better-supabase 0.13.0 → 0.14.0

package/dist/sso-B744gHeS.d.ts

@@ -0,0 +1,161 @@
+/// <reference lib="esnext.temporal" />
+import { T as ErrorMapper, t as AsyncResult } from "./result-C6jDfedy.js";
+import { n as Logger } from "./logger-DWVYUmwi.js";
+import { r as BlockTemporalOptions } from "./block-helpers-BaugZlJV.js";
+import { t as BlockTransport } from "./block-transport-d53POsem.js";
+import { n as BlockHooks } from "./block-hooks-CmjPKqQ_.js";
+//#region src/blocks/sso/sso.d.ts
+/** The DNS record that proves a domain belongs to the organization. */
+interface DomainRecord {
+  readonly type: "TXT";
+  readonly name: string;
+  readonly value: string;
+}
+interface OrganizationDomain {
+  readonly id: string;
+  readonly organizationId: string;
+  readonly domain: string;
+  readonly verifiedAt: Temporal.Instant | undefined;
+  /** New users with a confirmed email at the domain join with this role. */
+  readonly autoJoinRole: string | undefined;
+  /** Sessions of users at the domain need SAML (`sso_access_token_check`). */
+  readonly enforceSso: boolean;
+  readonly createdBy: string | undefined;
+  readonly createdAt: Temporal.Instant;
+  /** Publish this TXT record, then call `verifyDomain`. */
+  readonly record: DomainRecord;
+}
+interface SsoProvider {
+  /** The Supabase Auth SSO provider id, for `signInWithSSO({ providerId })`. */
+  readonly id: string;
+  readonly organizationId: string;
+  readonly type: "saml";
+  readonly metadataUrl: string | undefined;
+  readonly domains: readonly string[];
+  readonly createdAt: Temporal.Instant;
+}
+/** The provider an email address signs in with. */
+interface SsoDomain {
+  readonly domain: string;
+  readonly organizationId: string;
+  readonly providerId: string;
+  readonly enforceSso: boolean;
+}
+interface SsoOptions extends BlockTemporalOptions {
+  /** The caller's transport (`rpcTransport(supabase)`). */
+  readonly transport: BlockTransport;
+  /**
+   * The module schema, or its API schema: `defineBlocks` passes it from
+   * `blocks.generated.ts`. Default `better_supabase`.
+   */
+  readonly schema?: string;
+  readonly mappers?: readonly ErrorMapper[];
+  /**
+   * `withBlockHooks` hooks around the client's methods, such as a rule on which
+   * domains an organization may claim.
+   */
+  readonly hooks?: BlockHooks<Sso>;
+  /** Receives the errors `after` hooks throw. Default: `console`. */
+  readonly logger?: Logger;
+}
+interface Sso {
+  /** Claims a domain (needs `sso.manage`); publish its `record`, then verify it. */
+  addDomain(organizationId: string, domain: string): AsyncResult<OrganizationDomain>;
+  domains(organizationId: string): AsyncResult<readonly OrganizationDomain[]>;
+  /** Sets auto-join and SSO enforcement; both need a verified domain. */
+  updateDomain(domainId: string, settings: {
+    readonly autoJoinRole?: string | null;
+    readonly enforceSso?: boolean;
+  }): AsyncResult<OrganizationDomain>;
+  removeDomain(domainId: string): AsyncResult<boolean>;
+  providers(organizationId: string): AsyncResult<readonly SsoProvider[]>;
+  /**
+   * The SSO provider for an email address, for the sign-in page. Works signed
+   * out.
+   */
+  domainFor(email: string): AsyncResult<SsoDomain | undefined>;
+}
+/** Organization domains and SSO lookups as the caller. */
