better-supabase 0.13.0 → 0.15.0

package/dist/resolve-CXX6DHv3.d.ts

@@ -0,0 +1,288 @@
+/// <reference lib="esnext.temporal" />
+import { b as DbError } from "./result-DZeA5KS6.js";
+import { t as StandardSchemaV1 } from "./standard-DBV730sF.js";
+import { n as AuthOutageEvent, u as RefreshEvent } from "./events-vcqenSYU.js";
+import { n as Logger } from "./logger-DWVYUmwi.js";
+import { t as BetterSupabaseEnv } from "./index-NRMMhhEi.js";
+import { CookieOptions } from "@supabase/ssr";
+import { JWTClaims, SupabaseEnv, UserClaims } from "@supabase/server";
+//#region src/auth/session.d.ts
+/**
+ * The session object auth-js persists (`sb-<ref>-auth-token`). A `tokens-only`
+ * cookie has no `user`: auth-js keeps it in `auth.userStorage`.
+ */
+interface StoredSession {
+  readonly access_token: string;
+  readonly refresh_token: string;
+  readonly expires_at?: number;
+  readonly expires_in?: number;
+  readonly token_type?: string;
+  readonly user?: unknown;
+  readonly [key: string]: unknown;
+}
+/**
+ * `cookies.encode` in `@supabase/ssr`: `user-and-tokens` stores the user object
+ * in the cookie, `tokens-only` stores the access and refresh tokens alone. The
+ * server and the browser client must use the same value.
+ */
+type SessionEncoding = "user-and-tokens" | "tokens-only";
+declare const DEFAULT_SESSION_ENCODING: SessionEncoding;
+interface WriteSessionOptions {
+  /** Defaults to `user-and-tokens`, the `@supabase/ssr` default. */
+  readonly encode?: SessionEncoding;
+}
+/** A cookie scope an earlier deploy wrote the session at. */
+interface CookieScope {
+  readonly domain?: string;
+  readonly path?: string;
+}
+interface CookieRecord {
+  readonly name: string;
+  readonly value: string;
+}
+interface CookieWrite {
+  readonly name: string;
+  readonly value: string;
+  readonly options: CookieOptions;
+}
+/** Headers that keep responses carrying session cookies out of shared caches. */
+declare const AUTH_CACHE_HEADERS: Readonly<Record<string, string>>;
+/** `sb-<first label of the hostname>-auth-token`, the supabase-js default. */
+declare function sessionCookieName(url: string): string;
+declare function parseCookies(header: string | null | undefined): CookieRecord[];
+declare function serializeCookie(write: CookieWrite): string;
+/**
+ * Reads the session written by `@supabase/ssr` (plain or `base64-`, whole or
+ * chunked, `user-and-tokens` or `tokens-only`). Trailing chunks a shorter
+ * session no longer uses are ignored; chunks that never form a session read as
+ * no session.
+ */
+declare function readSession(cookies: readonly CookieRecord[], name: string): StoredSession | null;
+/**
+ * `Max-Age=0` writes for the session's chunk-like cookies that the readable
+ * session doesn't use: a leftover `.2` after a shorter rewrite, chunks next to
+ * a whole cookie, or chunks past a gap. Empty when no session reads.
+ */
+declare function pruneSessionChunks(cookies: readonly CookieRecord[], name: string, options?: CookieOptions): CookieWrite[];
+/**
+ * The encoding a stored session was written with: `tokens-only` without a
+ * `user`.
+ */
+declare function sessionEncoding(session: StoredSession): SessionEncoding;
+/**
+ * Cookie writes that store `session` (or clear it with `null`) exactly like
+ * `@supabase/ssr` with the same `encode`, and expire chunks the new value no
+ * longer uses.
