better-supabase 0.2.0 → 0.3.0

package/dist/{react-C83BdBGt.js → react-DNBYNazu.js}

@@ -1,9 +1,9 @@
 import { i as tenantClaimPaths, n as claimAt, r as claimsOf } from "./claims-CoTobNC-.js";
 import { t as invalidateTables } from "./invalidate-DbxuL2jL.js";
 import { n as liveQuery, t as liveCount } from "./live-D8rV1Ldw.js";
-import { n as useSession } from "./session-CqEwzVup.js";
+import { useSession } from "./react/session.js";
 import { createContext, createElement, useContext, useEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
-//#region src/react/index.ts
+//#region src/react/hooks.ts
 const BrowserContext = createContext(null);
 const LOADING = {
 	status: "loading",
@@ -91,9 +91,9 @@ function useBroadcast(topic, values, handlers, options) {
 	const userId = auth.user?.id ?? null;
 	if (options?.invalidate && !queryClient) throw new Error("better-supabase: useBroadcast({ invalidate }) needs <BetterSupabaseProvider queryClient={...}>");
 	useEffect(() => {
-		if (!name || auth.status === "loading") return void 0;
+		if (!name || auth.status === "loading") return;
 		const matched = topic.match(name);
-		if (!matched) return void 0;
+		if (!matched) return;
 		const forward = (payload, message) => {
 			const current = latest.current;
 			const table = current.handlers;
@@ -153,7 +153,7 @@ function useLiveQuery(spec, options = {}) {
 	const userId = auth.user?.id ?? null;
 	const debounceMs = options.debounceMs;
 	useEffect(() => {
-		if (!key || !queryClient || auth.status === "loading") return void 0;
+		if (!key || !queryClient || auth.status === "loading") return;
 		const live = liveQuery(browser.sb, browser.supabase, JSON.parse(key), {
 			onChange: (tables) => void invalidateTables(queryClient, tables),
 			onStatus: setStatus,
@@ -202,19 +202,23 @@ function useLiveCount(source, options = {}) {
 	const debounceMs = options.debounceMs;
 	const hasInitial = initial !== void 0;
 	useEffect(() => {
-		if (!key || auth.status === "loading") return void 0;
+		if (!key || auth.status === "loading") return;
 		const live = liveCount(browser.sb, browser.supabase, browser.db, JSON.parse(key), {
 			immediate: !hasInitial,
-			onCount: (count) => setState({
-				key,
-				count,
-				error: void 0
-			}),
-			onError: (error) => setState((previous) => ({
-				key,
-				count: previous.key === key ? previous.count : void 0,
-				error
-			})),
+			onCount: (count) => {
+				setState({
+					key,
+					count,
+					error: void 0
+				});
+			},
+			onError: (error) => {
+				setState((previous) => ({
+					key,
+					count: previous.key === key ? previous.count : void 0,
+					error
+				}));
+			},
 			onStatus: setStatus,
 			...tenant === void 0 ? {} : { tenant },
 			...debounceMs === void 0 ? {} : { debounceMs }

package/dist/{read-set-4lI3W_gZ.js → read-set-D0qBcboM.js}

@@ -1,5 +1,5 @@
-import { r as IrBuilder, u as tableMeta } from "./simplify-bwJpLnaS.js";
-import { n as touchedTables } from "./tables-rZxRxNPW.js";
+import { r as IrBuilder, u as tableMeta } from "./simplify-LakqK1vH.js";
+import { n as touchedTables } from "./tables-Dhha3BXM.js";
 //#region src/core/spec.ts
 const READ_METHODS = [
 	"findMany",
@@ -87,7 +87,7 @@ const TYPE = /^(?:[a-z_][a-z0-9_]*\.)?[a-z_][a-z0-9_]*(?:\[\])?$/;
 /** `jsonb_build_object` takes at most 100 arguments. */
 const MAX_ENTRIES = 50;
 /** Placeholders are `NUL bs:<name> NUL`: no real parameter value holds a NUL. */
-const NUL = String.fromCharCode(0);
+const NUL = "\0";
 const SENTINEL = new RegExp(`${NUL}bs:([a-z_][a-z0-9_]*)${NUL}`, "gi");
 const EXACT = new RegExp(`^${NUL}bs:([a-z_][a-z0-9_]*)${NUL}$`, "i");
 function sentinel(name) {