+declare function createSso(options: SsoOptions): Sso;
+/** Looks up the TXT strings at a name; an empty list when it has none. */
+type TxtResolver = (name: string, signal?: AbortSignal) => Promise<readonly string[]>;
+interface DohResolverOptions {
+  /**
+   * A DNS-over-HTTPS JSON endpoint. Default Cloudflare's
+   * `https://cloudflare-dns.com/dns-query`.
+   */
+  readonly endpoint?: string;
+  readonly fetch?: typeof fetch;
+}
+/** TXT lookups over DNS-over-HTTPS (the `application/dns-json` API). */
+declare function dohResolver(options?: DohResolverOptions): TxtResolver;
+interface SsoAuthAdmin {
+  /** The project URL (`SUPABASE_URL`). */
+  readonly url: string;
+  /** A secret or service-role key. Server-only. */
+  readonly secretKey: string;
+  readonly fetch?: typeof fetch;
+}
+interface SsoAdminOptions extends BlockTemporalOptions {
+  /**
+   * A service-role transport: these functions are granted to `service_role`
+   * only.
+   */
+  readonly transport: BlockTransport;
+  /** Supabase Auth's admin API, for SAML providers. */
+  readonly auth?: SsoAuthAdmin;
+  /** TXT lookups for `verifyDomain`. Default `dohResolver()`. */
+  readonly resolver?: TxtResolver;
+  readonly schema?: string;
+  readonly mappers?: readonly ErrorMapper[];
+}
+/** Who asked, so the database checks `sso.manage`; omit for app-owned calls. */
+interface SsoActor {
+  readonly actorId?: string;
+}
+type SamlMetadata = {
+  readonly metadataUrl: string;
+  readonly metadataXml?: never;
+} | {
+  readonly metadataXml: string;
+  readonly metadataUrl?: never;
+};
+type SamlProviderInput = SamlMetadata & {
+  /**
+   * Verified domains of the organization whose users sign in with this
+   * provider.
+   */
+  readonly domains: readonly string[];
+  /**
+   * Supabase Auth's `attribute_mapping`, such as `{ keys: { email: { name:
+   * "mail" } } }`.
+   */
+  readonly attributeMapping?: Readonly<Record<string, unknown>>;
+  readonly nameIdFormat?: string;
+};
+interface SsoAdmin {
+  /**
+   * Looks up the domain's TXT record and marks it verified when the token is
+   * there.
+   */
+  verifyDomain(domainId: string, options?: SsoActor & {
+    readonly signal?: AbortSignal;
+  }): AsyncResult<OrganizationDomain>;
+  /**
+   * Creates a SAML provider in Supabase Auth and records it for the
+   * organization.
+   */
+  addSamlProvider(organizationId: string, input: SamlProviderInput, options?: SsoActor): AsyncResult<SsoProvider>;
+  updateSamlProvider(providerId: string, input: Partial<SamlProviderInput> & {
+    readonly domains: readonly string[];
+  }, options?: SsoActor): AsyncResult<SsoProvider>;
+  /**
+   * Deletes the provider from Supabase Auth; `undefined` when the organization
+   * has no such provider.
+   */
+  removeSamlProvider(providerId: string, options?: SsoActor): AsyncResult<SsoProvider | undefined>;
+}
+/** Domain verification and SAML providers with a service-role client. */
+declare function createSsoAdmin(options: SsoAdminOptions): SsoAdmin;
+//#endregion
+export { dohResolver as _, SamlProviderInput as a, SsoAdmin as c, SsoDomain as d, SsoOptions as f, createSsoAdmin as g, createSso as h, SamlMetadata as i, SsoAdminOptions as l, TxtResolver as m, DomainRecord as n, Sso as o, SsoProvider as p, OrganizationDomain as r, SsoActor as s, DohResolverOptions as t, SsoAuthAdmin as u };