+ */
+declare function writeSession(existing: readonly CookieRecord[], name: string, session: StoredSession | null, options?: CookieOptions, { encode }?: WriteSessionOptions): CookieWrite[];
+/**
+ * `Max-Age=0` writes for every chunk of the session cookie at each of `scopes`,
+ * like `clearAuthCookiesAtScopes` from `@supabase/ssr`. Use it once the cookie
+ * `domain` or `path` changed, for the scopes earlier deploys wrote: browsers
+ * ignore writes for scopes the host doesn't own, but a scope equal to the
+ * current one clears the live session.
+ */
+declare function clearSessionAtScopes(existing: readonly CookieRecord[], name: string, scopes: readonly CookieScope[]): CookieWrite[];
+/** Applies cookie writes to a cookie list, as the next request would see it. */
+declare function applyCookieWrites(cookies: readonly CookieRecord[], writes: readonly CookieWrite[]): CookieRecord[];
+//#endregion
+//#region src/auth/resolve.d.ts
+/**
+ * Who is calling. `C` is the claims type from `betterSupabase.claims(schema)`;
+ * the verified payload keeps every JWT claim and adds the schema's output. `P`
+ * is the `user_metadata` type from `betterSupabase.userMetadata(schema)`.
+ */
+type AuthState<C = unknown, P = unknown> = {
+  readonly kind: "user";
+  readonly token: string;
+  readonly claims: JWTClaims & C;
+  readonly user: UserClaims;
+  /**
+   * Where the token came from: `oauth` for an RFC 9068 access token from
+   * `accessTokenResolver`, which never has a cookie session.
+   */
+  readonly source: "bearer" | "cookie" | "oauth" | (string & {});
+  /** Seconds since epoch, from the token's `exp`. */
+  readonly expiresAt: number | null;
+  /**
+   * `user_metadata` parsed by `betterSupabase.userMetadata(schema)`;
+   * `undefined` without a schema or when the metadata fails it. Users can
+   * write this data themselves: use it for display, never for access.
+   */
+  readonly profile?: P;
+} | {
+  readonly kind: "service";
+  readonly keyName: string;
+} | {
+  readonly kind: "apiKey";
+  readonly keyId: string;
+  readonly name: string;
+  readonly organizationId?: string;
+  readonly userId?: string;
+  readonly scopes: readonly string[];
+  /** When the key was created. */
+  readonly createdAt?: Temporal.Instant;
+  /** The user who created the key, when the row records one. */
+  readonly createdBy?: string;
+  /**
+   * `sub` (the user, or the key for an organization key), `role:
+   * authenticated` and `api_key`.
+   */
+  readonly claims: JWTClaims;
+} | {
+  readonly kind: "anon";
+  /**
+   * `expired`: the cookie session needs a refresh that was not allowed here
+   * (run the proxy).
+   */
+  readonly reason: "none" | "expired" | "signed_out" | "refresh_failed";
+} | {
+  readonly kind: "invalid";
+  readonly reason: InvalidReason;
+  readonly error: DbError;
+};
+type InvalidReason = "token" | "claims" | "actor";
+/**
+ * What an `AuthResolver` returns. `reason` may be left out of an `invalid`
+ * state; it then counts as `token`.
+ */
+type ResolvedState = Exclude<AuthState, {
+  kind: "invalid";
+}> | {
+  readonly kind: "invalid";
+  readonly reason?: InvalidReason;
+  readonly error: DbError;
+};
+/**
+ * Extension point for other credentials (API keys, third-party auth, custom
+ * tokens). Return `undefined` when the request carries nothing this resolver
+ * understands; the built-in Bearer and cookie resolution runs next.
+ */
+interface AuthResolver {
+  readonly name: string;
+  resolve(request: Request): Promise<ResolvedState | undefined> | ResolvedState | undefined;
+}
+interface ResolveAuthOptions {
+  readonly env: BetterSupabaseEnv;
+  /**
+   * Allow refreshing an expiring cookie session. Only where cookies can be
+   * written (proxy).