package/dist/realtime/index.d.ts

@@ -1,4 +1,5 @@
-import { x as PermdockTopicPolicy } from "../types-C83v5SQz.js";
+import { x as PermdockTopicPolicy } from "../types-DONv9SHN.js";
+import { t as PermdockCatalog } from "../permdock-sql-DImJULY-.js";
 import { n as TemplateValues, t as TemplateParams } from "../template-mbvlysOo.js";
-import { C as defineTopic, S as TriggerOptions, _ as TopicEvent, a as LiveSource, b as TopicOptions, c as liveQuery, d as RealtimeClient, f as RowChange, g as Topic, h as SubscriptionStatus, i as LiveQueryOptions, l as liveTopic, m as Subscription, n as LiveCountOptions, o as LiveSubscription, p as SubscribeOptions, r as LiveCountSeed, s as liveCount, t as CountRunner, u as EventSchemas, v as TopicHandlers, w as rowChange, x as TopicPayload, y as TopicMessage } from "../live-DJyZMD6w.js";
-export { type CountRunner, EventSchemas, type LiveCountOptions, type LiveCountSeed, type LiveQueryOptions, type LiveSource, type LiveSubscription, type PermdockTopicPolicy, RealtimeClient, RowChange, SubscribeOptions, Subscription, SubscriptionStatus, type TemplateParams, type TemplateValues, Topic, TopicEvent, TopicHandlers, TopicMessage, TopicOptions, TopicPayload, TriggerOptions, defineTopic, liveCount, liveQuery, liveTopic, rowChange };
+import { C as defineTopic, S as TriggerOptions, _ as TopicEvent, a as LiveSource, b as TopicOptions, c as liveQuery, d as RealtimeClient, f as RowChange, g as Topic, h as SubscriptionStatus, i as LiveQueryOptions, l as liveTopic, m as Subscription, n as LiveCountOptions, o as LiveSubscription, p as SubscribeOptions, r as LiveCountSeed, s as liveCount, t as CountRunner, u as EventSchemas, v as TopicHandlers, w as rowChange, x as TopicPayload, y as TopicMessage } from "../live-QE3UPbGm.js";
+export { type CountRunner, type EventSchemas, type LiveCountOptions, type LiveCountSeed, type LiveQueryOptions, type LiveSource, type LiveSubscription, type PermdockCatalog, type PermdockTopicPolicy, type RealtimeClient, type RowChange, type SubscribeOptions, type Subscription, type SubscriptionStatus, type TemplateParams, type TemplateValues, type Topic, type TopicEvent, type TopicHandlers, type TopicMessage, type TopicOptions, type TopicPayload, type TriggerOptions, defineTopic, liveCount, liveQuery, liveTopic, rowChange };