package/dist/sso-Bt9HocgW.js

@@ -0,0 +1,217 @@
+import { n as dbError } from "./errors-03ysrOt4.js";
+import { a as ok, r as err, t as AsyncResult } from "./result-B3m7xtRY.js";
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { C as optionalText, D as recordOf, F as stringsOf, I as textOf, R as toInstant, S as optionalInstant, f as errorText, k as recordsOf, n as applyTemporal, o as blockCall } from "./block-helpers-CiKtrb6g.js";
+import { r as withBlockHooks } from "./block-hooks-BymdcD0V.js";
+//#region src/blocks/sso/sso.ts
+function recordOfDomain(value) {
+	const row = recordOf(value, "organization_domains.record");
+	return {
+		type: "TXT",
+		name: textOf(row["name"]),
+		value: textOf(row["value"])
+	};
+}
+function domainOf(value) {
+	const row = recordOf(value, "organization_domains");
+	return {
+		id: textOf(row["id"]),
+		organizationId: textOf(row["organization_id"]),
+		domain: textOf(row["domain"]),
+		verifiedAt: optionalInstant(row["verified_at"]),
+		autoJoinRole: optionalText(row["auto_join_role"]),
+		enforceSso: row["enforce_sso"] === true,
+		createdBy: optionalText(row["created_by"]),
+		createdAt: toInstant(textOf(row["created_at"])),
+		record: recordOfDomain(row["record"])
+	};
+}
+function providerOf(value) {
+	const row = recordOf(value, "organization_sso_providers");
+	return {
+		id: textOf(row["id"]),
+		organizationId: textOf(row["organization_id"]),
+		type: "saml",
+		metadataUrl: optionalText(row["metadata_url"]),
+		domains: stringsOf(row["domains"]),
+		createdAt: toInstant(textOf(row["created_at"]))
+	};
+}
+function ssoDomainOf(value) {
+	if (!isRecord(value)) return;
+	return {
+		domain: textOf(value["domain"]),
+		organizationId: textOf(value["organizationId"]),
+		providerId: textOf(value["providerId"]),
+		enforceSso: value["enforceSso"] === true
+	};
+}
+/** Organization domains and SSO lookups as the caller. */
+function createSso(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	return withBlockHooks({
+		addDomain: (organizationId, domain) => call("add_organization_domain", {
+			tenant: organizationId,
+			domain
+		}, domainOf),
+		domains: (organizationId) => call("list_organization_domains", { tenant: organizationId }, (value) => recordsOf(value, "list_organization_domains").map(domainOf)),
+		updateDomain: (domainId, settings) => call("organization_domain", { id: domainId }, (value) => isRecord(value) ? domainOf(value) : void 0).andThen(async (current) => current === void 0 ? err(dbError("not_found", "No domain you manage has this id", { hint: "SSO_DOMAIN_NOT_FOUND" })) : call("update_organization_domain", {
+			id: domainId,
+			auto_join_role: settings.autoJoinRole === void 0 ? current.autoJoinRole ?? null : settings.autoJoinRole,
+			enforce_sso: settings.enforceSso ?? current.enforceSso
+		}, domainOf)),
+		removeDomain: (domainId) => call("remove_organization_domain", { id: domainId }, (value) => value === true),
+		providers: (organizationId) => call("list_sso_providers", { tenant: organizationId }, (value) => recordsOf(value, "list_sso_providers").map(providerOf)),
+		domainFor: (email) => call("sso_domain_for", { email }, ssoDomainOf)
+	}, options.hooks, {
+		block: "sso",
+		...options.logger ? { logger: options.logger } : {}
+	});
+}
+const NXDOMAIN = 3;
+const TXT = 16;
+/** TXT lookups over DNS-over-HTTPS (the `application/dns-json` API). */
+function dohResolver(options = {}) {
+	const endpoint = options.endpoint ?? "https://cloudflare-dns.com/dns-query";
+	const fetcher = options.fetch ?? fetch;
+	return async (name, signal) => {
+		const url = new URL(endpoint);
+		url.searchParams.set("name", name);
+		url.searchParams.set("type", "TXT");
+		const response = await fetcher(url, {
+			headers: { accept: "application/dns-json" },
+			...signal ? { signal } : {}
+		});
+		if (!response.ok) throw new Error(`DNS lookup of ${name} failed with ${response.status}`);
+		const body = await response.json();
+		if (!isRecord(body)) throw new Error(`DNS lookup of ${name} returned no JSON`);
+		if (body["Status"] === NXDOMAIN) return [];
+		if (body["Status"] !== 0) throw new Error(`DNS lookup of ${name} failed with status ${String(body["Status"])}`);
+		return (Array.isArray(body["Answer"]) ? body["Answer"] : []).filter((answer) => isRecord(answer) && answer["type"] === TXT).map((answer) => txtValue(textOf(isRecord(answer) ? answer["data"] : "")));
+	};
+}
+/** `"abc" "def"` (one record split into strings) gives `abcdef`. */
+function txtValue(data) {
+	const parts = [...data.matchAll(/"((?:[^"\\]|\\.)*)"/g)].map((match) => (match[1] ?? "").replaceAll(/\\(.)/g, "$1"));
+	return parts.length === 0 ? data : parts.join("");
+}
+function authStatusError(status, message) {
+	if (status === 400 || status === 422) return dbError("invalid_input", message);
+	if (status === 401) return dbError("unauthorized", message);
+	if (status === 403) return dbError("forbidden", message);
+	if (status === 404) return dbError("not_found", message);
+	if (status === 409) return dbError("conflict", message);
+	if (status === 429) return dbError("rate_limited", message);
