better-supabase 0.15.1 → 0.16.0

package/dist/server/index.js

@@ -1,10 +1,12 @@
 import { n as dbError } from "../errors-BVFgt8BZ.js";
 import { n as isRecord } from "../guards-6F2bCtQR.js";
 import { t as base64ToText } from "../base64-B9Wlsdj7.js";
+import { n as validate } from "../standard-BA3mLh6w.js";
 import { c as toProblem, i as isProblem, n as PROBLEM_TYPE_BASE, o as problemResponse, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-Bf0cJ7tk.js";
 import { i as delegationOf, n as actorOf, r as agentClaims, t as IDENTITY_SCOPES } from "../actor-go7p9-CJ.js";
 import { i as userContext, r as impersonatorOf } from "../impersonation-DM3oWNoD.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
+import { t as joinTopic } from "../channels-CfcFPuo_.js";
 import { r as toCsv, t as csvColumns } from "../csv-2rXGPNtP.js";
 import { A as suspendAccount, C as shouldRefresh, D as SERVER_EVENT_SOURCE, E as defineAuthorizationHooks, O as endSessions, S as shouldCheckSession, T as serverCore, a as unexpectedResponse, b as isPrefetch, c as extendServer, d as clearSupportCookie, f as supportCookie, h as TENANT_HEADER, i as resolveToken, j as deleteAccount, k as lastSignIns, l as supportStorage, m as supportCookieValue, n as flushEvents, o as withFlush, r as handle, s as createServer, u as SUPPORT_COOKIE, x as refreshFor, y as withSession } from "../adapter-Dyks1lX1.js";
 import { n as PRIMARY_COOKIE } from "../replicas-Dyoh3CEg.js";
@@ -57,6 +59,399 @@ const impersonationEvents = defineEvents({
 	"support.denied": event()
 });
 //#endregion
+//#region src/server/session-status.ts
+const VOLATILE_CLAIMS = [
+	"exp",
+	"iat",
+	"nbf",
+	"jti"
+];
+const HEADERS = {
+	"content-type": "application/json",
+	"cache-control": "no-store, private"
+};
+/** JSON with object keys sorted at every level, so equal claims hash alike. */
+function canonical(value) {
+	if (value === void 0) return "null";
+	if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+	if (value !== null && typeof value === "object") return `{${Object.entries(value).filter(([, each]) => each !== void 0).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, each]) => `${JSON.stringify(key)}:${canonical(each)}`).join(",")}}`;
+	return JSON.stringify(value);
+}
+async function sha256Hex(text) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+	return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/**
+* The fingerprint `sessionStatusRoute` reports for a user's claims and support
+* session: a SHA-256 hex digest that changes when a claim that decides access
+* changes (role, tenant, memberships, `aal`) or the support target does.
+*/
+async function claimsFingerprint(claims, support, ignore = []) {
+	const skip = /* @__PURE__ */ new Set([...VOLATILE_CLAIMS, ...ignore]);
+	return sha256Hex(canonical({
+		claims: Object.fromEntries(Object.entries(claims).filter(([key]) => !skip.has(key))),
+		support: support ? {
+			session: support.session.id,
+			target: support.session.targetUserId,
+			readOnly: support.session.readOnly
+		} : null
+	}));
+}
+const statusOf = (resolution) => {
+	if (resolution.sessionEnded) return resolution.sessionEndedReason ?? "ended";
+	const { auth } = resolution;
+	if (auth.kind === "user") return "active";
+	return auth.kind === "anon" && auth.reason === "expired" ? "expired" : "signed_out";
+};
+/**
+* A `GET` handler that tells a browser whether its session still holds, for
+* apps that keep the session in httpOnly cookies and have no browser Supabase
+* client: `useSessionWatch()` from `better-supabase/next/client` polls it. It
+* answers `{ status, userId, fingerprint, expiresAt, support }` with
+* `Cache-Control: no-store`.
