@svadmin/supabase 0.11.0 → 0.11.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/supabase",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "Supabase adapters — DataProvider, AuthProvider, LiveProvider, AuditHandler",
   "type": "module",
   "sideEffects": false,
@@ -20,10 +20,10 @@
     }
   },
   "peerDependencies": {
-    "@svadmin/core": "^0.25.0",
+    "@svadmin/core": "^0.25.2",
     "@supabase/supabase-js": "^2.0.0",
     "@refinedev/supabase": "^5.0.0",
-    "@supacloud/js": "^0.10.0"
+    "@supacloud/js": "^0.12.0"
   },
   "license": "MIT",
   "author": "zuohuadong",

package/src/auth-provider.ts

@@ -3,6 +3,26 @@ import type { SupabaseClient } from '@supabase/supabase-js';
 import type { AuthProvider, Identity, AuthActionResult, CheckResult } from '@svadmin/core';
 import { audit } from '@svadmin/core';
 
+const INVALID_REFRESH_TOKEN_MESSAGES = [
+  'refresh token is not valid',
+  'invalid refresh token',
+  'refresh_token_not_found',
+  'jwt expired',
+];
+
+function isInvalidRefreshTokenError(error: unknown): error is Error {
+  if (!(error instanceof Error)) {
+    return false;
+  }
+
+  const message = error.message.toLowerCase();
+  return INVALID_REFRESH_TOKEN_MESSAGES.some((fragment) => message.includes(fragment));
+}
+
+async function clearInvalidSession(client: SupabaseClient): Promise<void> {
+  await client.auth.signOut({ scope: 'local' });
+}
+
 export function createSupabaseAuthProvider(client: SupabaseClient): AuthProvider {
   return {
     async login({ email, password }: Record<string, unknown>): Promise<AuthActionResult> {
@@ -23,16 +43,42 @@ export function createSupabaseAuthProvider(client: SupabaseClient): AuthProvider
     },
 
     async check(): Promise<CheckResult> {
-      const { data: { session } } = await client.auth.getSession();
+      const { data: { session }, error } = await client.auth.getSession();
+      if (error) {
+        if (isInvalidRefreshTokenError(error)) {
+          await clearInvalidSession(client);
+          return {
+            authenticated: false,
+            redirectTo: '/login',
+            logout: true,
+            error: { message: 'Session expired, please sign in again.' },
+          };
+        }
+
+        return {
+          authenticated: false,
+          redirectTo: '/login',
+          logout: true,
+          error: { message: 'Session validation failed.' },
+        };
+      }
       if (session) return { authenticated: true };
       return { authenticated: false, redirectTo: '/login', logout: true };
     },
 
     async getIdentity(): Promise<Identity | null> {
-      const { data: { user } } = await client.auth.getUser();
+      const { data: { user }, error } = await client.auth.getUser();
+      if (error && isInvalidRefreshTokenError(error)) {
+        await clearInvalidSession(client);
+        return null;
+      }
       if (!user) return null;
       
-      const { data: { session } } = await client.auth.getSession();
+      const { data: { session }, error: sessionError } = await client.auth.getSession();
+      if (sessionError && isInvalidRefreshTokenError(sessionError)) {
+        await clearInvalidSession(client);
+        return null;
+      }
       
       return {
         id: user.id,
@@ -44,7 +90,11 @@ export function createSupabaseAuthProvider(client: SupabaseClient): AuthProvider
     },
 
     async getPermissions(): Promise<unknown> {
-      const { data: { user } } = await client.auth.getUser();
+      const { data: { user }, error } = await client.auth.getUser();
+      if (error && isInvalidRefreshTokenError(error)) {
+        await clearInvalidSession(client);
+        return null;
+      }
       return user?.user_metadata?.role ?? 'user';
     },
 
@@ -71,6 +121,11 @@ export function createSupabaseAuthProvider(client: SupabaseClient): AuthProvider
     },
 
     async onError(error: unknown): Promise<{ redirectTo?: string; logout?: boolean }> {
+      if (isInvalidRefreshTokenError(error)) {
+        await clearInvalidSession(client);
+        return { redirectTo: '/login', logout: true };
+      }
+
       if (error instanceof Error && error.message.includes('401')) {
         // Pre-flight check: race-condition guard
         // Supabase might have just refreshed the token in the background right after our fetch failed

package/src/supabase.test.ts

@@ -135,6 +135,24 @@ describe('Supabase AuthProvider', () => {
     expect(result.logout).toBe(true);
   });
 
+  test('check clears invalid refresh token sessions', async () => {
+    const { createSupabaseAuthProvider } = await import('./auth-provider');
+    const client = createMockSupabaseClient({
+      auth: {
+        getSession: mock(async () => ({
+          data: { session: null },
+          error: new Error('Refresh token is not valid'),
+        })),
+      }
+    });
+    const auth = createSupabaseAuthProvider(client);
+    const result = await auth.check();
+    expect(result.authenticated).toBe(false);
+    expect(result.logout).toBe(true);
+    expect(result.redirectTo).toBe('/login');
+    expect(client.auth.signOut).toHaveBeenCalled();
+  });
+
   test('getIdentity surfaces user metadata', async () => {
     const { createSupabaseAuthProvider } = await import('./auth-provider');
     const auth = createSupabaseAuthProvider(createMockSupabaseClient());
@@ -152,6 +170,22 @@ describe('Supabase AuthProvider', () => {
     expect(role).toBe('admin');
   });
 
+  test('getIdentity clears invalid refresh token sessions', async () => {
+    const { createSupabaseAuthProvider } = await import('./auth-provider');
+    const client = createMockSupabaseClient({
+      auth: {
+        getUser: mock(async () => ({
+          data: { user: null },
+          error: new Error('Invalid refresh token'),
+        })),
+      }
+    });
+    const auth = createSupabaseAuthProvider(client);
+    const identity = await auth.getIdentity();
+    expect(identity).toBeNull();
+    expect(client.auth.signOut).toHaveBeenCalled();
+  });
+
   test('onError returns logout true on 401 with no session', async () => {
     const { createSupabaseAuthProvider } = await import('./auth-provider');
     const client = createMockSupabaseClient({
@@ -172,6 +206,16 @@ describe('Supabase AuthProvider', () => {
     expect(result.logout).toBeUndefined();
     expect(client.auth.signOut).not.toHaveBeenCalled();
   });
+
+  test('onError logs out on invalid refresh token', async () => {
+    const { createSupabaseAuthProvider } = await import('./auth-provider');
+    const client = createMockSupabaseClient();
+    const auth = createSupabaseAuthProvider(client);
+    const result = await auth.onError!(new Error('Refresh token is not valid'));
+    expect(result.logout).toBe(true);
+    expect(result.redirectTo).toBe('/login');
+    expect(client.auth.signOut).toHaveBeenCalled();
+  });
 });