package/dist/realtime/index.js

@@ -3,9 +3,9 @@ import { i as ok, n as err, t as AsyncResult } from "../result-DWXatkd6.js";
 import { i as tenantClaimPaths } from "../claims-CoTobNC-.js";
 import { n as liveQuery, r as liveTopic, t as liveCount } from "../live-D8rV1Ldw.js";
 import { s as toApp } from "../shared-_6-uPL7E.js";
-import { a as sqlString, i as sqlIdent, n as parseTemplate, r as slug, t as permdockCheck } from "../permdock-sql-CghlHPuH.js";
+import { a as sqlIdent, i as slug, o as sqlString, r as parseTemplate, t as permdockCheck } from "../permdock-sql-Bta_G0v-.js";
 import { REALTIME_SUBSCRIBE_STATES } from "@supabase/supabase-js";
-//#region src/realtime/index.ts
+//#region src/realtime/topic.ts
 const VALUE = /^[\w.@+=-]+$/;
 function validateValue(_name, value) {
 	return VALUE.test(value) ? void 0 : "contains characters topics do not allow";
@@ -55,7 +55,7 @@ function sendError(status, message) {
 */
 function defineTopic(template, options = {}) {
 	const parsed = parseTemplate(template, ":", validateValue);
-	const literal = template.replace(/\{[^}]+\}/g, " ");
+	const literal = template.replaceAll(/\{[^}]+\}/g, " ");
 	const name = slug(options.name ?? literal) || "topic";
 	const isPrivate = options.private ?? true;
 	const schemas = options.events ?? {};
@@ -71,10 +71,10 @@ function defineTopic(template, options = {}) {
 		if (!permdock) return void 0;
 		const where = `defineTopic(${template})`;
 		const id = permdock.scope === "global" ? void 0 : `split_part((select realtime.topic()), ':', ${String(permdock.segment ?? segment(tenantParam ?? "orgId", "PermDock"))})`;
-		const receive = permdockCheck(where, permdock, permdock.receive, id);
+		const receive = permdockCheck(where, permdock, permdock.receive, id, options.catalog);
 		return {
 			receive,
-			send: permdock.send === void 0 ? receive : permdockCheck(where, permdock, permdock.send, id)
+			send: permdock.send === void 0 ? receive : permdockCheck(where, permdock, permdock.send, id, options.catalog)
 		};
 	})();
 	if (!permdock && tenantParam && (options.tenant || parsed.params.includes(tenantParam))) {
@@ -131,7 +131,7 @@ function defineTopic(template, options = {}) {
 				if (!db) throw new TypeError(`defineTopic: no column for {${param}} on "${table}"`);
 				return `rec.${sqlIdent(db)}::text`;
 			});
-			const schema = trigger.functionSchema ?? "public";
+			const schema = trigger.functionSchema ?? "better_supabase";
 			const fn = `${sqlIdent(schema)}.${sqlIdent(`bs_broadcast_${name}_${slug(meta.name)}`)}`;
 			const triggerName = sqlIdent(`bs_broadcast_${name}`);
 			const target = `${sqlIdent(meta.schema)}.${sqlIdent(meta.name)}`;
@@ -142,6 +142,7 @@ function defineTopic(template, options = {}) {
 			]).join(" or ");
 			return [
 				`-- better-supabase: broadcast ${meta.name} changes to ${template}`,
+				`create schema if not exists ${sqlIdent(schema)};`,
 				`create or replace function ${fn}()`,
 				"returns trigger",
 				"language plpgsql",

package/dist/{resolve-CjHILk2w.d.ts → resolve-BRciX2jK.d.ts}

@@ -1,7 +1,7 @@
-import { p as DbError } from "./result-CTkCZ6JA.js";
-import { f as Logger, l as RefreshEvent } from "./events-DOt3nSO-.js";
-import { h as RequestContext } from "./plugin-C4TR9J0Z.js";
-import { t as StandardSchemaV1 } from "./standard-CyhRzctb.js";
+import { p as DbError } from "./result-c2OYgCV2.js";
+import { f as Logger, l as RefreshEvent } from "./events-Do8jXh4D.js";
+import { h as RequestContext } from "./plugin-DVRB8qNE.js";
+import { t as StandardSchemaV1 } from "./standard-eudBiRk1.js";
 import { t as BetterSupabaseEnv } from "./index-Dy6kuF0P.js";
 import { CookieOptions } from "@supabase/ssr";
 import { JWTClaims, SupabaseEnv, UserClaims } from "@supabase/server";
@@ -76,7 +76,7 @@ type AuthState<C = unknown, P = unknown> = {
   readonly reason: InvalidReason;
   readonly error: DbError;
 };
-type InvalidReason = "token" | "claims";
+type InvalidReason = "token" | "claims" | "actor";
 /**
  * What an `AuthResolver` returns. `reason` may be left out of an `invalid`
  * state; it then counts as `token`.
@@ -140,6 +140,7 @@ interface ResolveAuthOptions {
   /** Called after every refresh attempt (metrics, logging). */
   readonly onRefresh?: (event: RefreshEvent) => void;
   readonly fetch?: typeof fetch;
+  /** Epoch milliseconds, the unit JWT `exp` and `iat` math needs. */
   readonly now?: () => number;
 }
 interface AuthResolution<C = unknown, P = unknown> {