+	return dbError("network", message);
+}
+/** Domain verification and SAML providers with a service-role client. */
+function createSsoAdmin(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	const resolver = options.resolver ?? dohResolver();
+	const auth = (method, path, body) => AsyncResult.from(async () => {
+		const admin = options.auth;
+		if (!admin) return err(dbError("invalid_request", "Pass auth to createSsoAdmin to manage SAML providers"));
+		const fetcher = admin.fetch ?? fetch;
+		let response;
+		try {
+			response = await fetcher(`${admin.url.replace(/\/+$/, "")}/auth/v1/admin/sso/providers${path}`, {
+				method,
+				headers: {
+					apikey: admin.secretKey,
+					authorization: `Bearer ${admin.secretKey}`,
+					"content-type": "application/json"
+				},
+				...body === void 0 ? {} : { body: JSON.stringify(body) }
+			});
+		} catch (cause) {
+			return err(dbError("network", errorText(cause)));
+		}
+		const text = await response.text();
+		let json;
+		try {
+			json = text.length > 0 ? JSON.parse(text) : {};
+		} catch {
+			json = {};
+		}
+		if (!response.ok) {
+			const message = isRecord(json) ? optionalText(json["msg"]) ?? optionalText(json["message"]) ?? optionalText(json["error_description"]) : void 0;
+			return err(authStatusError(response.status, message ?? `Supabase Auth answered ${response.status}`));
+		}
+		return ok(isRecord(json) ? json : {});
+	});
+	const providerBody = (input) => ({
+		type: "saml",
+		...input.metadataUrl === void 0 ? {} : { metadata_url: input.metadataUrl },
+		...input.metadataXml === void 0 ? {} : { metadata_xml: input.metadataXml },
+		...input.domains === void 0 ? {} : { domains: [...input.domains] },
+		...input.attributeMapping === void 0 ? {} : { attribute_mapping: input.attributeMapping },
+		...input.nameIdFormat === void 0 ? {} : { name_id_format: input.nameIdFormat }
+	});
+	const register = (organizationId, providerId, domains, metadataUrl, actor) => call("register_sso_provider", {
+		tenant: organizationId,
+		provider: providerId,
+		domains,
+		metadata_url: metadataUrl ?? null,
+		actor: actor.actorId ?? null
+	}, providerOf);
+	const providerFor = (providerId, actor) => call("sso_provider", {
+		provider: providerId,
+		actor: actor.actorId ?? null
+	}, (value) => isRecord(value) ? providerOf(value) : void 0);
+	const missing = () => err(dbError("not_found", "No SSO provider has this id", { hint: "SSO_PROVIDER_NOT_FOUND" }));
+	const path = (providerId) => `/${encodeURIComponent(providerId)}`;
+	return {
+		verifyDomain: (domainId, request = {}) => call("organization_domain", { id: domainId }, (value) => isRecord(value) ? domainOf(value) : void 0).andThen(async (found) => {
+			if (found === void 0) return err(dbError("not_found", "No domain has this id", { hint: "SSO_DOMAIN_NOT_FOUND" }));
+			if (found.verifiedAt === void 0) {
+				let values;
+				try {
+					values = await resolver(found.record.name, request.signal);
+				} catch (cause) {
+					return err(dbError("network", errorText(cause)));
+				}
+				if (!values.includes(found.record.value)) return err(dbError("invalid_request", `No TXT record ${found.record.name} with the verification value yet`, { hint: "SSO_DOMAIN_RECORD_MISSING" }));
+			}
+			return call("verify_organization_domain", {
+				id: domainId,
+				actor: request.actorId ?? null
+			}, domainOf);
+		}),
+		addSamlProvider: (organizationId, input, actor = {}) => call("check_sso_provider", {
+			tenant: organizationId,
+			domains: input.domains,
+			actor: actor.actorId ?? null
+		}, () => void 0).andThen(() => auth("POST", "", providerBody(input))).andThen(async (created) => {
+			const providerId = textOf(created["id"]);
+			const recorded = await register(organizationId, providerId, input.domains, input.metadataUrl, actor);
+			if (!recorded.ok) await auth("DELETE", path(providerId));
+			return recorded;
+		}),
+		updateSamlProvider: (providerId, input, actor = {}) => providerFor(providerId, actor).andThen(async (found) => {
+			if (found === void 0) return missing();
+			const checked = await call("check_sso_provider", {
+				tenant: found.organizationId,
+				domains: input.domains,
+				actor: actor.actorId ?? null
+			}, () => void 0);
+			if (!checked.ok) return checked;
+			const updated = await auth("PUT", path(providerId), providerBody(input));
+			if (!updated.ok) return updated;
+			const metadataUrl = input.metadataXml === void 0 ? input.metadataUrl ?? found.metadataUrl : void 0;
+			return register(found.organizationId, providerId, input.domains, metadataUrl, actor);
+		}),
+		removeSamlProvider: (providerId, actor = {}) => providerFor(providerId, actor).andThen(async (found) => {
+			if (found === void 0) return ok(void 0);
+			const deleted = await auth("DELETE", path(providerId));
+			if (!deleted.ok && deleted.error.kind !== "not_found") return deleted;
+			return call("unregister_sso_provider", {
+				provider: providerId,
+				actor: actor.actorId ?? null
+			}, () => found);
+		})
+	};
+}
+//#endregion
+export { createSsoAdmin as n, dohResolver as r, createSso as t };

