better-supabase 0.12.0 → 0.13.0

package/dist/client-DyfWYU8S.js

@@ -1,84 +0,0 @@
-import { n as dbError } from "./errors-BV1SKTVs.js";
-import { r as err } from "./result-DIeYscA3.js";
-import { n as whileSignedIn, t as defineController } from "./controller-D6NyNrlZ.js";
-//#region src/blocks/comments/client.ts
-/**
-* One subject's comment thread for the signed-in user: loads it, keeps it
-* current after `add`, `edit` and `remove`, and loads it again for each
-* message on `topic`.
-*/
-function createCommentsController(options) {
-	const { client, organizationId, subjectType, subjectId } = options;
-	const topic = options.topic ?? null;
-	return defineController({
-		comments: void 0,
-		status: "closed",
-		error: void 0
-	}, (state) => {
-		let ticket = 0;
-		const refresh = async () => {
-			if (organizationId === null) return;
-			const request = ++ticket;
-			const result = await client.list(organizationId, subjectType, subjectId, options.limit === void 0 ? {} : { limit: options.limit });
-			if (request !== ticket) return;
-			state.set(result.ok ? {
-				comments: result.data,
-				error: void 0
-			} : { error: result.error });
-		};
-		const replace = (comment) => {
-			ticket += 1;
-			state.set((current) => {
-				const comments = current.comments ?? [];
-				return {
-					error: void 0,
-					comments: comments.some((each) => each.id === comment.id) ? comments.map((each) => each.id === comment.id ? comment : each) : [...comments, comment]
-				};
-			});
-		};
-		return {
-			actions: {
-				refresh,
-				add: async (body, draft = {}) => {
-					if (organizationId === null) return err(dbError("invalid_input", "No organization is active"));
-					const result = await client.create({
-						...draft,
-						organizationId,
-						subjectType,
-						subjectId,
-						body
-					});
-					if (result.ok) replace(result.data);
-					else state.set({ error: result.error });
-					return result;
-				},
-				edit: async (id, edit) => {
-					const result = await client.edit(id, edit);
-					if (result.ok) replace(result.data);
-					else state.set({ error: result.error });
-					return result;
-				},
-				remove: async (id) => {
-					const result = await client.remove(id);
-					if (result.ok) await refresh();
-					else state.set({ error: result.error });
-					return result;
-				}
-			},
-			start: () => organizationId === null ? void 0 : whileSignedIn(options.auth, () => {
-				refresh();
-				if (topic === null) return;
-				const { leave } = options.ports.topic(topic, {
-					onMessage: () => void refresh(),
-					onRejoin: () => void refresh(),
-					onStatus: (status) => {
-						state.set({ status });
-					}
-				});
-				return leave;
-			})
-		};
-	});
-}
-//#endregion
-export { createCommentsController as t };