package/dist/{resource-CgZa3YG_.d.ts → resource-CwVgiI5q.d.ts}

@@ -1,13 +1,14 @@
-import { N as TableKey, P as TableMeta, R as Update, _ as Insert, n as AnyModels, t as AnyFunctions } from "./types-C83v5SQz.js";
-import { b as ValidationIssue, o as Result } from "./result-CTkCZ6JA.js";
-import { t as BetterSupabase, xt as SelectArg } from "./define-e3zI4_4g.js";
-import { r as RespondOptions } from "./respond-Dne1ARSa.js";
-import { i as ResourceOperation } from "./index-DbxFr7XG.js";
+import { N as TableKey, P as TableMeta, R as Update, g as Insert, n as AnyModels, t as AnyFunctions } from "./types-DONv9SHN.js";
+import { b as ValidationIssue, o as Result } from "./result-c2OYgCV2.js";
+import { t as BetterSupabase, xt as SelectArg } from "./define-DUbydmJa.js";
+import { r as RespondOptions } from "./respond-DAkPIdTH.js";
+import { i as ResourceOperation } from "./index-qriRM9cZ.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/server/resource.d.ts
 /** What a resource needs from `defineListQuery`. */
 interface ResourceList {
   readonly table: string;
+  readonly pagination?: ResourcePagination;
   readonly openapi: readonly unknown[];
   readonly jsonSchema: Readonly<Record<string, unknown>>;
   parse(input: never): {
@@ -31,9 +32,16 @@ interface ResourceRouteOptions<M extends AnyModels, T extends TableKey<M>> {
     readonly create?: StandardSchemaV1<unknown, Insert<M, T>>;
     readonly update?: StandardSchemaV1<unknown, Update<M, T>>;
   };
-  /** Largest page for the default `page`/`size` list. Defaults to 200. */
+  /**
+   * Paging of the default list: `offset` (`page` and `size`) or `cursor`
+   * (`after` and `size`, keyset). A `list` query brings its own. Defaults
+   * to `offset`.
+   */
+  readonly pagination?: ResourcePagination;
+  /** Largest page for the default list. Defaults to 200. */
   readonly maxPageSize?: number;
 }
+type ResourcePagination = "offset" | "cursor";
 interface ResourceInput {
   /** Primary key value; strings are converted for integer keys. */
   readonly id?: unknown;
@@ -49,6 +57,7 @@ interface ResourceHandler {
   /** Name of the key parameter, or `undefined` for tables without a single-column key. */
   readonly keyParam: string | undefined;
   readonly list: ResourceList | undefined;
+  readonly pagination: ResourcePagination;
   readonly maxPageSize: number;
   /** Runs one operation as whoever `db` is bound to. Resolves to a `Result`. */
   execute(db: object, operation: ResourceOperation, input?: ResourceInput): Promise<Result<unknown>>;
@@ -62,4 +71,4 @@ interface ResourceHandler {
  */
 declare function defineResource<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>>(sb: BetterSupabase<M, D, F, E>, table: T, options?: ResourceRouteOptions<M, T>): ResourceHandler;
 //#endregion
-export { defineResource as a, ResourceRouteOptions as i, ResourceInput as n, ResourceList as r, ResourceHandler as t };
+export { ResourceRouteOptions as a, ResourcePagination as i, ResourceInput as n, defineResource as o, ResourceList as r, ResourceHandler as t };

