+      if (factor.status !== "verified") {
+        await query(`update auth.mfa_factors set status = 'verified', updated_at = now() where id = $1`, [factorId]);
+      }
+      return this.sessionFor(user, undefined, {
+        aal: "aal2",
+        amr: [
+          { method: "password", timestamp: Math.floor(Date.now() / 1000) },
+          { method: "totp", timestamp: Math.floor(Date.now() / 1000) }
+        ]
+      }, query);
     });
+    if (!session) {
+      return authError(422, "mfa_verification_failed", "This challenge has already been verified");
+    }
     return json(200, session);
   }
   async unenrollFactor(req, factorId) {
@@ -2115,6 +2163,17 @@ Or sign in with this link: ${link}`
       updated_at: iso(r.updated_at)
     }));
   }
+  async ensureEmailIdentity(user, query = (sql, params) => this.db.query(sql, params)) {
+    if (!user.email)
+      return;
+    await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
+       values ($1::uuid, 'email', $1::text, $2::jsonb)
+       on conflict (provider, provider_id) do update
+       set identity_data = excluded.identity_data, updated_at = now()`, [user.id, JSON.stringify({ sub: user.id, email: user.email })]);
+  }
+  async userJsonWithRelations(user, query = (sql, params) => this.db.query(sql, params)) {
+    return this.userJson(user, await this.getUserFactors(user.id, query), await this.getUserIdentities(user.id, query));
+  }
   async rotateRefreshToken(token) {
     return this.db.transaction(async (query) => {
       const claimedToken = await this.claimRefreshToken(query, token);
@@ -2188,9 +2247,14 @@ Or sign in with this link: ${link}`
       is_anonymous: u.is_anonymous ?? false
     };
   }
-  async sessionTokensFor(userId) {
+  sessionForOAuth(user) {
+    return this.sessionFor(user, undefined, {
+      amr: [{ method: "oauth", timestamp: Math.floor(Date.now() / 1000) }]
+    });
+  }
+  async oauthSessionTokensFor(userId) {
     const res = await this.db.query(`select * from auth.users where id = $1`, [userId]);
-    const session = await this.sessionFor(res.rows[0]);
+    const session = await this.sessionForOAuth(res.rows[0]);
     return { access_token: session.access_token, refresh_token: session.refresh_token, expires_in: session.expires_in };
   }
   async sessionFor(user, parentToken, opts, query = (sql, params) => this.db.query(sql, params)) {

package/dist/runtime/auth/handler.d.ts

@@ -97,6 +97,7 @@ export declare class AuthHandler {
     private phoneDeliveriesSettledBeforeDeadline;
     /** Dispatch one `/auth/v1/*` request. Any thrown error becomes a 500 `unexpected_failure`. */
     handle(req: Request, ctx: RequestContext, url: URL): Promise<Response>;
+    private oauthCallbackUrl;
     private signup;
     private token;
     private getUser;
@@ -159,6 +160,8 @@ export declare class AuthHandler {
     private getUserFactors;
     /** GoTrue-shaped identities for a user (linked providers), from auth.identities. */
     private getUserIdentities;
+    private ensureEmailIdentity;
+    private userJsonWithRelations;
     private rotateRefreshToken;
     private claimRefreshToken;
     private refreshSessionStartedAt;
@@ -167,8 +170,8 @@ export declare class AuthHandler {
     private claimsFromBearer;
     /** Shape a user row into the GoTrue user object supabase-js expects. */
     userJson(u: UserRow, factors?: Record<string, unknown>[], identities?: Record<string, unknown>[]): Record<string, unknown>;
-    /** Session tokens for a bare user id (used by the OAuth implicit callback). */
-    private sessionTokensFor;
+    private sessionForOAuth;
+    private oauthSessionTokensFor;
     private sessionFor;
 }
 export {};