package/dist/client-Dz1jWDA2.js

@@ -1,209 +0,0 @@
-import { n as dbError } from "./errors-BV1SKTVs.js";
-import { a as ok, r as err } from "./result-DIeYscA3.js";
-import { n as whileSignedIn, t as defineController } from "./controller-D6NyNrlZ.js";
-import { t as authResult } from "./auth-reply-Daq72lY4.js";
-//#region src/blocks/mfa/client.ts
-const toAal = (level) => level === "aal2" ? "aal2" : level === "aal1" ? "aal1" : void 0;
-const toFactor = (raw) => ({
-	id: raw.id,
-	name: raw.friendly_name === "" ? void 0 : raw.friendly_name,
-	type: raw.factor_type,
-	verified: raw.status === "verified"
-});
-async function readAssurance(mfa) {
-	const result = await authResult(() => mfa.getAuthenticatorAssuranceLevel());
-	return result.ok ? ok({
-		level: toAal(result.data.currentLevel),
-		nextLevel: toAal(result.data.nextLevel)
-	}) : result;
-}
-async function readFactors(mfa) {
-	const result = await authResult(() => mfa.listFactors());
-	return result.ok ? ok(result.data.all.map(toFactor)) : result;
-}
-/** Whether `error` is the `INSUFFICIENT_AAL` refusal that asks for a step-up. */
-function needsStepUp(error) {
-	return error?.kind === "forbidden" && error.code === "INSUFFICIENT_AAL";
-}
-/**
-* A user's MFA factors for a security settings page: `enroll` shows a QR
-* code, `verify` confirms it with the first code, and `unenroll` removes a
-* factor. The assurance level is read again after each change.
-*/
-function createMfaController(options) {
-	const { mfa } = options;
-	return defineController({
-		factors: void 0,
-		level: void 0,
-		nextLevel: void 0,
-		enrollment: void 0,
-		pending: false,
-		error: void 0
-	}, (state) => {
-		let ticket = 0;
-		const refresh = async () => {
-			const request = ++ticket;
-			const [factors, assurance] = await Promise.all([readFactors(mfa), readAssurance(mfa)]);
-			if (request !== ticket) return;
-			if (!factors.ok) {
-				state.set({ error: factors.error });
-				return;
-			}
-			if (!assurance.ok) {
-				state.set({ error: assurance.error });
-				return;
-			}
-			state.set({
-				factors: factors.data,
-				...assurance.data
-			});
-		};
-		const settle = async (result) => {
-			state.set(result.ok ? { pending: false } : {
-				pending: false,
-				error: result.error
-			});
-			if (result.ok) await refresh();
-			return result;
-		};
-		return {
-			actions: {
-				refresh,
-				dismiss: () => {
-					state.set({ error: void 0 });
-				},
-				enroll: async (input) => {
-					state.set({
-						pending: true,
-						error: void 0
-					});
-					const result = await authResult(() => mfa.enroll({
-						factorType: "totp",
-						...input?.name === void 0 ? {} : { friendlyName: input.name },
-						...options.issuer === void 0 ? {} : { issuer: options.issuer }
-					}));
-					const enrolled = result.ok ? ok({
-						factorId: result.data.id,
-						qrCode: result.data.totp.qr_code,
-						secret: result.data.totp.secret,
-						uri: result.data.totp.uri
-					}) : result;
-					if (enrolled.ok) state.set({ enrollment: enrolled.data });
-					return settle(enrolled);
-				},
-				verify: async (code) => {
-					const enrollment = state.get().enrollment;
-					if (enrollment === void 0) return err(dbError("invalid_input", "Enrol a factor before verifying it"));
-					state.set({
-						pending: true,
-						error: void 0
-					});
-					const verified = await authResult(() => mfa.challengeAndVerify({
-						factorId: enrollment.factorId,
-						code
-					}));
-					if (!verified.ok) return settle(err(verified.error));
-					state.set({ enrollment: void 0 });
-					return settle(await readAssurance(mfa));
-				},
-				cancel: async () => {
-					const enrollment = state.get().enrollment;
-					if (enrollment === void 0) return;
-					state.set({
-						enrollment: void 0,
-						pending: true
-					});
-					await settle(await authResult(() => mfa.unenroll({ factorId: enrollment.factorId })));
-				},
-				unenroll: async (factorId) => {
-					state.set({
-						pending: true,
-						error: void 0
-					});
-					const result = await authResult(() => mfa.unenroll({ factorId }));
-					return settle(result.ok ? ok(true) : result);
-				}
-			},
-			start: () => whileSignedIn(options.auth, () => {
-				refresh();
-			})
-		};
-	});
-}
-/**
-* Raises the session to `aal2` before a call that `checkAal` guards: show
-* it when an error passes `needsStepUp`, then retry the call once
-* `satisfied` is true.
-*/
-function createStepUpController(options) {
-	const { mfa } = options;
-	return defineController({
-		factors: void 0,
-		level: void 0,
-		nextLevel: void 0,
-		satisfied: false,
-		verifying: false,
-		error: void 0
-	}, (state) => {
-		let ticket = 0;
-		const assured = (assurance) => ({
-			...assurance,
-			satisfied: assurance.level === "aal2"
-		});
-		const refresh = async () => {
-			const request = ++ticket;
-			const [factors, assurance] = await Promise.all([readFactors(mfa), readAssurance(mfa)]);
-			if (request !== ticket) return;
-			if (!factors.ok) {
-				state.set({ error: factors.error });
-				return;
-			}
-			if (!assurance.ok) {
-				state.set({ error: assurance.error });
-				return;
-			}
-			state.set({
-				factors: factors.data.filter((factor) => factor.verified),
-				...assured(assurance.data)
-			});
-		};
-		return {
-			actions: {
-				refresh,
-				dismiss: () => {
-					state.set({ error: void 0 });
-				},
-				verify: async (code, factorId) => {
-					const id = factorId ?? state.get().factors?.[0]?.id;
-					if (id === void 0) {
-						const missing = dbError("invalid_input", "No verified factor to challenge");
-						state.set({ error: missing });
-						return err(missing);
-					}
-					state.set({
-						verifying: true,
-						error: void 0
-					});
-					const verified = await authResult(() => mfa.challengeAndVerify({
-						factorId: id,
-						code
-					}));
-					const result = verified.ok ? await readAssurance(mfa) : verified;
-					state.set(result.ok ? {
-						verifying: false,
-						...assured(result.data)
-					} : {
-						verifying: false,
-						error: result.error
-					});
-					return result;
-				}
-			},
-			start: () => whileSignedIn(options.auth, () => {
-				refresh();
-			})
-		};
-	});
-}
-//#endregion
-export { createStepUpController as n, needsStepUp as r, createMfaController as t };

