@svadmin/supabase 0.13.9 → 0.15.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/supabase",
-  "version": "0.13.9",
+  "version": "0.15.0",
   "description": "Supabase adapters — DataProvider, AuthProvider, LiveProvider, AuditHandler",
   "type": "module",
   "sideEffects": false,
@@ -24,7 +24,7 @@
     }
   },
   "peerDependencies": {
-    "@svadmin/core": "^0.50.0",
+    "@svadmin/core": "^0.52.0",
     "@supabase/supabase-js": "^2.112.4",
     "@refinedev/supabase": "^6.0.2",
     "@supacloud/js": "^0.23.1"
@@ -33,7 +33,7 @@
   "author": "zuohuadong",
   "repository": {
     "type": "git",
-    "url": "https://github.com/vibeunion/svadmin.git",
+    "url": "git+https://github.com/vibeunion/svadmin.git",
     "directory": "packages/supabase"
   },
   "homepage": "https://github.com/vibeunion/svadmin#readme",
@@ -55,11 +55,11 @@
     }
   },
   "dependencies": {
-    "@svadmin/refine-adapter": "^0.10.15"
+    "@sinclair/typebox": "^0.34.52",
+    "@svadmin/refine-adapter": "^0.11.6"
   },
   "devDependencies": {
-    "@refinedev/supabase": "^6.0.2",
-    "@supabase/supabase-js": "^2.112.4",
-    "@supacloud/js": "^0.23.1"
+    "@supacloud/js": "0.23.1",
+    "@supabase/supabase-js": "^2.112.4"
   }
 }

package/src/audit-handler.ts

@@ -1,16 +1,65 @@
-// Supabase AuditHandler — writes audit entries to a Supabase table
-import type { SupabaseClient } from '@supabase/supabase-js';
 import type { AuditHandler, AuditEntry } from '@svadmin/core';
+import { definedOptions } from '@svadmin/core/options';
+import { decodeAuditEntry, snapshotPlainData, checkExact, type JsonValue } from '@svadmin/core/schema';
+import { Type } from '@sinclair/typebox';
 
-export function createSupabaseAuditHandler(client: SupabaseClient): AuditHandler {
-  return async (entry: AuditEntry) => {
-    await client.from('audit_log').insert({
+export interface SupabaseAuditRow {
+  action: AuditEntry['action'];
+  resource?: string;
+  record_id: string | null;
+  user_id?: string;
+  details: JsonValue;
+  created_at: AuditEntry['timestamp'];
+}
+
+export interface SupabaseAuditClient {
+  from(table: 'audit_log'): {
+    insert(row: SupabaseAuditRow): PromiseLike<unknown>;
+  };
+}
+
+export class SupabaseAuditError extends Error {
+  constructor(readonly code: 'WRITE_REJECTED' | 'WRITE_OUTCOME_UNKNOWN') {
+    super(code === 'WRITE_REJECTED' ? 'Audit write was rejected.' : 'Audit write outcome could not be confirmed.');
+    this.name = 'SupabaseAuditError';
+  }
+}
+
+const receiptSchema = Type.Object({
+  data: Type.Null(), error: Type.Null(), count: Type.Null(),
+  status: Type.Union([Type.Literal(201), Type.Literal(204)]), statusText: Type.String(),
+});
+const rejectedSchema = Type.Object({
+  data: Type.Null(), count: Type.Null(),
+  error: Type.Object({
+    code: Type.String({ minLength: 1 }), message: Type.String(),
+    details: Type.Union([Type.String(), Type.Null()]),
+    hint: Type.Union([Type.String(), Type.Null()]),
+  }),
+  status: Type.Union([
+    Type.Literal(400), Type.Literal(401), Type.Literal(403),
+    Type.Literal(404), Type.Literal(405), Type.Literal(409),
+    Type.Literal(413), Type.Literal(415), Type.Literal(422), Type.Literal(429),
+  ]),
+  statusText: Type.String(),
+});
+
+/** Preserve the full validated event in JSON while retaining indexed query columns. */
+export function createSupabaseAuditHandler(client: SupabaseAuditClient): AuditHandler {
+  return async value => {
+    const entry = decodeAuditEntry(value);
+    const row = {
       action: entry.action,
-      resource: entry.resource,
-      record_id: entry.recordId ? String(entry.recordId) : null,
-      user_id: entry.userId,
-      details: entry.details,
+      ...definedOptions({ resource: entry.resource, user_id: entry.userId }),
+      record_id: entry.recordId === undefined ? null : String(entry.recordId),
+      details: snapshotPlainData(entry),
       created_at: entry.timestamp,
-    });
+    } satisfies SupabaseAuditRow;
+    let result: unknown;
+    try { result = snapshotPlainData(await client.from('audit_log').insert(row)); }
+    catch { throw new SupabaseAuditError('WRITE_OUTCOME_UNKNOWN'); }
+    if (checkExact(receiptSchema, result)) return;
+    if (checkExact(rejectedSchema, result)) throw new SupabaseAuditError('WRITE_REJECTED');
+    throw new SupabaseAuditError('WRITE_OUTCOME_UNKNOWN');
   };
 }

