better-supabase 0.13.0 → 0.15.0

package/dist/attachments-CPkGJVfk.js

@@ -1,270 +0,0 @@
-import { n as dbError } from "./errors-D7u24ZJH.js";
-import { a as ok, r as err, t as AsyncResult } from "./result-DIT_qp4G.js";
-import { n as isRecord } from "./guards-6F2bCtQR.js";
-import { t as fromStorageError } from "./errors-Cq72lONT.js";
-import { C as optionalText, D as recordOf, I as textOf, R as toInstant, S as optionalInstant, f as errorText, k as recordsOf, n as applyTemporal, o as blockCall } from "./block-helpers-DwE32_gT.js";
-import { r as withBlockHooks } from "./block-hooks-C1r-R2r0.js";
-import { c as withFields, i as extraOf, n as blockFields, r as extraFieldsArg, t as allWithFields } from "./block-fields-Cwd4c8m-.js";
-import { n as claimsUploads, t as claimUpload } from "./upload-claim-DCuklVyh.js";
-//#region src/blocks/attachments/attachments.ts
-const STATUSES = [
-	"pending",
-	"clean",
-	"infected",
-	"failed"
-];
-function statusOf(value) {
-	const status = STATUSES.find((candidate) => candidate === value);
-	if (status === void 0) throw new TypeError(`Unknown attachment status ${JSON.stringify(value)}`);
-	return status;
-}
-/** An attachments row, as `get_attachment` and `create_attachment` return it. */
-function attachmentOf(value) {
-	const row = recordOf(value, "attachments");
-	return {
-		id: textOf(row["id"]),
-		organizationId: optionalText(row["organization_id"]),
-		subjectType: optionalText(row["subject_type"]),
-		subjectId: optionalText(row["subject_id"]),
-		bucket: textOf(row["bucket"]),
-		path: textOf(row["object_path"]),
-		name: textOf(row["name"]),
-		mimeType: textOf(row["mime_type"]),
-		size: Number(row["size"]),
-		status: statusOf(row["status"]),
-		scanDetail: optionalText(row["scan_detail"]),
-		metadata: isRecord(row["metadata"]) ? row["metadata"] : {},
-		uploadedBy: optionalText(row["uploaded_by"]),
-		createdAt: toInstant(textOf(row["created_at"])),
-		uploadedAt: optionalInstant(row["uploaded_at"]),
-		scannedAt: optionalInstant(row["scanned_at"])
-	};
-}
-const CLAIM_HINTS = {
-	notUploaded: "ATTACHMENT_NOT_UPLOADED",
-	forbidden: "ATTACHMENT_FORBIDDEN"
-};
-const notFound = () => dbError("not_found", "No attachment you can see has this id", { hint: "ATTACHMENT_NOT_FOUND" });
-/** A Storage reply as a result, its error mapped to a `DbError`. */
-function stored(reply) {
-	return AsyncResult.from(async () => {
-		try {
-			const { data, error } = await reply;
-			if (error) return err(fromStorageError(error, "storage.objects"));
-			if (data === null || data === void 0) return err(dbError("network", "Storage returned no data"));
-			return ok(data);
-		} catch (cause) {
-			return err(fromStorageError(cause, "storage.objects"));
-		}
-	});
-}
-/**
-* Waits for a scan from a job or an event. A scan whose target is gone (the
-* attachment row, or for an object the stored object) is done, not a failure,
-* so the job or event is not retried; every other error throws.