package/dist/client-DzTtOVRR.js

@@ -1,137 +0,0 @@
-import { n as dbError } from "./errors-BV1SKTVs.js";
-import { r as err } from "./result-DIeYscA3.js";
-import { n as isRecord, t as isList } from "./guards-6F2bCtQR.js";
-import { n as whileSignedIn, t as defineController } from "./controller-D6NyNrlZ.js";
-//#region src/blocks/settings/client.ts
-const isConverter = (value) => isRecord(value) && typeof value["input"] === "function";
-const jsonSchemaOf = (entry) => {
-	const standard = entry.schema["~standard"];
-	const converter = isRecord(standard) ? standard["jsonSchema"] : void 0;
-	if (!isConverter(converter)) return;
-	try {
-		const converted = converter.input({ target: "draft-2020-12" });
-		return isRecord(converted) ? converted : void 0;
-	} catch {
-		return;
-	}
-};
-const kindOfValue = (value) => typeof value === "boolean" ? "boolean" : typeof value === "number" ? "number" : typeof value === "string" ? "text" : "json";
-const text = (value) => typeof value === "string" ? value : void 0;
-function fieldOf(key, entry) {
-	const schema = jsonSchemaOf(entry);
-	const values = schema?.["enum"];
-	const choices = isList(values) ? values.filter((value) => typeof value === "string" || typeof value === "number") : [];
-	const type = schema?.["type"];
-	return {
-		key,
-		kind: choices.length > 0 ? "choice" : type === "boolean" ? "boolean" : type === "number" || type === "integer" ? "number" : type === "string" ? "text" : type === void 0 ? kindOfValue(entry.default) : "json",
-		choices,
-		title: text(schema?.["title"]),
-		description: text(schema?.["description"]),
-		default: entry.default
-	};
-}
-/**
-* The form fields of one scope of a settings definition, in declaration
-* order: `settingFields(settings.schemas.organization)`.
-*/
-function settingFields(entries) {
-	const fields = [];
-	for (const key of Object.keys(entries)) {
-		const entry = entries[key];
-		if (!entry) continue;
-		fields.push(fieldOf(key, entry));
-	}
-	return fields;
-}
-function storeOf(options) {
-	const { user, organization } = options;
-	if (user) return {
-		get: () => user.getUser(),
-		set: (key, value) => user.setUser(key, value),
-		reset: (key) => user.resetUser(key)
-	};
-	if (!organization) throw new TypeError("better-supabase: createSettingsController needs `user` or `organization`");
-	const organizationId = options.organizationId ?? null;
-	if (organizationId === null) return;
-	return {
-		get: () => organization.getOrganization(organizationId),
-		set: (key, value) => organization.setOrganization(organizationId, key, value),
-		reset: (key) => organization.resetOrganization(organizationId, key)
-	};
-}
-/**
-* One scope of the app's settings for a settings page: the form fields
-* generated from the definition, the stored values over the defaults, and
-* `set` and `reset` per key.
-*/
-function createSettingsController(options) {
-	const store = storeOf(options);
-	return defineController({
-		fields: settingFields(options.entries),
-		values: void 0,
-		saving: void 0,
-		error: void 0
-	}, (state) => {
-		const refresh = async () => {
-			if (!store) return;
-			const run = state.run();
-			const result = await store.get();
-			if (run !== state.run()) return;
-			state.set(result.ok ? {
-				values: result.data,
-				error: void 0
-			} : { error: result.error });
-		};
-		const waiting = () => err(dbError("invalid_input", "No organization to save the setting for"));
-		const set = async (key, value) => {
-			if (!store) return waiting();
-			state.set({
-				saving: key,
-				error: void 0
-			});
-			const result = await store.set(key, value);
-			if (!result.ok) {
-				state.set({
-					saving: void 0,
-					error: result.error
-				});
-				return result;
-			}
-			state.set((current) => ({
-				saving: void 0,
-				...current.values === void 0 ? {} : { values: {
-					...current.values,
-					[key]: result.data
-				} }
-			}));
-			return result;
-		};
-		return {
-			actions: {
-				refresh,
-				set,
-				setField: (key, value) => set(key, value),
-				reset: async (key) => {
-					if (!store) return waiting();
-					state.set({
-						saving: key,
-						error: void 0
-					});
-					const result = await store.reset(key);
-					state.set(result.ok ? { saving: void 0 } : {
-						saving: void 0,
-						error: result.error
-					});
-					if (result.ok) await refresh();
-					return result;
-				}
-			},
-			start: () => store ? whileSignedIn(options.auth, () => {
-				refresh();
-			}) : void 0
-		};
-	});
-}
-//#endregion
-export { settingFields as n, createSettingsController as t };

