better-supabase 0.2.0 → 0.3.0

package/dist/storage-DuGn38fr.js

@@ -1,527 +0,0 @@
-import { n as dbError, o as isDbError, t as DbException } from "./errors-Bl3rkOzo.js";
-import { i as ok, n as err, o as toDbError, t as AsyncResult } from "./result-DWXatkd6.js";
-import { i as tenantClaimPaths } from "./claims-CoTobNC-.js";
-import { a as sqlString, i as sqlIdent, n as parseTemplate, r as slug, t as permdockCheck } from "./permdock-sql-CghlHPuH.js";
-//#region src/storage/index.ts
-/** Storage operations that list objects; every other `select` is a read. */
-const LIST_OPERATIONS = [
-	"object.list",
-	"object.list_v2",
-	"s3.object.list"
-];
-const TTL = {
-	minute: 60,
-	hour: 3600,
-	day: 86400,
-	week: 604800
-};
-const SIZE_UNITS = {
-	b: 1,
-	kb: 1e3,
-	kib: 1024,
-	mb: 1e3 ** 2,
-	mib: 1024 ** 2,
-	gb: 1e3 ** 3,
-	gib: 1024 ** 3
-};
-function parseSize(value) {
-	if (typeof value === "number") return value;
-	const match = /^\s*(\d+(?:\.\d+)?)\s*([a-z]*)\s*$/i.exec(value);
-	const unit = SIZE_UNITS[(match?.[2] || "b").toLowerCase()];
-	if (!match || unit === void 0) throw new TypeError(`Invalid size "${value}"`);
-	return Math.round(Number(match[1]) * unit);
-}
-const SAFE_SEGMENT = /^[\w!\-.*'() &$@=;:+,?]+$/;
-function validateSegment(_name, value) {
-	if (value === "." || value === "..") return "is a relative path";
-	if (!SAFE_SEGMENT.test(value)) return "contains characters Storage does not allow";
-}
-function claimSql(claim) {
-	const expressions = (typeof claim === "string" ? [claim] : claim).map((path) => {
-		const keys = path.split(".");
-		const last = keys.pop();
-		return `(select auth.jwt())${keys.map((key) => ` -> ${sqlString(key)}`).join("")} ->> ${sqlString(last)}`;
-	});
-	return expressions.length === 1 ? expressions[0] : `coalesce(${expressions.join(", ")})`;
-}
-function mimeAllowed(allowed, type) {
-	const base = type.split(";")[0].trim().toLowerCase();
-	return allowed.some((entry) => {
-		const pattern = entry.toLowerCase();
-		return pattern.endsWith("/*") ? base.startsWith(pattern.slice(0, -1)) : base === pattern;
-	});
-}
-function sizeLabel(bytes) {
-	for (const [unit, size] of [
-		["GiB", 1024 ** 3],
-		["MiB", 1024 ** 2],
-		["KiB", 1024]
-	]) if (bytes >= size && bytes % size === 0) return `${String(bytes / size)}${unit}`;
-	return `${String(bytes)}B`;
-}
-/** Maps a Storage error (`StorageApiError`, fetch failures) to a `DbError`. */
-function fromStorageError(raw, table) {
-	if (isDbError(raw)) return raw;
-	if (raw instanceof DbException) return raw.error;
-	if (typeof raw !== "object" || raw === null) return toDbError(raw);
-	const failure = raw;
-	if (failure.name === "AbortError") return toDbError(raw);
-	const message = failure.message ?? "Storage request failed";
-	const code = failure.code ?? failure.statusCode;
-	const base = {
-		...code ? { code } : {},
-		...table ? { table } : {}
-	};
-	const statusCode = Number(failure.statusCode);
-	const status = Number.isFinite(statusCode) && statusCode >= 400 ? statusCode : failure.status ?? 0;
-	if (/row-level security|unauthorized to|AccessDenied/i.test(`${message} ${code ?? ""}`)) return dbError("forbidden", message, base);
-	if (/already exists|duplicate/i.test(`${message} ${code ?? ""}`)) return dbError("conflict", message, base);
-	if (failure.name === "StorageUnknownError" && status === 0) return dbError("network", message, base);
-	switch (status) {
-		case 400: return dbError("invalid_request", message, base);
-		case 401: return dbError("unauthorized", message, base);
-		case 403: return dbError("forbidden", message, base);
-		case 404: return dbError("not_found", message, base);
-		case 409: return dbError("conflict", message, base);
-		case 413:
-		case 415: return dbError("invalid_input", message, {
-			...base,
-			status
-		});
-		case 408:
-		case 429: return dbError("network", message, {
-			...base,
-			status
-		});
-		default: return status >= 500 ? dbError("network", message, base) : dbError("unexpected", message, base);
-	}
-}
-/**
-* A typed Storage bucket: path builders from a template, limits, generated
-* SQL policies and `config.toml`, and helpers for the multi-step work apps
-* repeat (replace, signed uploads, orphan cleanup).