package/src/auth-contract.ts

@@ -0,0 +1,169 @@
+import { Type, type Static, type TSchema } from '@sinclair/typebox';
+import { checkExact, snapshotPlainData } from '@svadmin/core/schema';
+
+const nonempty = Type.String({ minLength: 1 });
+const record = Type.Record(Type.String(), Type.Unknown());
+const nullableText = Type.Union([Type.String(), Type.Null()]);
+const username = Type.Optional(nonempty);
+
+export const credentials = Type.Object({ email: nonempty, password: nonempty, username }, { additionalProperties: false });
+export const registration = Type.Object({
+  email: nonempty, password: nonempty, username, name: Type.Optional(Type.String()),
+}, { additionalProperties: false });
+export const resetRequest = Type.Object({ email: nonempty, username }, { additionalProperties: false });
+export const passwordUpdate = Type.Object({
+  password: nonempty, confirmPassword: Type.Optional(nonempty),
+}, { additionalProperties: false });
+
+export const identityMetadata = Type.Object({
+  name: Type.Optional(nullableText), avatar_url: Type.Optional(nullableText),
+});
+export const userSchema = Type.Object({
+  id: nonempty, aud: nonempty, created_at: nonempty,
+  app_metadata: record, user_metadata: Type.Intersect([identityMetadata, record]),
+  email: Type.Optional(Type.String()), phone: Type.Optional(Type.String()),
+  role: Type.Optional(Type.String()),
+  is_anonymous: Type.Optional(Type.Boolean()),
+});
+export type SupabaseAuthUser = Static<typeof userSchema>;
+
+export const sessionSchema = Type.Object({
+  access_token: nonempty, refresh_token: nonempty, token_type: Type.Literal('bearer'),
+  expires_in: Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),
+  expires_at: Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),
+  user: userSchema,
+});
+export type SupabaseAuthSession = Static<typeof sessionSchema>;
+
+export const loginResponse = Type.Object({
+  data: Type.Object({ user: userSchema, session: sessionSchema }), error: Type.Null(),
+});
+export const registrationResponse = Type.Object({
+  data: Type.Object({ user: userSchema, session: Type.Union([sessionSchema, Type.Null()]) }), error: Type.Null(),
+});
+export const sessionResponse = Type.Object({
+  data: Type.Object({ session: Type.Union([sessionSchema, Type.Null()]) }), error: Type.Null(),
+});
+export const userResponse = Type.Object({
+  data: Type.Object({ user: Type.Union([userSchema, Type.Null()]) }), error: Type.Null(),
+});
+export const updateResponse = Type.Object({
+  data: Type.Object({ user: userSchema }), error: Type.Null(),
+});
+export const resetResponse = Type.Object({
+  data: Type.Object({}, { additionalProperties: false }), error: Type.Null(),
+});
+export const signOutResponse = Type.Object({ error: Type.Null() });
+
+const errorMessages = {
+  INVALID_AUTH_INPUT: 'Invalid authentication input.',
+  INVALID_AUTH_RESPONSE: 'Invalid authentication response.',
+  INVALID_AUTH_SESSION: 'Invalid authentication session.',
+  AUTH_SESSION_EXPIRED: 'Session expired, please sign in again.',
+  AUTH_SESSION_CHANGED: 'Authentication session changed. Retry the operation.',
+  AUTH_REJECTED: 'Authentication request was rejected.',
+  AUTH_REQUEST_FAILED: 'Authentication request failed.',
+  AUTH_CLEANUP_FAILED: 'Session cleanup could not be confirmed.',
+  WRITE_OUTCOME_UNKNOWN: 'Authentication operation may have succeeded; its outcome could not be confirmed.',
+  PERMISSION_LOOKUP_FAILED: 'Permission lookup failed.',
+  INVALID_PERMISSIONS: 'Invalid permission response.',
+} as const;
+
+export class SupabaseAuthError extends Error {
+  constructor(readonly code: keyof typeof errorMessages) {
+    super(errorMessages[code]);
+    this.name = 'SupabaseAuthError';
+  }
+}
+
+type BoundaryPhase = 'input' | 'response' | 'session';
+
+export function decodeAuth<S extends TSchema>(
+  schema: S, value: unknown, phase: BoundaryPhase,
+): Static<S> {
+  try {
+    const candidate = snapshotPlainData(value);