+*
+* ```ts
+* // app/api/session-status/route.ts
+* export const GET = sessionStatusRoute(bsb);
+* ```
+*/
+function sessionStatusRoute(server, options = {}) {
+	const checkSession = options.checkSession ?? true;
+	const refresh = options.refresh ?? false;
+	return async (request) => {
+		if (request.method !== "GET" && request.method !== "HEAD") return new Response(null, {
+			status: 405,
+			headers: { allow: "GET, HEAD" }
+		});
+		const resolution = await server.resolve(request, {
+			checkSession,
+			refresh
+		});
+		const status = statusOf(resolution);
+		const { auth } = resolution;
+		const user = auth.kind === "user" ? auth : void 0;
+		const support = user && status === "active" ? await server.support.current(request, user) : void 0;
+		const body = {
+			status,
+			userId: user?.user.id ?? null,
+			fingerprint: user && status === "active" ? await claimsFingerprint(user.claims, support, options.ignoreClaims) : null,
+			expiresAt: user?.expiresAt ?? null,
+			support: support ? {
+				sessionId: support.session.id,
+				targetUserId: support.session.targetUserId,
+				readOnly: support.session.readOnly
+			} : null
+		};
+		return resolution.apply(new Response(request.method === "HEAD" ? null : JSON.stringify(body), {
+			status: 200,
+			headers: HEADERS
+		}));
+	};
+}
+//#endregion
+//#region src/server/realtime-relay.ts
+/** The channels `liveQuery` joins: `bsb:t:<schema>.<table>[:...]`, private. */
+const liveRelayTopic = {
+	private: true,
+	match: (topic) => /^bsb:t:[^:]+\.[^:]+(?::.+)?$/.test(topic) ? {} : null
+};
+var Verdict = class extends Error {
+	allowed;
+	constructor(allowed) {
+		super(allowed ? "allowed" : "denied");
+		this.allowed = allowed;
+	}
+};
+const RLS_DENIED = "42501";
+function codeOf(cause) {
+	return typeof cause === "object" && cause !== null && "code" in cause ? cause.code : void 0;
+}
+/**
+* Whether `claims` may receive or send on `topic`, by the `realtime.messages`
+* policies, checked the way Realtime checks a join: a probe message is
+* inserted, then read (receive) or written (send) as the caller, and the
+* transaction rolls back.
+*/
+async function realtimeTopicAccess(postgres, input) {
+	const role = input.claims["role"] === "anon" ? "anon" : "authenticated";
+	const sub = input.claims["sub"];
+	const extension = input.extension ?? "broadcast";
+	const insert = "insert into realtime.messages (topic, extension, event, payload, private) values ($1, $2, 'bsb_relay_probe', '{}'::jsonb, true)";
+	const assume = async (sql) => {
+		await sql.queryRaw("select set_config('request.jwt.claims', $1, true), set_config('request.jwt.claim.sub', $2, true), set_config('request.jwt.claim.role', $3, true), set_config('realtime.topic', $4, true), set_config('role', $3, true)", [
+			JSON.stringify({
+				...input.claims,
+				role
+			}),
+			typeof sub === "string" ? sub : "",
+			role,
+			input.topic
+		]);
+	};
+	try {
+		await postgres.transaction(async (sql) => {
+			if (input.action === "receive") {
+				const [probe] = await sql.queryRaw(`${insert} returning id::text as id`, [input.topic, extension]);
+				await assume(sql);
+				const [row] = await sql.queryRaw("select exists (select 1 from realtime.messages m where m.id::text = $1) as allowed", [probe?.id ?? ""]);
+				throw new Verdict(row?.allowed === true);
+			}
+			await assume(sql);
+			try {
+				await sql.queryRaw(insert, [input.topic, extension]);
+			} catch (cause) {
+				if (codeOf(cause) === RLS_DENIED) throw new Verdict(false);
+				throw cause;
+			}
+			throw new Verdict(true);
+		});
+	} catch (cause) {
+		if (cause instanceof Verdict) return cause.allowed;
+		throw cause;
+	}
+	return false;
+}
+const encoder = new TextEncoder();
+const frame = (event, data) => encoder.encode(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+const PING = encoder.encode(": ping\n\n");
+const STREAM_HEADERS = {
+	"content-type": "text/event-stream; charset=utf-8",
+	"cache-control": "no-store, no-transform",
+	"x-accel-buffering": "no"
+};
+function readOnlyError() {
+	return {
+		...dbError("forbidden", "The support session is read-only"),
+		code: "SUPPORT_READ_ONLY"
+	};
+}
+function isSendBody(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const body = value;
+	return typeof body.topic === "string" && typeof body.event === "string" && body.event !== "";
+}
+/**
+* Realtime for callers without a browser token of their own: a support session
+* ("view as user"), or an app that keeps sessions in httpOnly cookies. `GET
+* ?topic=<name>` resolves the caller, checks the topic's access as that caller
+* (the viewed user in a support session), joins upstream with the secret key
+* and streams the topic's broadcasts and presence as server-sent events. `POST
+* { topic, event, payload }` broadcasts for the caller after the same check on
+* the send policy; read-only support sessions can't send.