-*
-* ```ts
-* export const logos = defineBucket({
-*   id: 'customer-logos',
-*   path: '{orgId}/{customerId}/logo/{version}.webp',
-*   policy: 'tenant',
-*   fileSizeLimit: '5MiB',
-*   allowedMimeTypes: ['image/webp'],
-* });
-* ```
-*/
-function defineBucket(config) {
-	const template = parseTemplate(config.path, "/", validateSegment);
-	const policy = config.policy ?? "none";
-	const fileSizeLimit = config.fileSizeLimit === void 0 ? void 0 : parseSize(config.fileSizeLimit);
-	const allowedMimeTypes = config.allowedMimeTypes;
-	function segmentFor(param, kind) {
-		const index = template.segmentOf(param);
-		if (index === void 0) throw new TypeError(`defineBucket: a ${kind} policy needs {${param}} as a whole path segment in "${config.path}"`);
-		return index;
-	}
-	const mode = typeof policy === "string" ? policy : "permdock";
-	const accessCheck = (() => {
-		switch (mode) {
-			case "tenant": {
-				const index = segmentFor(config.tenant?.param ?? "orgId", "tenant");
-				const expression = config.tenant?.sql ?? claimSql(config.tenant?.claim ?? tenantClaimPaths());
-				return `split_part(name, '/', ${String(index)}) = (${expression})`;
-			}
-			case "owner": {
-				const index = segmentFor(config.owner?.param ?? "userId", "owner");
-				return `split_part(name, '/', ${String(index)}) = (select auth.uid())::text`;
-			}
-			case "public":
-			case "none":
-			case "permdock": return;
-			default: throw new TypeError(`defineBucket: unknown policy "${String(mode)}"`);
-		}
-	})();
-	const permdock = (() => {
-		if (typeof policy === "string") return void 0;
-		const where = `defineBucket(${config.id})`;
-		const id = policy.scope === "global" ? void 0 : `split_part(name, '/', ${String(policy.segment ?? segmentFor(config.tenant?.param ?? "orgId", "PermDock"))})`;
-		const check = (key) => permdockCheck(where, policy, key, id);
-		const keys = policy.permdock;
-		return {
-			read: check(keys.read),
-			...keys.list === void 0 ? {} : { list: check(keys.list) },
-			write: check(keys.write),
-			delete: check(keys.delete ?? keys.write)
-		};
-	})();
-	const resolve = (target) => {
-		if (typeof target !== "string") return template.build(target);
-		if (!template.match(target)) throw new DbException(dbError("invalid_input", `Path "${target}" does not match "${config.path}"`));
-		return target;
-	};
-	const check = (file) => {
-		if (fileSizeLimit !== void 0 && file.size !== void 0 && file.size > fileSizeLimit) return dbError("invalid_input", `File is larger than ${sizeLabel(fileSizeLimit)}`, { status: 413 });
-		if (allowedMimeTypes && file.type && !mimeAllowed(allowedMimeTypes, file.type)) return dbError("invalid_input", `File type ${file.type} is not allowed`, { status: 415 });
-	};
-	const bucket = {
-		id: config.id,
-		template: config.path,
-		params: template.params,
-		owner: policy === "owner" ? config.owner?.param ?? "userId" : template.params.includes("userId") ? "userId" : void 0,
-		public: config.public ?? false,
-		policy,
-		fileSizeLimit,
-		allowedMimeTypes,
-		path: (values) => template.build(values),
-		match: (path) => template.match(path),
-		prefix: (values = {}) => template.prefix(values, template.segments - 1),
-		check,
-		sql() {
-			const id = sqlString(config.id);
-			const name = slug(config.id);
-			const lines = [
-				`-- better-supabase: bucket ${config.id} (${config.path})`,
-				"insert into storage.buckets (id, name, public, file_size_limit, allowed_mime_types)",
-				`values (${id}, ${id}, ${String(bucket.public)}, ${fileSizeLimit === void 0 ? "null" : String(fileSizeLimit)}, ${allowedMimeTypes ? `array[${allowedMimeTypes.map(sqlString).join(", ")}]` : "null"})`,
-				"on conflict (id) do update set public = excluded.public, file_size_limit = excluded.file_size_limit,",
-				"  allowed_mime_types = excluded.allowed_mime_types;"
-			];
-			const policies = [];
-			const inBucket = `bucket_id = ${id}`;
-			const shape = `name ~ ${sqlString(template.sqlPattern)}`;
-			if (accessCheck) {