package/dist/ssr/index.d.ts

@@ -1,5 +1,5 @@
-import { C as serializeCookie, E as writeSession, S as readSession, T as sessionEncoding, _ as WriteSessionOptions, a as ResolveAuthOptions, b as parseCookies, c as resolveAuth, d as CookieRecord, f as CookieScope, g as StoredSession, h as SessionEncoding, l as AUTH_CACHE_HEADERS, m as DEFAULT_SESSION_ENCODING, n as AuthResolver, p as CookieWrite, r as AuthState, t as AuthResolution, u as CookieOptions, v as applyCookieWrites, w as sessionCookieName, x as pruneSessionChunks, y as clearSessionAtScopes } from "../resolve-D57oDWNr.js";
-import { n as toSession, t as AuthSession } from "../view-CKzCp8FW.js";
-import { r as MembershipClaim } from "../entitlements-CMGsO4gL.js";
-import { a as sessionStatus, c as RefreshOutcome, i as clearSessionCookies, l as refreshSession, n as SessionStatus, o as authContext, r as SessionStatusOptions, s as RefreshOptions, t as ClearSessionCookiesOptions } from "../ended-D_Twxl8v.js";
+import { C as serializeCookie, E as writeSession, S as readSession, T as sessionEncoding, _ as WriteSessionOptions, a as ResolveAuthOptions, b as parseCookies, c as resolveAuth, d as CookieRecord, f as CookieScope, g as StoredSession, h as SessionEncoding, l as AUTH_CACHE_HEADERS, m as DEFAULT_SESSION_ENCODING, n as AuthResolver, p as CookieWrite, r as AuthState, t as AuthResolution, u as CookieOptions, v as applyCookieWrites, w as sessionCookieName, x as pruneSessionChunks, y as clearSessionAtScopes } from "../resolve-CzUKTIMq.js";
+import { n as toSession, t as AuthSession } from "../view-2_I-2ukO.js";
+import { r as MembershipClaim } from "../entitlements-DDevu4ZE.js";
+import { a as sessionStatus, c as RefreshOutcome, i as clearSessionCookies, l as refreshSession, n as SessionStatus, o as authContext, r as SessionStatusOptions, s as RefreshOptions, t as ClearSessionCookiesOptions } from "../ended--Bd_Q6uL.js";
 export { AUTH_CACHE_HEADERS, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type ClearSessionCookiesOptions, type CookieOptions, type CookieRecord, type CookieScope, type CookieWrite, DEFAULT_SESSION_ENCODING, type MembershipClaim, type RefreshOptions, type RefreshOutcome, type ResolveAuthOptions, type SessionEncoding, type SessionStatus, type SessionStatusOptions, type StoredSession, type WriteSessionOptions, applyCookieWrites, authContext, clearSessionAtScopes, clearSessionCookies, parseCookies, pruneSessionChunks, readSession, refreshSession, resolveAuth, serializeCookie, sessionCookieName, sessionEncoding, sessionStatus, toSession, writeSession };