+    if (checkExact(schema, candidate)) return candidate;
+  } catch {
+    // Credential payloads and reflection errors must not become error details.
+  }
+  throw new SupabaseAuthError(phase === 'input' ? 'INVALID_AUTH_INPUT'
+    : phase === 'session' ? 'INVALID_AUTH_SESSION' : 'INVALID_AUTH_RESPONSE');
+}
+
+/** Project only own data fields: SDK Error instances are not JSON records. */
+function errorField(error: object, key: string): unknown {
+  const property = Object.getOwnPropertyDescriptor(error, key);
+  if (!property) return undefined;
+  if (!('value' in property)) throw new TypeError('Invalid error descriptor');
+  return property.value;
+}
+
+export function inspectAuthError(error: unknown): 'expired' | 'unauthorized' | 'rejected' | 'other' {
+  try {
+    if (typeof error !== 'object' || error === null) return 'other';
+    const code = errorField(error, 'code');
+    const status = errorField(error, 'status');
+    const name = errorField(error, 'name');
+    if ((code !== undefined && typeof code !== 'string') ||
+        (name !== undefined && typeof name !== 'string') ||
+        (status !== undefined && (typeof status !== 'number' || !Number.isInteger(status)))) return 'other';
+    if (code === 'refresh_token_not_found' || code === 'refresh_token_already_used' ||
+        code === 'session_not_found' || code === 'user_not_found' || code === 'bad_jwt' ||
+        code === 'invalid_jwt' || name === 'AuthSessionMissingError') return 'expired';
+    if (status === 401) return 'unauthorized';
+    if (typeof status === 'number' && status >= 400 && status < 500) return 'rejected';
+  } catch {
+    // Ignore uninspectable errors, including throwing or revoked proxies.
+  }
+  return 'other';
+}
+
+function requestFailure(error: unknown, write: boolean, phase: 'response' | 'session'): SupabaseAuthError {
+  switch (inspectAuthError(error)) {
+    case 'expired': return new SupabaseAuthError('AUTH_SESSION_EXPIRED');
+    case 'unauthorized': return new SupabaseAuthError(phase === 'session' ? 'AUTH_SESSION_EXPIRED' : 'AUTH_REJECTED');
+    case 'rejected': return new SupabaseAuthError('AUTH_REJECTED');
+    case 'other': return new SupabaseAuthError(write ? 'WRITE_OUTCOME_UNKNOWN' : 'AUTH_REQUEST_FAILED');
+  }
+}
+
+/** Successful results must match a schema; failed results never expose SDK messages. */
+export async function authRequest<S extends TSchema>(
+  invoke: () => Promise<unknown>, schema: S, phase: 'response' | 'session', write = false,
+): Promise<Static<S>> {
+  let result: unknown;
+  try { result = await invoke(); }
+  catch (error) { throw requestFailure(error, write, phase); }
+
+  let error: unknown;
+  try {
+    if (typeof result !== 'object' || result === null || Array.isArray(result)) {
+      throw new TypeError('Invalid response');
+    }
+    const descriptor = Object.getOwnPropertyDescriptor(result, 'error');
+    if (!descriptor || !('value' in descriptor)) throw new TypeError('Invalid response');
+    error = descriptor.value;
+  } catch {
+    throw new SupabaseAuthError(write ? 'WRITE_OUTCOME_UNKNOWN'
+      : phase === 'session' ? 'INVALID_AUTH_SESSION' : 'INVALID_AUTH_RESPONSE');
+  }
+  if (error !== null) {
+    if (typeof error !== 'object' || error === null) {
+      throw new SupabaseAuthError(write ? 'WRITE_OUTCOME_UNKNOWN'
+        : phase === 'session' ? 'INVALID_AUTH_SESSION' : 'INVALID_AUTH_RESPONSE');
+    }
+    throw requestFailure(error, write, phase);
+  }
+  try { return decodeAuth(schema, result, phase); }
+  catch {
+    throw new SupabaseAuthError(write ? 'WRITE_OUTCOME_UNKNOWN'
+      : phase === 'session' ? 'INVALID_AUTH_SESSION' : 'INVALID_AUTH_RESPONSE');
+  }
+}
+
+export function validateIdentifier(input: { email: string; username?: string }): void {
+  if (input.username !== undefined && input.username !== input.email) {
+    throw new SupabaseAuthError('INVALID_AUTH_INPUT');
+  }
+}