-				const using = `${inBucket} and ${accessCheck}`;
-				const write = `${using} and ${shape}`;
-				policies.push([
-					"select",
-					"select",
-					"authenticated",
-					using,
-					void 0
-				], [
-					"insert",
-					"insert",
-					"authenticated",
-					void 0,
-					write
-				], [
-					"update",
-					"update",
-					"authenticated",
-					using,
-					write
-				], [
-					"delete",
-					"delete",
-					"authenticated",
-					using,
-					void 0
-				]);
-			} else if (policy === "public") policies.push([
-				"select",
-				"select",
-				"anon, authenticated",
-				inBucket,
-				void 0
-			]);
-			else if (permdock) {
-				const listing = `storage.allow_any_operation(array[${LIST_OPERATIONS.map(sqlString).join(", ")}])`;
-				if (permdock.list) policies.push([
-					"select",
-					"select",
-					"authenticated",
-					`${inBucket} and not ${listing} and ${permdock.read}`,
-					void 0
-				], [
-					"list",
-					"select",
-					"authenticated",
-					`${inBucket} and ${listing} and ${permdock.list}`,
-					void 0
-				]);
-				else policies.push([
-					"select",
-					"select",
-					"authenticated",
-					`${inBucket} and ${permdock.read}`,
-					void 0
-				]);
-				const write = `${inBucket} and ${permdock.write}`;
-				policies.push([
-					"insert",
-					"insert",
-					"authenticated",
-					void 0,
-					`${write} and ${shape}`
-				], [
-					"update",
-					"update",
-					"authenticated",
-					write,
-					`${write} and ${shape}`
-				], [
-					"delete",
-					"delete",
-					"authenticated",
-					`${inBucket} and ${permdock.delete}`,
-					void 0
-				]);
-			}
-			for (const [suffix, command, roles, using, withCheck] of policies) {
-				const policyName = sqlIdent(`bs_${name}_${suffix}`);
-				lines.push("", `drop policy if exists ${policyName} on storage.objects;`, `create policy ${policyName} on storage.objects for ${command} to ${roles}${using ? `\n  using (${using})` : ""}${withCheck ? `\n  with check (${withCheck})` : ""};`);
-			}
-			if (permdock && !permdock.list) lines.push("", `drop policy if exists ${sqlIdent(`bs_${name}_list`)} on storage.objects;`);
-			return `${lines.join("\n")}\n`;
-		},
-		toml() {
-			const lines = [`[storage.buckets.${config.id}]`, `public = ${String(bucket.public)}`];
-			if (config.fileSizeLimit !== void 0) lines.push(`file_size_limit = "${typeof config.fileSizeLimit === "number" ? sizeLabel(config.fileSizeLimit) : config.fileSizeLimit}"`);
-			if (allowedMimeTypes) lines.push(`allowed_mime_types = [${allowedMimeTypes.map((type) => JSON.stringify(type)).join(", ")}]`);
-			return `${lines.join("\n")}\n`;
-		},
-		drift(actual) {
-			if (!actual) return [{
-				field: "missing",
-				expected: config.id,
-				actual: void 0,
-				message: `Bucket "${config.id}" does not exist`
-			}];
-			const issues = [];
-			if (actual.public !== bucket.public) issues.push({
-				field: "public",
-				expected: bucket.public,
-				actual: actual.public,
-				message: `Bucket "${config.id}" public is ${String(actual.public)}`
-			});
-			if ((actual.fileSizeLimit ?? void 0) !== fileSizeLimit) issues.push({
-				field: "fileSizeLimit",
-				expected: fileSizeLimit,
-				actual: actual.fileSizeLimit,
-				message: `Bucket "${config.id}" file size limit differs`
-			});
-			const sorted = (list) => list ? [...list].sort().join(",") : "";
-			if (sorted(actual.allowedMimeTypes) !== sorted(allowedMimeTypes)) issues.push({
-				field: "allowedMimeTypes",
-				expected: allowedMimeTypes,
-				actual: actual.allowedMimeTypes,
-				message: `Bucket "${config.id}" allowed MIME types differ`
-			});
-			return issues;
-		},
-		connect: (client) => connectBucket(bucket, client, resolve)
-	};
-	return bucket;
-}
-function bodyInfo(body, contentType) {
-	const info = {};
-	if (typeof Blob !== "undefined" && body instanceof Blob) {
-		info.size = body.size;
-		if (body.type) info.type = body.type;
-	} else if (body instanceof ArrayBuffer || ArrayBuffer.isView(body)) info.size = body.byteLength;