+   */
+  readonly refresh?: boolean;
+  /**
+   * With `refresh`, refresh when the token expires within this many seconds.
+   * Defaults to 60. Without `refresh` a token stays valid until its `exp`.
+   */
+  readonly leeway?: number;
+  /** Milliseconds before a refresh counts as a network failure. Defaults to 5000. */
+  readonly refreshTimeoutMs?: number;
+  readonly checkSession?: boolean;
+  /**
+   * Accept `sb_secret_` keys (`apikey` header) as service callers: `true` for
+   * any configured key, or the key names allowed (`['cron']`). Defaults to
+   * false.
+   */
+  readonly secret?: boolean | readonly string[];
+  readonly audience?: string | string[];
+  readonly issuer?: string | string[];
+  readonly cookie?: {
+    readonly name?: string;
+    readonly options?: CookieOptions;
+    /**
+     * The shape refreshed sessions are written in, `cookies.encode` in
+     * `@supabase/ssr`. Use the browser client's value. Defaults to
+     * `user-and-tokens`.
+     */
+    readonly encode?: SessionEncoding;
+  };
+  /**
+   * Read the session cookie. Defaults to true. `false` suits endpoints only
+   * bearer clients call (MCP): a browser's cookie then can't authorize a
+   * request another site makes it send.
+   */
+  readonly cookies?: boolean;
+  /**
+   * Inline JWKS instead of fetching `env.jwksUrl` (tests, air-gapped). `false`
+   * or `null` verifies against no keys and never fetches, ignoring
+   * `SUPABASE_JWKS` and `SUPABASE_JWKS_URL`.
+   */
+  readonly jwks?: SupabaseEnv["jwks"] | false;
+  /**
+   * Verify HS256 tokens without a `kid` locally with this shared secret, the
+   * tokens Supabase Lite issues (`auth.jwt_secret`). Tokens with a `kid` still
+   * verify against the JWKS. `createServer` sets it from `SUPABASE_JWT_SECRET`
+   * with `backend: "lite"`.
+   */
+  readonly jwtSecret?: string;
+  /**
+   * Validates the verified claims (`betterSupabase.claims(schema)` sets it). A
+   * failure resolves to `{ kind: 'invalid', reason: 'claims' }`.
+   */
+  readonly claims?: StandardSchemaV1;
+  /**
+   * Parses `user_metadata` into `profile`
+   * (`betterSupabase.userMetadata(schema)` sets it). A failure leaves `profile`
+   * undefined and warns once; the session stays valid.
+   */
+  readonly userMetadata?: StandardSchemaV1;
+  /** Receives the `userMetadata` warning. Defaults to `console`. */
+  readonly logger?: Logger;
+  readonly resolvers?: readonly AuthResolver[];
+  /**
+   * The caller's IP, sent to Auth as `Sb-Forwarded-For` on refreshes so its
+   * per-IP rate limit counts users, not your server. Only with a secret key
+   * (`env.secretKey`), which Auth requires for the header. Defaults to
+   * `clientIp` (the last `x-forwarded-for` hop); `false` turns it off.
+   */
+  readonly clientIp?: ((request: Request) => string | undefined) | false;
+  /** Called after every refresh attempt (metrics, logging). */
+  readonly onRefresh?: (event: RefreshEvent) => void;
+  /**
+   * Called with the milliseconds each phase took: reading the session cookie
+   * (`parse`), verifying a token (`verify`), refreshing (`refresh`) and asking
+   * Auth whether the session ended (`ended`). For `Server-Timing`.
+   */
+  readonly onTiming?: (phase: ResolvePhase, ms: number) => void;
+  /**
+   * With `refresh`, expire session chunks the readable session doesn't use (a
+   * leftover `.2` after a shorter rewrite) on every request, not only when the
+   * session is rewritten. Defaults to true.