-*/
-async function settle(scanned, gone) {
-	const result = await scanned;
-	if (result.ok || gone(result.error)) return;
-	await scanned.orThrow();
-}
-const attachmentGone = (error) => error.kind === "not_found" && error.hint === "ATTACHMENT_NOT_FOUND";
-const objectGone = (error) => error.kind === "not_found" && error.code === "NoSuchKey";
-function lookup(call, id) {
-	return call("get_attachment", { id }, (value) => value).andThen((value) => Promise.resolve(isRecord(value) ? ok(attachmentOf(value)) : err(notFound())));
-}
-/** Attachments as the caller: the table's and the bucket's policies apply. */
-const NEW_ATTACHMENT = /* @__PURE__ */ new Set([
-	"organizationId",
-	"name",
-	"mimeType",
-	"size",
-	"subjectType",
-	"subjectId",
-	"metadata"
-]);
-function createAttachments(options) {
-	applyTemporal(options);
-	const call = blockCall(options.transport, options.schema, options.mappers);
-	const fields = blockFields(options.fields, "attachment fields");
-	const typed = (value) => AsyncResult.from(() => withFields(fields, value, attachmentOf(value)));
-	const find = (id) => call("get_attachment", { id }, (value) => value).andThen((value) => isRecord(value) ? typed(value) : AsyncResult.err(notFound()));
-	const confirmed = (id) => call("confirm_attachment", { id }, (value) => value).andThen(typed);
-	const confirm = (id) => claimsUploads(options.storage) ? lookup(call, id).andThen((attachment) => attachment.uploadedAt === void 0 ? claimUpload(options.storage, attachment, CLAIM_HINTS).andThen(() => confirmed(id)) : confirmed(id)) : confirmed(id);
-	const requireScan = options.requireScan ?? true;
-	const ttl = options.downloadTtl ?? 300;
-	const bucket = (attachment) => options.storage.from(attachment.bucket);
-	/** Why a file can't be read yet, or `undefined` once it can. */
-	const gate = (attachment) => {
-		return attachment.status === "clean" || !requireScan && attachment.status !== "infected" && attachment.uploadedAt !== void 0 ? void 0 : dbError("invalid_request", attachment.status === "infected" ? "The file failed the malware scan" : "The file is not scanned yet", { hint: "ATTACHMENT_NOT_SCANNED" });
-	};
-	const discard = async (created, error) => {
-		await call("delete_attachment", { id: created.id }, (value) => value);
-		return err(error);
-	};
-	const create = (attachment) => AsyncResult.from(() => extraFieldsArg(fields, extraOf(attachment, NEW_ATTACHMENT))).andThen((more) => call("create_attachment", {
-		tenant: attachment.organizationId,
-		name: attachment.name,
-		mime_type: attachment.mimeType,
-		size: attachment.size,
-		subject_type: attachment.subjectType,
-		subject_id: attachment.subjectId,
-		metadata: attachment.metadata,
-		...more
-	}, (value) => value)).andThen(typed);
-	const upload = (attachment) => create(attachment).andThen(async (created) => {
-		const url = await stored(bucket(created).createSignedUploadUrl(created.path));
-		if (!url.ok) return discard(created, url.error);
-		return ok({
-			attachment: created,
-			signedUrl: url.data.signedUrl,
-			token: url.data.token
-		});
-	});
-	return withBlockHooks({
-		upload,
-		confirm,
-		get: find,
-		list: (organizationId, subject) => call("list_attachments", {
-			tenant: organizationId,
-			subject_type: subject?.type,
-			subject_id: subject?.id
-		}, (value) => recordsOf(value, "list_attachments").map((raw) => [raw, attachmentOf(raw)])).andThen((rows) => allWithFields(fields, rows)),
-		download: (id, download = {}) => find(id).andThen((attachment) => {
-			const blocked = gate(attachment);
-			if (blocked) return Promise.resolve(err(blocked));
-			return stored(bucket(attachment).createSignedUrl(attachment.path, ttl, download.as === void 0 ? void 0 : { download: download.as })).map((url) => ({
-				attachment,
-				signedUrl: url.signedUrl
-			}));
-		}),
-		put: (attachment, file) => create(attachment).andThen(async (created) => {
-			const target = bucket(created);
-			if (!target.upload) return discard(created, dbError("invalid_request", "The storage client has no upload", { hint: "ATTACHMENT_STORAGE_CLIENT" }));
-			const sent = await stored(target.upload(created.path, file, {
-				contentType: created.mimeType,
-				upsert: false
-			}));
-			if (!sent.ok) return discard(created, sent.error);
-			return confirmed(created.id);
-		}),
-		read: (id) => find(id).andThen((attachment) => {
-			const blocked = gate(attachment);
-			if (blocked) return Promise.resolve(err(blocked));
-			return stored(bucket(attachment).download(attachment.path)).map((file) => ({
-				attachment,
-				file
-			}));
-		}),
-		remove: (id) => find(id).andThen((attachment) => stored(bucket(attachment).remove([attachment.path]))).andThen(() => call("delete_attachment", { id }, (value) => value === true))
-	}, options.hooks, {
-		block: "attachments",
-		...options.logger ? { logger: options.logger } : {}
-	});
-}
-/**
-* Scans uploaded files with the app's `scan` function and records `clean`,
-* `infected` or `failed`. A file already clean or infected is not scanned
-* again, so replayed events and retried jobs are safe.