package/dist/client-Ezlbskjq.js

@@ -1,60 +0,0 @@
-import { t as defineController } from "./controller-D6NyNrlZ.js";
-import { t as tenantOf } from "./tenant-B-fiItlJ.js";
-//#region src/auth/entitlements.ts
-/**
-* Whether the session's plan-features claim grants `key` in `tenantId`.
-* `claim` is `config.claims.features` (default `features`), the claim
-* `better_supabase.feature_claims()` fills, or `{ claim, keys }` when
-* `entitlements.claim.keys` writes short codes. The claim is as fresh as the
-* token: enforce it in RLS with `better_supabase.has_entitlement()`, and
-* refresh the session after checkout. A tenant left out by
-* `entitlements.claim.maxTenants` reads as not granted. Takes a server
-* session or the client's `useAuth()` snapshot.
-*/
-function hasEntitlement(session, tenantId, key, claim = "features") {
-	const options = typeof claim === "string" ? { claim } : claim;
-	const claims = "kind" in session ? session.kind === "user" ? session.claims : void 0 : session.claims;
-	if (!isRecord(claims)) return false;
-	const features = claims[options.claim ?? "features"];
-	if (!isRecord(features) || !Object.hasOwn(features, tenantId)) return false;
-	const keys = features[tenantId];
-	const code = options.keys?.[key] ?? key;
-	return Array.isArray(keys) && keys.includes(code);
-}
-const isRecord = (value) => typeof value === "object" && value !== null;
-//#endregion
-//#region src/blocks/entitlements/client.ts
-/**
-* Whether the active organization's plan includes `feature`, from the
-* session's plan-features claim. It updates when the session does, so a
-* session refresh after checkout opens the gate. UX only: enforce the
-* feature in RLS with `better_supabase.has_entitlement()`.
-*/
-function createFeatureGateController(options) {
-	const read = () => {
-		const session = options.auth.current();
-		if (session.status === "loading") return {
-			allowed: void 0,
-			organizationId: void 0
-		};
-		const organizationId = options.organizationId ?? tenantOf(session, options.tenantClaim);
-		return {
-			allowed: organizationId === void 0 ? false : hasEntitlement(session, organizationId, options.feature, options.claim),
-			organizationId
-		};
-	};
-	return defineController(read(), (state) => {
-		const recheck = () => {
-			state.set(read());
-		};
-		return {
-			actions: { recheck },
-			start: () => {
-				recheck();
-				return options.auth.subscribe(recheck);
-			}
-		};
-	});
-}
-//#endregion
-export { hasEntitlement as n, createFeatureGateController as t };