-	if (contentType) info.type = contentType;
-	return info;
-}
-function ttlSeconds(ttl) {
-	return typeof ttl === "number" ? ttl : TTL[ttl ?? "hour"];
-}
-function isErrorResult(value) {
-	return typeof value === "object" && value !== null && value.ok === false && "error" in value;
-}
-function connectBucket(bucket, client, resolve) {
-	const api = () => client.storage.from(bucket.id);
-	const run = (fn) => AsyncResult.from(async () => {
-		try {
-			const { data, error } = await fn();
-			return error || data === null ? err(fromStorageError(error, bucket.id)) : ok(data);
-		} catch (cause) {
-			return err(fromStorageError(cause, bucket.id));
-		}
-	});
-	const fileOptions = (options, contentType) => ({
-		...contentType ? { contentType } : {},
-		...options?.cacheControl ? { cacheControl: options.cacheControl } : {},
-		...options?.metadata ? { metadata: { ...options.metadata } } : {},
-		upsert: options?.upsert ?? false
-	});
-	const download = (value) => value === void 0 ? {} : { download: value };
-	const upload = (target, body, options) => AsyncResult.from(async () => {
-		options?.signal?.throwIfAborted();
-		const path = resolve(target);
-		const contentType = options?.contentType;
-		const problem = bucket.check(bodyInfo(body, contentType));
-		if (problem) return err(problem);
-		return run(() => api().upload(path, body, fileOptions(options, contentType))).map(() => ({ path }));
-	});
-	const remove = (targets) => AsyncResult.from(async () => {
-		const paths = targets.map(resolve);
-		if (paths.length === 0) return ok([]);
-		return run(() => api().remove(paths)).map(() => paths);
-	});
-	const walk = async (folder, signal, out) => {
-		const limit = 1e3;
-		for (let offset = 0;; offset += limit) {
-			signal?.throwIfAborted();
-			const { data, error } = await api().list(folder, {
-				limit,
-				offset,
-				sortBy: {
-					column: "name",
-					order: "asc"
-				}
-			}, signal ? { signal } : {});
-			if (error) throw new DbException(fromStorageError(error, bucket.id));
-			for (const item of data) {
-				const path = folder ? `${folder}/${item.name}` : item.name;
-				if (item.id === null) await walk(path, signal, out);
-				else {
-					const metadata = item.metadata ?? {};
-					out.push({
-						path,
-						...typeof metadata.size === "number" ? { size: metadata.size } : {},
-						...metadata.mimetype ? { contentType: metadata.mimetype } : {},
-						createdAt: item.created_at,
-						updatedAt: item.updated_at
-					});
-				}
-			}
-			if (data.length < limit) return;
-		}
-	};
-	const list = (within, options) => AsyncResult.from(async () => {
-		const out = [];
-		await walk(bucket.prefix(within ?? {}), options?.signal, out);
-		return ok(out);
-	}).mapError((error) => ({
-		...error,
-		table: bucket.id
-	}));
-	const signedUrl = (target, options) => AsyncResult.from(async () => {
-		const path = resolve(target);
-		return run(() => api().createSignedUrl(path, ttlSeconds(options?.ttl), {
-			...download(options?.download),
-			...options?.transform ? { transform: { ...options.transform } } : {}
-		})).map((data) => data.signedUrl);
-	});
-	return {
-		bucket,
-		upload,
-		download: (target, options) => AsyncResult.from(async () => {
-			const path = resolve(target);
-			return run(() => api().download(path, {}, options?.signal ? { signal: options.signal } : {}));
-		}),
-		exists: (target) => AsyncResult.from(async () => {
-			const path = resolve(target);
-			const found = await api().exists(path);
-			if (!found.data) return ok(false);
-			return found.error ? err(fromStorageError(found.error, bucket.id)) : ok(true);
-		}),
-		remove,
-		list,
-		signedUrl,
-		signedUrls: (targets, options) => AsyncResult.from(async () => {
-			const paths = targets.map(resolve);
-			if (paths.length === 0) return ok([]);
-			return run(() => api().createSignedUrls(paths, ttlSeconds(options?.ttl), download(options?.download))).andThen(async (data) => {