package/dist/ssr/index.js

@@ -1,4 +1,4 @@
-import { t as authContext } from "../context-CrojkPNC.js";
-import { _ as writeSession, a as clearSessionCookies, c as DEFAULT_SESSION_ENCODING, d as parseCookies, f as pruneSessionChunks, g as sessionEncoding, h as sessionCookieName, i as refreshSession, l as applyCookieWrites, m as serializeCookie, o as sessionStatus, p as readSession, r as resolveAuth, s as AUTH_CACHE_HEADERS, u as clearSessionAtScopes } from "../resolve-sy3_Gz0i.js";
-import { n as toSession } from "../view-CfUd5vI9.js";
+import { t as authContext } from "../context-CYquqpA6.js";
+import { _ as writeSession, a as clearSessionCookies, c as DEFAULT_SESSION_ENCODING, d as parseCookies, f as pruneSessionChunks, g as sessionEncoding, h as sessionCookieName, i as refreshSession, l as applyCookieWrites, m as serializeCookie, o as sessionStatus, p as readSession, r as resolveAuth, s as AUTH_CACHE_HEADERS, u as clearSessionAtScopes } from "../resolve-DAYdcs22.js";
+import { n as toSession } from "../view-BtgqxQLM.js";
 export { AUTH_CACHE_HEADERS, DEFAULT_SESSION_ENCODING, applyCookieWrites, authContext, clearSessionAtScopes, clearSessionCookies, parseCookies, pruneSessionChunks, readSession, refreshSession, resolveAuth, serializeCookie, sessionCookieName, sessionEncoding, sessionStatus, toSession, writeSession };

package/dist/standard-DbQsD2xZ.d.ts

@@ -0,0 +1,7 @@
+import { f as Result } from "./result-C6jDfedy.js";
+import { StandardSchemaV1 as StandardSchemaV1$1 } from "@standard-schema/spec";
+//#region src/core/standard.d.ts
+/** Validates with any Standard Schema (zod, valibot, arktype, ...). */
+declare function validate<S extends StandardSchemaV1$1>(schema: S, value: unknown, label?: string): Promise<Result<StandardSchemaV1$1.InferOutput<S>>>;
+//#endregion
+export { validate as n, StandardSchemaV1$1 as t };

package/dist/standard-DtkpFGkS.js

@@ -0,0 +1,25 @@
+import { n as dbError } from "./errors-03ysrOt4.js";
+import { a as ok, r as err } from "./result-B3m7xtRY.js";
+//#region src/core/standard.ts
+/** Validates with any Standard Schema (zod, valibot, arktype, ...). */
+async function validate(schema, value, label = "value") {
+	let outcome = schema["~standard"].validate(value);
+	if (outcome instanceof Promise) outcome = await outcome;
+	if (outcome.issues) return err(dbError("validation", `Invalid ${label}`, { issues: toIssues(outcome.issues) }));
+	return ok(outcome.value);
+}
+/** Standard Schema issues as JSON-safe `ValidationIssue`s. */
+function toIssues(issues) {
+	return issues.map((issue) => {
+		const path = issue.path?.map((segment) => {
+			const key = typeof segment === "object" ? segment.key : segment;
+			return typeof key === "symbol" ? String(key) : key;
+		});
+		return path && path.length > 0 ? {
+			message: issue.message,
+			path
+		} : { message: issue.message };
+	});
+}
+//#endregion
+export { validate as n, toIssues as t };