+   */
+  readonly pruneChunks?: boolean;
+  readonly fetch?: typeof fetch;
+  /** Epoch milliseconds, the unit JWT `exp` and `iat` math needs. */
+  readonly now?: () => number;
+}
+type ResolvePhase = "parse" | "verify" | "refresh" | "ended";
+interface AuthResolution<C = unknown, P = unknown> {
+  readonly auth: AuthState<C, P>;
+  /**
+   * Cookie writes for the response. Empty unless the session was refreshed or
+   * cleared.
+   */
+  readonly cookies: readonly CookieWrite[];
+  /** No-store headers, set whenever `cookies` is not empty. */
+  readonly headers: Readonly<Record<string, string>>;
+  /** Cookies the rest of this request should see, including a refreshed session. */
+  readonly requestCookies: readonly CookieRecord[];
+  /** Adds `cookies` and `headers` to a response. */
+  apply(response: Response): Response;
+  /**
+   * The session was ended server-side (revoked, deleted or banned); the cookies
+   * are cleared.
+   */
+  readonly sessionEnded?: boolean;
+  /** Why `sessionEnded` is set: `banned` when Auth rejected the user as banned. */
+  readonly sessionEndedReason?: "ended" | "banned";
+  /** Set when a refresh failed because the Auth server was unreachable. */
+  readonly outage?: AuthOutageEvent;
+}
+/**
+ * The last `x-forwarded-for` hop, the one your own edge appended. Hops to its
+ * left come from the client and can be forged. Behind more than one proxy, pass
+ * your own reader to `clientIp`.
+ */
+declare function clientIp(request: Request): string | undefined;
+declare function resolveAuth(request: Request, options: ResolveAuthOptions): Promise<AuthResolution>;
+//#endregion
+export { readSession as C, writeSession as D, sessionEncoding as E, pruneSessionChunks as S, sessionCookieName as T, StoredSession as _, ResolveAuthOptions as a, clearSessionAtScopes as b, clientIp as c, CookieOptions as d, CookieRecord as f, SessionEncoding as g, DEFAULT_SESSION_ENCODING as h, InvalidReason as i, resolveAuth as l, CookieWrite as m, AuthResolver as n, ResolvePhase as o, CookieScope as p, AuthState as r, ResolvedState as s, AuthResolution as t, AUTH_CACHE_HEADERS as u, WriteSessionOptions as v, serializeCookie as w, parseCookies as x, applyCookieWrites as y };

package/dist/resource-D8pzB5Qf.d.ts

@@ -0,0 +1,123 @@
+import { dt as TableMeta } from "./types-DFdg_4yN.js";
+import { D as ResourceOperation, O as SecurityRequirement, i as JsonObject, k as TableVerb } from "./model-hwpvole9.js";
+//#region src/spec/schemas.d.ts
+/** A Standard Schema, or anything else that might carry `~standard`. */
+interface StandardLike {
+  readonly "~standard": object;
+}
+//#endregion
+//#region src/spec/resource.d.ts
+type ResourcePagination = "offset" | "cursor";
+type ActionMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+/** A custom endpoint on a resource, documented next to its CRUD operations. */
+interface ResourceActionSpec<Ref = string> {
+  readonly method: ActionMethod;
+  /**
+   * Relative to the collection: `/{id}/send` acts on one row (the key parameter
+   * is the table's primary key), `/export` on the table.
+   */
+  readonly path: string;
+  /** The JSON body. */
+  readonly input?: StandardLike;
+  /** The query parameters, as an object schema. */
+  readonly query?: StandardLike;
+  /** The JSON response. Without it the action answers 204. */
+  readonly output?: StandardLike;
+  /** Success status. Defaults to 200 with an output, 204 without. */
+  readonly status?: number;
+  readonly summary?: string;
+  readonly description?: string;
+  readonly deprecated?: boolean;
+  readonly permission?: Ref;
+  /** Names of the events the action emits, for AsyncAPI. */
+  readonly emits?: readonly string[];
+}
+/** One shared error response: its component name, status and description. */
+interface ErrorResponse {
+  readonly name: string;
+  readonly status: number;
+  readonly description: string;
+}
+/**
+ * What a resource serves and documents. `defineResource` and `defineApi` read
+ * the same object, so the routes and the spec cannot drift.