-				const failed = data.find((entry) => entry.error != null || !entry.signedUrl);
-				if (failed) return err(dbError("not_found", failed.error ?? `No URL for ${String(failed.path)}`, { table: bucket.id }));
-				return ok(data.map((entry) => entry.signedUrl));
-			});
-		}),
-		publicUrl(target, options) {
-			const path = resolve(target);
-			return api().getPublicUrl(path, {
-				...download(options?.download),
-				...options?.transform ? { transform: { ...options.transform } } : {}
-			}).data.publicUrl;
-		},
-		renderUrl(target, transform, options) {
-			if (!bucket.public) return signedUrl(target, {
-				...options,
-				transform
-			});
-			return AsyncResult.from(async () => ok(api().getPublicUrl(resolve(target), {
-				...download(options?.download),
-				transform: { ...transform }
-			}).data.publicUrl));
-		},
-		replace: (target, body, options = {}) => AsyncResult.from(async () => {
-			const path = resolve(target);
-			const previous = options.previous ?? null;
-			const same = previous === path;
-			const uploaded = await upload(path, body, {
-				...options,
-				upsert: same || (options.upsert ?? false)
-			});
-			if (!uploaded.ok) return uploaded;
-			const undo = async (error) => {
-				if (!same) await remove([path]);
-				return err(error);
-			};
-			try {
-				options.signal?.throwIfAborted();
-				const outcome = await options.commit?.(path);
-				if (isErrorResult(outcome)) return await undo(outcome.error);
-			} catch (cause) {
-				return undo(fromStorageError(cause, bucket.id));
-			}
-			if (!previous || same) return ok({
-				path,
-				removed: null
-			});
-			const removed = await run(() => api().remove([previous]));
-			return ok(removed.ok ? {
-				path,
-				removed: previous
-			} : {
-				path,
-				removed: null,
-				cleanup: removed.error
-			});
-		}),
-		reserve: (target, options) => AsyncResult.from(async () => {
-			const path = resolve(target);
-			return run(() => api().createSignedUploadUrl(path, options?.upsert ? { upsert: true } : void 0)).map((data) => ({
-				path: data.path,
-				token: data.token,
-				signedUrl: data.signedUrl
-			}));
-		}),
-		uploadReserved: (reservation, body, options) => AsyncResult.from(async () => {
-			options?.signal?.throwIfAborted();
-			const path = resolve(reservation.path);
-			const problem = bucket.check(bodyInfo(body, options?.contentType));
-			if (problem) return err(problem);
-			return run(() => api().uploadToSignedUrl(path, reservation.token, body, fileOptions(options, options?.contentType))).map(() => ({ path }));
-		}),
-		sweep: (options) => AsyncResult.from(async () => {
-			const now = options.now?.() ?? Date.now();
-			const cutoff = options.olderThan instanceof Date ? options.olderThan.getTime() : now - options.olderThan;
-			const found = await list(options.within, options.signal ? { signal: options.signal } : void 0);
-			if (!found.ok) return found;
-			const candidates = found.data.filter((object) => bucket.match(object.path) !== null).filter((object) => {
-				const created = Date.parse(object.createdAt ?? object.updatedAt ?? "");
-				return Number.isFinite(created) && created < cutoff;
-			}).map((object) => object.path);
-			const size = options.batchSize ?? 100;
-			const orphans = [];
-			const removed = [];
-			for (let index = 0; index < candidates.length; index += size) {
-				options.signal?.throwIfAborted();
-				const batch = candidates.slice(index, index + size);
-				const keep = new Set(await options.referenced(batch));
-				const unreferenced = batch.filter((path) => !keep.has(path));
-				orphans.push(...unreferenced);
-				if (options.dryRun || unreferenced.length === 0) continue;
-				const result = await run(() => api().remove(unreferenced));
-				if (!result.ok) return result;
-				removed.push(...unreferenced);
-			}
-			return ok({
-				scanned: found.data.length,
-				orphans,
-				removed
-			});
-		})
-	};
-}
-//#endregion
-export { parseSize as i, defineBucket as n, fromStorageError as r, TTL as t };