package/dist/runtime/auth/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,mBAAmB,CAAA;AAE1D,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAc,SAAS,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGnE,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAA;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAG7C,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAA;IACjB,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,yGAAyG;IACzG,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;IACd,+DAA+D;IAC/D,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IAC5B,oFAAoF;IACpF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IACpD,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,KAAK,CAAA;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;CACjC;AAED,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,eAAe,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACjD,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAClD,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAClC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CACjC;AAgID,wEAAwE;AACxE,qBAAa,WAAW;IAYpB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IAZhB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAM;IACrD,OAAO,CAAC,KAAK,CAAc;IAC3B,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,eAAe,CAA2B;IAClD,OAAO,CAAC,wBAAwB,CAA6B;IAC7D,OAAO,CAAC,QAAQ,CAAQ;IAExB,YACU,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU,EAa3B;IAED;;;OAGG;IACH,OAAO,CAAC,KAAK;IAKb,OAAO,CAAC,QAAQ;IAUhB,4EAA4E;IACtE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAM1B;YAEa,oCAAoC;IAgBlD,8FAA8F;IACxF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuD3E;YAIa,MAAM;YAiEN,KAAK;YAwCL,OAAO;YAMP,UAAU;YAgEV,MAAM;YAwBN,UAAU;YA4CV,OAAO;YAqBP,eAAe;YAqDf,eAAe;YAmCf,SAAS;YAwBT,kBAAkB;IAShC,OAAO,CAAC,mBAAmB;YASb,eAAe;YAgBf,YAAY;YAaZ,qBAAqB;YAgBrB,qBAAqB;IAUnC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,kBAAkB;YAQZ,YAAY;IAM1B,+EAA+E;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAI;YAE9B,MAAM;YASN,eAAe;YAWf,uBAAuB;YAkBvB,qBAAqB;YAUrB,uBAAuB;YAcvB,6BAA6B;YAa7B,WAAW;YAsCX,cAAc;YAyDd,UAAU;YAuBV,KAAK;YA6FL,sBAAsB;IAuEpC;;;OAGG;YACW,KAAK;IAqBnB;;;;;OAKG;YACW,UAAU;IA2CxB;;;;;;;;;OASG;YACW,SAAS;YAqBT,YAAY;YAyDZ,eAAe;YAqBf,YAAY;YAyCZ,cAAc;YAWd,cAAc;IAmB5B,oFAAoF;YACtE,iBAAiB;YAuBjB,kBAAkB;YAqBlB,iBAAiB;YAUjB,uBAAuB;IASrC,OAAO,CAAC,kBAAkB;YAoBZ,cAAc;YAOd,gBAAgB;IAM9B,wEAAwE;IACxE,QAAQ,CACN,CAAC,EAAE,OAAO,EACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,EACvC,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,GACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmBzB;IAED,+EAA+E;YACjE,gBAAgB;YAUhB,UAAU;CAqDzB"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,mBAAmB,CAAA;AAE1D,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAc,SAAS,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGnE,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAA;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAG7C,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAA;IACjB,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,yGAAyG;IACzG,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;IACd,+DAA+D;IAC/D,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IAC5B,oFAAoF;IACpF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IACpD,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,KAAK,CAAA;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;CACjC;AAED,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,eAAe,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACjD,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAClD,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAClC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CACjC;AAgID,wEAAwE;AACxE,qBAAa,WAAW;IAYpB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IAZhB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAM;IACrD,OAAO,CAAC,KAAK,CAAc;IAC3B,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,eAAe,CAA2B;IAClD,OAAO,CAAC,wBAAwB,CAA6B;IAC7D,OAAO,CAAC,QAAQ,CAAQ;IAExB,YACU,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU,EAa3B;IAED;;;OAGG;IACH,OAAO,CAAC,KAAK;IAKb,OAAO,CAAC,QAAQ;IAUhB,4EAA4E;IACtE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAM1B;YAEa,oCAAoC;IAgBlD,8FAA8F;IACxF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwD3E;YAEa,gBAAgB;YAYhB,MAAM;YAiEN,KAAK;YAwCL,OAAO;YAMP,UAAU;YA6DV,MAAM;YAwBN,UAAU;YA4CV,OAAO;YAqBP,eAAe;YAqDf,eAAe;YAmCf,SAAS;YAwBT,kBAAkB;IAShC,OAAO,CAAC,mBAAmB;YASb,eAAe;YAgBf,YAAY;YAaZ,qBAAqB;YAgBrB,qBAAqB;IAUnC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,kBAAkB;YAQZ,YAAY;IAM1B,+EAA+E;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAI;YAE9B,MAAM;YASN,eAAe;YAWf,uBAAuB;YAkBvB,qBAAqB;YAUrB,uBAAuB;YAcvB,6BAA6B;YAa7B,WAAW;YAsCX,cAAc;YAyDd,UAAU;YAuBV,KAAK;YAyHL,sBAAsB;IAuEpC;;;OAGG;YACW,KAAK;IAqBnB;;;;;OAKG;YACW,UAAU;IA2CxB;;;;;;;;;OASG;YACW,SAAS;YAqBT,YAAY;YAyDZ,eAAe;YAqBf,YAAY;YAmDZ,cAAc;YAWd,cAAc;IAmB5B,oFAAoF;YACtE,iBAAiB;YAqBjB,mBAAmB;YAcnB,qBAAqB;YAarB,kBAAkB;YAqBlB,iBAAiB;YAUjB,uBAAuB;IASrC,OAAO,CAAC,kBAAkB;YAoBZ,cAAc;YAOd,gBAAgB;IAM9B,wEAAwE;IACxE,QAAQ,CACN,CAAC,EAAE,OAAO,EACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,EACvC,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,GACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmBzB;IAED,OAAO,CAAC,eAAe;YAMT,qBAAqB;YAYrB,UAAU;CAqDzB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/lite",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   "type": "module",
   "license": "Apache-2.0",