+ */
+interface ResourceDescription<Ref = string> {
+  /** Defaults to every operation for tables, `list` and `get` for views. */
+  readonly operations?: readonly ResourceOperation[];
+  /**
+   * The contract verbs served as `POST /<table>/<verb>`. Defaults to `page`,
+   * `count` and `aggregate`, plus `upsert` for a table with a primary key that
+   * serves both `create` and `update`; `false` serves none.
+   */
+  readonly verbs?: false | readonly TableVerb[];
+  /** Filters, search and sorts for `list`, from `defineListQuery`. */
+  readonly list?: {
+    readonly openapi: readonly unknown[];
+    readonly pagination?: ResourcePagination;
+  };
+  /**
+   * Paging of the default list. Defaults to `cursor`, or `offset` for a table
+   * or view without a primary key; `offset` adds `page` and the total.
+   */
+  readonly pagination?: ResourcePagination;
+  /** Largest page of the default list. Defaults to 200. */
+  readonly maxPageSize?: number;
+  /** Path of the collection in the spec. Defaults to `/<table>`. */
+  readonly path?: string;
+  readonly tag?: string;
+  readonly description?: string;
+  /**
+   * Validates request bodies; their JSON Schema replaces the table's in the
+   * spec.
+   */
+  readonly input?: {
+    readonly create?: StandardLike;
+    readonly update?: StandardLike;
+  };
+  /** The response shape of an operation whose hooks change it. */
+  readonly output?: Partial<Readonly<Record<ResourceOperation, StandardLike>>>;
+  readonly actions?: Readonly<Record<string, ResourceActionSpec<Ref>>>;
+  /**
+   * The permission of each operation and verb. `true` asks the authorizer
+   * (`forOperation`) for every enabled operation and verb.
+   */
+  readonly permissions?: true | Partial<Readonly<Record<ResourceOperation | TableVerb, Ref>>>;
+  /** Overrides the model's security for this resource; `[]` makes it public. */
+  readonly security?: readonly SecurityRequirement[];
+  /** The shared error responses. Defaults to the API's `errors`. */
+  readonly errors?: readonly ErrorResponse[];
+  /**
+   * Deep-merged into the lowered operation, by operation or action name (`*`
+   * for all).
+   */
+  readonly extend?: Readonly<Record<string, JsonObject>>;
+}
+interface PlannedAction<Ref = string> extends ResourceActionSpec<Ref> {
+  readonly name: string;
+  /** The `{name}` segments of `path`. */
+  readonly params: readonly string[];
+  /** The path split into segments; `{name}` segments are params. */
+  readonly segments: readonly string[];
+}
+/** A resolved `ResourceDescription`. */
+interface ResourcePlan<Ref = string> {
+  readonly table: string;
+  readonly meta: TableMeta;
+  readonly operations: readonly ResourceOperation[];
+  /** The contract verbs served as `POST /<table>/<verb>`. */
+  readonly verbs: readonly TableVerb[];
+  /**
+   * Name of the key parameter, or `undefined` for tables without a
+   * single-column key.
+   */
+  readonly keyParam: string | undefined;
+  readonly pagination: ResourcePagination;
+  readonly maxPageSize: number;
+  readonly description: ResourceDescription<Ref>;
+  readonly actions: readonly PlannedAction<Ref>[];
+  /** The permission reference of each operation and action that has one. */
+  readonly permissions: Readonly<Record<string, Ref>>;
+}
+//#endregion
+export { ResourcePlan as a, ResourcePagination as i, ResourceActionSpec as n, StandardLike as o, ResourceDescription as r, ErrorResponse as t };