+* `relayRealtimeClient(url)` from `better-supabase/realtime` is the client.
+*
+* ```ts
+* // app/api/realtime/route.ts
+* export const { GET, POST } = realtimeRelay(bsb, {
+*   topics: [notifications, liveRelayTopic],
+*   postgres,
+* });
+* ```
+*/
+function realtimeRelay(server, options) {
+	const { postgres, authorize } = options;
+	if (!postgres && !authorize) throw new TypeError("realtimeRelay needs `postgres` to check the realtime.messages policies, or `authorize`");
+	const heartbeatMs = options.heartbeatMs ?? 25e3;
+	const maxDurationMs = options.maxDurationMs ?? 24e4;
+	const maxQueued = Math.max(1, options.maxQueued ?? 256);
+	const retryMs = options.retryMs ?? 1e3;
+	const refresh = options.refresh ?? false;
+	let upstream = options.upstream;
+	const upstreamClient = () => {
+		upstream ??= server.admin().$client;
+		return upstream;
+	};
+	const problem = (error) => problemResponse(error, { format: options.problem });
+	const topicOf = (name) => options.topics.find((each) => each.match(name) !== null);
+	const allowed = async (input) => {
+		try {
+			if (authorize) return await authorize(input);
+			if (input.auth.kind === "service") return true;
+			return postgres ? await realtimeTopicAccess(postgres, {
+				claims: input.claims,
+				topic: input.topic,
+				action: input.action
+			}) : false;
+		} catch {
+			return false;
+		}
+	};
+	const claimsOf = (auth, support) => {
+		if (support) return support.claims;
+		switch (auth.kind) {
+			case "user": return auth.claims;
+			case "apiKey": return auth.claims;
+			case "anon": return { role: "anon" };
+			case "service": return { role: "service_role" };
+			case "invalid": return { role: "anon" };
+			default: return auth;
+		}
+	};
+	/** Resolves the caller and checks `action` on `name`; a Response refuses. */
+	const admit = async (request, name, action) => {
+		const topic = topicOf(name);
+		if (!topic) return { refusal: problem(dbError("not_found", `No relayed topic "${name}"`)) };
+		const ctx = await server.context(request, { refresh });
+		const { auth, support } = ctx;
+		if (auth.kind === "invalid") return { refusal: ctx.apply(problem(auth.error)) };
+		if (!(auth.kind !== "anon") && (topic.private || action === "send")) return { refusal: ctx.apply(problem(dbError("unauthorized", "Sign in to join this topic"))) };
+		if (action === "send" && support?.session.readOnly === true) return { refusal: ctx.apply(problem(readOnlyError())) };
+		if (!(!topic.private && action === "receive" ? true : await allowed({
+			topic: name,
+			action,
+			auth,
+			support,
+			claims: claimsOf(auth, support)
+		}))) return { refusal: ctx.apply(problem(dbError("forbidden", `Not allowed to ${action} on "${name}"`))) };
+		return {
+			topic,
+			ctx
+		};
+	};
+	const expiryOf = (auth, support) => {
+		const times = [];
+		if (auth.kind === "user" && auth.expiresAt !== null) times.push(auth.expiresAt * 1e3);
+		if (support) times.push(support.session.expiresAt.epochMilliseconds);
+		return times.length === 0 ? void 0 : Math.min(...times);
+	};
+	const GET = async (request) => {
+		const name = new URL(request.url).searchParams.get("topic");
+		if (!name) return problem(dbError("invalid_request", "Pass ?topic=<name>"));
+		const admitted = await admit(request, name, "receive");
+		if ("refusal" in admitted) return admitted.refusal;
+		const { topic, ctx } = admitted;
+		const expiresAt = expiryOf(ctx.resolution.auth, ctx.support);
+		const client = upstreamClient();
+		let finish = () => void 0;
+		const stream = new ReadableStream({