package/dist/client-GCCRI9ge.d.ts

@@ -1,135 +0,0 @@
-import { b as DbError, f as Result } from "./result-BREt7qOh.js";
-import { t as Aal } from "./mfa-YzkRjNad.js";
-import { n as Controller, t as AuthPort } from "./controller-BZhiIb-N.js";
-import { t as AuthReply } from "./auth-reply-Dj124sbX.js";
-//#region src/blocks/mfa/client.d.ts
-/** A factor as `auth.mfa.listFactors()` returns it. */
-interface RawMfaFactor {
-  readonly id: string;
-  readonly friendly_name?: string;
-  readonly factor_type: string;
-  readonly status: string;
-}
-/** The part of `supabase.auth.mfa` the MFA controllers call. */
-interface MfaApi {
-  listFactors(): PromiseLike<AuthReply<{
-    readonly all: readonly RawMfaFactor[];
-  }>>;
-  enroll(params: {
-    factorType: "totp";
-    friendlyName?: string;
-    issuer?: string;
-  }): PromiseLike<AuthReply<{
-    readonly id: string;
-    readonly totp: {
-      readonly qr_code: string;
-      readonly secret: string;
-      readonly uri: string;
-    };
-  }>>;
-  challengeAndVerify(params: {
-    factorId: string;
-    code: string;
-  }): PromiseLike<AuthReply<unknown>>;
-  unenroll(params: {
-    factorId: string;
-  }): PromiseLike<AuthReply<unknown>>;
-  getAuthenticatorAssuranceLevel(): PromiseLike<AuthReply<{
-    readonly currentLevel: string | null;
-    readonly nextLevel: string | null;
-  }>>;
-}
-interface MfaFactor {
-  readonly id: string;
-  readonly name: string | undefined;
-  /** `totp`, `phone` or `webauthn`. */
-  readonly type: string;
-  /** False for an enrolment the user hasn't confirmed with a code yet. */
-  readonly verified: boolean;
-}
-/** A TOTP factor waiting for its first code. */
-interface MfaEnrollment {
-  readonly factorId: string;
-  /** An SVG data URL of the QR code for authenticator apps. */
-  readonly qrCode: string;
-  /** The secret, for typing into an authenticator by hand. */
-  readonly secret: string;
-  readonly uri: string;
-}
-interface MfaAssurance {
-  /** The session's level; `undefined` until the first load. */
-  readonly level: Aal | undefined;
-  /** `aal2` when the user has a verified factor, so a challenge can raise the session. */
-  readonly nextLevel: Aal | undefined;
-}
-/** Whether `error` is the `INSUFFICIENT_AAL` refusal that asks for a step-up. */
-declare function needsStepUp(error: DbError | undefined): boolean;
-interface MfaControllerOptions {
-  /** `supabase.auth.mfa` of the browser client. */
-  readonly mfa: MfaApi;
-  readonly auth: AuthPort;
-  /** The issuer authenticator apps show; default: the Auth Site URL's host. */
-  readonly issuer?: string;
-}
-interface MfaSnapshot extends MfaAssurance {
-  /** Every factor, verified or not; `undefined` until the first load. */
-  readonly factors: readonly MfaFactor[] | undefined;
-  /** The TOTP factor `enroll` made, until `verify` or `cancel`. */
-  readonly enrollment: MfaEnrollment | undefined;
-  /** Whether an enrol, verify or unenrol call is in flight. */
-  readonly pending: boolean;
-  readonly error: DbError | undefined;
-}
-interface MfaActions {
-  /** Enrols a TOTP factor and keeps its QR code in `enrollment`. */
-  readonly enroll: (input?: {
-    readonly name?: string;
-  }) => Promise<Result<MfaEnrollment>>;
-  /** Confirms `enrollment` with a code from the app; the session is `aal2` after it. */
-  readonly verify: (code: string) => Promise<Result<MfaAssurance>>;
-  /** Removes the unconfirmed factor of `enrollment`. */
-  readonly cancel: () => Promise<void>;
-  /** Removes a factor; removing a verified one needs an `aal2` session. */
-  readonly unenroll: (factorId: string) => Promise<Result<boolean>>;
-  /** Forgets `error`. */
-  readonly dismiss: () => void;
-  readonly refresh: () => Promise<void>;
-}
-type MfaController = Controller<MfaSnapshot, MfaActions>;
-/**
- * A user's MFA factors for a security settings page: `enroll` shows a QR
- * code, `verify` confirms it with the first code, and `unenroll` removes a
- * factor. The assurance level is read again after each change.
- */
-declare function createMfaController(options: MfaControllerOptions): MfaController;
-interface StepUpControllerOptions {
-  /** `supabase.auth.mfa` of the browser client. */
-  readonly mfa: MfaApi;
-  readonly auth: AuthPort;
-}
-interface StepUpSnapshot extends MfaAssurance {
-  /** The verified factors a code can come from; `undefined` until the first load. */
-  readonly factors: readonly MfaFactor[] | undefined;
-  /** Whether the session is `aal2`. */
-  readonly satisfied: boolean;
-  readonly verifying: boolean;
-  readonly error: DbError | undefined;
-}
-interface StepUpActions {
-  /**
-   * Challenges a verified factor (the first one by default) with `code`,
-   * then reads the session's level again.
-   */
-  readonly verify: (code: string, factorId?: string) => Promise<Result<MfaAssurance>>;
-  readonly dismiss: () => void;
-  readonly refresh: () => Promise<void>;
-}
-type StepUpController = Controller<StepUpSnapshot, StepUpActions>;
-/**
- * Raises the session to `aal2` before a call that `checkAal` guards: show
- * it when an error passes `needsStepUp`, then retry the call once
- * `satisfied` is true.
- */
-declare function createStepUpController(options: StepUpControllerOptions): StepUpController;
-//#endregion
-export { MfaControllerOptions as a, MfaSnapshot as c, StepUpController as d, StepUpControllerOptions as f, needsStepUp as g, createStepUpController as h, MfaController as i, RawMfaFactor as l, createMfaController as m, MfaApi as n, MfaEnrollment as o, StepUpSnapshot as p, MfaAssurance as r, MfaFactor as s, MfaActions as t, StepUpActions as u };