-*/
-function createAttachmentScanner(options) {
-	applyTemporal(options);
-	const call = blockCall(options.transport, options.schema);
-	const prefix = `${options.typePrefix ?? "dev.better-supabase"}.`;
-	const record = (id, status, detail) => call("set_attachment_status", {
-		id,
-		status,
-		detail
-	}, (value) => value).andThen((value) => Promise.resolve(isRecord(value) ? ok(attachmentOf(value)) : err(notFound())));
-	const scan = (id, signal) => lookup(call, id).andThen((attachment) => {
-		if (attachment.status === "clean" || attachment.status === "infected") return Promise.resolve(ok(attachment));
-		if (attachment.uploadedAt === void 0) return Promise.resolve(err(dbError("invalid_request", "The file was not uploaded yet", { hint: "ATTACHMENT_NOT_UPLOADED" })));
-		return stored(options.storage.from(attachment.bucket).download(attachment.path)).andThen(async (file) => {
-			let verdict;
-			try {
-				verdict = await options.scan(file, attachment, signal);
-			} catch (cause) {
-				const failed = await record(id, "failed", errorText(cause));
-				return failed.ok ? err(dbError("raised", `The scan failed: ${errorText(cause)}`, { hint: "ATTACHMENT_SCAN_FAILED" })) : failed;
-			}
-			return record(id, verdict.status, verdict.detail);
-		});
-	});
-	return {
-		scan,
-		job: async (payload, _job, signal) => {
-			await settle(scan(payload.attachmentId, signal), attachmentGone);
-		},
-		sink: () => ({ async send(events) {
-			for (const event of events) {
-				if ((event.type.startsWith(prefix) ? event.type.slice(prefix.length) : event.type) !== "attachment.uploaded" || !isRecord(event.data)) continue;
-				const id = optionalText(event.data["attachmentId"]);
-				if (id !== void 0) await settle(scan(id), attachmentGone);
-			}
-		} })
-	};
-}
-function scannedOf(value) {
-	const row = recordOf(value, "scanned_objects");
-	const status = textOf(row["status"]);
-	return {
-		bucket: textOf(row["bucket"]),
-		path: textOf(row["object_path"]),
-		status: status === "clean" || status === "infected" || status === "failed" ? status : "pending",
-		detail: optionalText(row["scan_detail"]),
-		scannedAt: optionalInstant(row["scanned_at"])
-	};
-}
-/**
-* The scan gate for objects outside the attachments table, such as a file drive
-* or avatars: scans an object with the app's `scan` function and records the
-* verdict in `scanned_objects`, which storage policies read with
-* `object_clean(bucket_id, name)`. With `options.scanBuckets`, new objects in
-* those buckets get a pending row and an `object.uploaded` event.