+			start(controller) {
+				let closed = false;
+				let subscribed = false;
+				let leave;
+				const timers = [];
+				const enqueue = (chunk) => {
+					try {
+						controller.enqueue(chunk);
+					} catch {
+						finish(null);
+					}
+				};
+				const push = (chunk) => {
+					if (closed) return;
+					if ((controller.desiredSize ?? 1) <= 0) {
+						finish("overflow");
+						return;
+					}
+					enqueue(chunk);
+				};
+				finish = (reason) => {
+					if (closed) return;
+					closed = true;
+					for (const timer of timers) {
+						clearTimeout(timer);
+						clearInterval(timer);
+					}
+					request.signal.removeEventListener("abort", aborted);
+					leave?.();
+					if (reason !== null) enqueue(frame("end", { reason }));
+					try {
+						controller.close();
+					} catch {}
+				};
+				const aborted = () => {
+					finish(null);
+				};
+				const onStatus = (status) => {
+					switch (status) {
+						case "joining": return;
+						case "subscribed":
+							push(frame("status", {
+								status,
+								rejoin: subscribed
+							}));
+							subscribed = true;
+							return;
+						case "error":
+							if (subscribed) push(frame("status", { status }));
+							else finish("upstream_error");
+							return;
+						case "closed":
+							finish("closed");
+							return;
+						default: finish(status);
+					}
+				};
+				const subscriber = {
+					onStatus,
+					receive: (message) => {
+						push(frame("broadcast", {
+							event: message.event,
+							payload: message.payload
+						}));
+					},
+					...topic.presence ? { sync: (state) => {
+						push(frame("presence", state));
+					} } : {}
+				};
+				enqueue(encoder.encode(`retry: ${String(retryMs)}\n\n`));
+				if (request.signal.aborted) {
+					finish(null);
+					return;
+				}
+				request.signal.addEventListener("abort", aborted);
+				timers.push(setInterval(() => {
+					push(PING);
+				}, heartbeatMs), setTimeout(() => {
+					finish("max_duration");
+				}, maxDurationMs));
+				if (expiresAt !== void 0) timers.push(setTimeout(() => {
+					finish("expired");
+				}, Math.max(0, expiresAt - Date.now())));
+				try {
+					leave = joinTopic(client, name, topic.private, false, topic.presence === true, subscriber).leave;
+				} catch {
+					finish("upstream_error");
+				}
+			},
+			cancel() {
+				finish(null);
+			}
+		}, new CountQueuingStrategy({ highWaterMark: maxQueued }));
+		return ctx.apply(new Response(stream, {
+			status: 200,
+			headers: STREAM_HEADERS
+		}));
+	};
+	const POST = async (request) => {
+		const body = await request.json().catch(() => void 0);
+		if (!isSendBody(body)) return problem(dbError("invalid_request", "Send a JSON body with `topic`, `event` and `payload`"));
+		const known = topicOf(body.topic);
+		if (known && !known.clientSend) return problem(dbError("forbidden", `"${body.topic}" takes no client broadcasts`));
+		const admitted = await admit(request, body.topic, "send");
+		if ("refusal" in admitted) return admitted.refusal;
+		const { topic, ctx } = admitted;
+		const schema = topic.events?.[body.event];
+		const checked = schema ? await validate(schema, body.payload, "payload") : {
+			ok: true,
+			data: body.payload
+		};
+		if (!checked.ok) return ctx.apply(problem(checked.error));
+		const client = upstreamClient();
+		const open = client.getChannels().some((existing) => existing.topic === `realtime:${body.topic}`);
+		const channel = client.channel(body.topic, { config: { private: topic.private } });
+		try {
+			const sent = await channel.httpSend(body.event, checked.data);
+			return ctx.apply(sent.success ? new Response(null, { status: 202 }) : problem(dbError("network", sent.error)));
+		} finally {
+			if (!open) await client.removeChannel(channel);
+		}
+	};
+	return {
+		GET,
+		POST
+	};
+}
+//#endregion
 //#region src/server/entries/upstream.ts
 /** Repository context from a `@supabase/server` context. */
 function contextFromSupabase(ctx) {
@@ -452,4 +847,4 @@ function subscribeAuthzVersions(options) {
 	return subscription;
 }
 //#endregion
-export { AUTH_CACHE_HEADERS, DB_CALLS_HEADER, IDENTITY_SCOPES, PERMISSION_CAP_CLAIM, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, SERVER_EVENT_SOURCE, SUPPORT_COOKIE, TENANT_HEADER, aalOf, accessTokenResolver, actorOf, agentClaims, amrOf, authContext, authModeOf, authzVersionOf, bindAuthorizer, cacheTagsOf, checkAal, checkSession, clearSessionCookies, clearSupportCookie, clientIp, contextFromSupabase, createServer, csvColumns, csvResponse, defineAuthorizationHooks, defineAuthorizer, defineResource, delegationOf, deleteAccount, endSessions, extendServer, flushEvents, fromProblem, guard, handle, hasRole, impersonationEvents, impersonatorOf, isPrefetch, isProblem, isRateLimitPolicyName, isResult, isSessionSnapshot, issuedAtOf, jwtClaimsOf, lastSignIns, parseDbStats, passwordGrant, periodSeconds, problemResponse, rateLimitHeader, rateLimitPolicyHeader, readSession, refreshFor, refreshSession, requestMemo, resolveAuth, resolveToken, respond, rolesAt, safeRedirectPath, serverCore, sessionCacheKey, sessionCookieName, sessionMemo, sessionStatus, settle, shouldCheckSession, shouldRefresh, snapshotOf, sqlSupportStore, subjectReaders, subscribeAuthzVersions, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, supportStorage, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, unexpectedResponse, userClaimsOf, withBetterDb, withBetterPostgres, withBetterSupabase, withBlock, withDbStats, withFlush, withGuard, withServerTiming, withSession, writeSession };
+export { AUTH_CACHE_HEADERS, DB_CALLS_HEADER, IDENTITY_SCOPES, PERMISSION_CAP_CLAIM, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, SERVER_EVENT_SOURCE, SUPPORT_COOKIE, TENANT_HEADER, aalOf, accessTokenResolver, actorOf, agentClaims, amrOf, authContext, authModeOf, authzVersionOf, bindAuthorizer, cacheTagsOf, checkAal, checkSession, claimsFingerprint, clearSessionCookies, clearSupportCookie, clientIp, contextFromSupabase, createServer, csvColumns, csvResponse, defineAuthorizationHooks, defineAuthorizer, defineResource, delegationOf, deleteAccount, endSessions, extendServer, flushEvents, fromProblem, guard, handle, hasRole, impersonationEvents, impersonatorOf, isPrefetch, isProblem, isRateLimitPolicyName, isResult, isSessionSnapshot, issuedAtOf, jwtClaimsOf, lastSignIns, liveRelayTopic, parseDbStats, passwordGrant, periodSeconds, problemResponse, rateLimitHeader, rateLimitPolicyHeader, readSession, realtimeRelay, realtimeTopicAccess, refreshFor, refreshSession, requestMemo, resolveAuth, resolveToken, respond, rolesAt, safeRedirectPath, serverCore, sessionCacheKey, sessionCookieName, sessionMemo, sessionStatus, sessionStatusRoute, settle, shouldCheckSession, shouldRefresh, snapshotOf, sqlSupportStore, subjectReaders, subscribeAuthzVersions, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, supportStorage, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, unexpectedResponse, userClaimsOf, withBetterDb, withBetterPostgres, withBetterSupabase, withBlock, withDbStats, withFlush, withGuard, withServerTiming, withSession, writeSession };