-*/
-function createObjectScanner(options) {
-	applyTemporal(options);
-	const call = blockCall(options.transport, options.schema);
-	const prefix = `${options.typePrefix ?? "dev.better-supabase"}.`;
-	const record = (bucket, path, status, detail) => call("set_object_scan", {
-		bucket,
-		path,
-		status,
-		detail
-	}, scannedOf);
-	const scan = (bucket, path, signal) => call("object_scan", {
-		bucket,
-		path
-	}, (value) => isRecord(value) ? scannedOf(value) : void 0).andThen((current) => {
-		if (current?.status === "clean" || current?.status === "infected") return Promise.resolve(ok(current));
-		return stored(options.storage.from(bucket).download(path)).andThen(async (file) => {
-			let verdict;
-			try {
-				verdict = await options.scan(file, {
-					bucket,
-					path
-				}, signal);
-			} catch (cause) {
-				const failed = await record(bucket, path, "failed", errorText(cause));
-				return failed.ok ? err(dbError("raised", `The scan failed: ${errorText(cause)}`, { hint: "ATTACHMENT_SCAN_FAILED" })) : failed;
-			}
-			return record(bucket, path, verdict.status, verdict.detail);
-		});
-	});
-	return {
-		scan,
-		job: async (payload, _job, signal) => {
-			await settle(scan(payload.bucket, payload.path, signal), objectGone);
-		},
-		sink: () => ({ async send(events) {
-			for (const event of events) {
-				if ((event.type.startsWith(prefix) ? event.type.slice(prefix.length) : event.type) !== "object.uploaded" || !isRecord(event.data)) continue;
-				const bucket = optionalText(event.data["bucket"]);
-				const path = optionalText(event.data["path"]);
-				if (bucket !== void 0 && path !== void 0) await settle(scan(bucket, path), objectGone);
-			}
-		} })
-	};
-}
-//#endregion
-export { stored as a, createObjectScanner as i, createAttachmentScanner as n, createAttachments as r, attachmentOf as t };

package/dist/attributes-BOFl922R.js

@@ -1,44 +0,0 @@
-//#region src/workflow-sdk/attributes.ts
-/**
-* The attributes the Supabase World's status trigger copies into
-* `workflow_runs`.
-*/
-const WORKFLOW_ATTRIBUTES = {
-	tenant: "bs.tenant",
-	actor: "bs.actor",
-	key: "bs.key",
-	/** The builder definition a run started from; its alerts match on it. */
-	definition: "bs.definition",
-	/** The builder version number a run started from. */
-	version: "bs.version",
-	/** The opaque ticket `bs.forContext` resolves into the context a step runs as. */
-	ticket: "bs.ticket",
-	/** The user an event or schedule start runs as (`runAs`). */
-	publisher: "bs.publisher",
-	/** The event actor or schedule creator behind a `runAs` start, for audit only. */
-	trigger: "bs.trigger",
-	/** The record a run belongs to, as `<type>/<id>`. */
-	subject: "bs.subject",
-	/**
-	* What a `runAs` run's steps run as: `user`, `service_principal`, `system` or
-	* `external`.
-	*/
-	principalKind: "bs.principal_kind",
-	/** The id of that principal, when it has one. */
-	principal: "bs.principal",
-	/** `test` for a builder test run; anything else records `live`. */
-	mode: "bs.mode",
-	/** The trigger node a builder run started at. */
-	triggerNode: "bs.trigger_node"
-};
-/**
-* The `bs.subject` value for a record: `<type>/<id>`. Throws a `TypeError` for
-* a type with a slash or an empty type or id, which the mirror can't split
-* back.
-*/
-function subjectAttribute(subject) {
-	if (subject.type === "" || subject.type.includes("/") || subject.type.length > 100 || subject.id === "" || subject.id.length > 200) throw new TypeError("better-supabase: a workflow subject has a type of 1 to 100 characters without a slash and an id of 1 to 200");
-	return `${subject.type}/${subject.id}`;
-}
-//#endregion
-export { subjectAttribute as n, WORKFLOW_ATTRIBUTES as t };