package/dist/{resource-BHEWmQJK.js → resource-D30rp0GN.js}

@@ -1,7 +1,7 @@
 import { n as dbError } from "./errors-Bl3rkOzo.js";
 import { i as ok, n as err } from "./result-DWXatkd6.js";
 import { t as validate } from "./standard-FUi3Z3-7.js";
-import { i as respond } from "./respond-DMcbQwfN.js";
+import { i as respond } from "./respond-C44EZAJo.js";
 //#region src/server/resource.ts
 const INTEGER = /* @__PURE__ */ new Set([
 	"int2",
@@ -24,24 +24,44 @@ async function readBody(request) {
 	} catch {}
 	return err(dbError("invalid_request", "The request body must be a JSON object"));
 }
-function pageArgs(query, max) {
+function pageArgs(query, max, pagination) {
+	const raw = (name) => {
+		const value = query instanceof URLSearchParams ? query.get(name) : query?.[name];
+		return value === null || value === "" ? void 0 : value;
+	};
 	const read = (name, fallback) => {
-		const raw = query instanceof URLSearchParams ? query.get(name) : query?.[name];
-		if (raw === null || raw === void 0 || raw === "") return fallback;
-		const value = Number(raw);
-		return Number.isSafeInteger(value) && value >= 1 ? value : void 0;
+		const value = raw(name);
+		if (value === void 0) return fallback;
+		const number = Number(value);
+		return Number.isSafeInteger(number) && number >= 1 ? number : void 0;
 	};
-	const page = read("page", 1);
+	const issues = [];
 	const size = read("size", 50);
-	if (page === void 0 || size === void 0 || size > max) return err(dbError("validation", "Invalid page parameters", { issues: [...page === void 0 ? [{
-		message: "Must be a positive integer",
-		path: ["page"]
-	}] : [], ...size === void 0 || size > max ? [{
+	if (size === void 0 || size > max) issues.push({
 		message: `Must be between 1 and ${max}`,
 		path: ["size"]
-	}] : []] }));
-	return ok({
-		page,
+	});
+	const [used, unused] = pagination === "cursor" ? ["after", "page"] : ["page", "after"];
+	if (raw(unused) !== void 0) issues.push({
+		message: `This list pages with \`${used}\``,
+		path: [unused]
+	});
+	const page = read("page", 1);
+	if (pagination === "offset" && page === void 0) issues.push({
+		message: "Must be a positive integer",
+		path: ["page"]
+	});
+	const after = raw("after");
+	if (pagination === "cursor" && after !== void 0 && typeof after !== "string") issues.push({
+		message: "Must be text",
+		path: ["after"]
+	});
+	if (issues.length > 0 || size === void 0) return err(dbError("validation", "Invalid page parameters", { issues }));
+	return pagination === "cursor" ? ok({
+		after: typeof after === "string" ? after : null,
+		size
+	}) : ok({
+		page: page ?? 1,
 		size
 	});
 }
@@ -78,6 +98,7 @@ function defineResource(sb, table, options = {}) {
 	const extra = options.select === void 0 ? {} : { select: options.select };
 	const maxPageSize = options.maxPageSize ?? 200;
 	const list = options.list;
+	const pagination = list ? list.pagination ?? "offset" : options.pagination ?? "offset";
 	const execute = async (db, operation, input = {}) => {
 		const repository = db[table];
 		if (!repository) throw new TypeError(`The db has no "${table}" repository`);
@@ -90,12 +111,12 @@ function defineResource(sb, table, options = {}) {
 					if (!query.ok) return err(dbError("validation", "Invalid list query", { issues: query.issues }));
 					return settled(list.run(db, query.value, extra));
 				}
-				const page = pageArgs(input.query, maxPageSize);
+				const page = pageArgs(input.query, maxPageSize, pagination);
 				if (!page.ok) return page;
 				return settled(repository.paginate({
 					...extra,
 					...page.data,
-					count: "exact"
+					..."page" in page.data ? { count: "exact" } : {}
 				}));
 			}
 			case "get": {
@@ -160,6 +181,7 @@ function defineResource(sb, table, options = {}) {
 		operations,
 		keyParam,
 		list,
+		pagination,
 		maxPageSize,
 		execute,
 		handle(request, db, id, respondOptions = {}) {

package/dist/{respond-DMcbQwfN.js → respond-C44EZAJo.js}

@@ -1,10 +1,11 @@
 import { n as dbError, o as isDbError, r as dbErrorOf } from "./errors-Bl3rkOzo.js";
 import { i as ok, n as err, o as toDbError, t as AsyncResult } from "./result-DWXatkd6.js";
-import { a as postgrestExecutor, n as StatsRecorder } from "./stats-C5W-rBfR.js";
-import { a as problemResponse } from "./problem-BTkTtRV9.js";
-import { i as loadEnv } from "./env-BEToab0I.js";
-import { h as actClaim, i as authContext, o as resolveAuth, r as checkAal } from "./mfa-CpLfJSde.js";
-import { n as postgresExecutor } from "./executor-DeppvirK.js";
+import { a as postgrestExecutor, n as StatsRecorder } from "./stats-D78UQ8Yu.js";
+import { a as problemResponse } from "./problem-CGt1ADix.js";
+import { loadEnv } from "./env/index.js";
+import { _ as actClaim, g as delegationOf, h as actorOf, i as authContext, o as resolveAuth, r as checkAal } from "./mfa-BxoR1RkN.js";
+import { n as postgresExecutor } from "./executor-C57jx2pn.js";
+import { parseCookieHeader, serializeCookieHeader } from "@supabase/ssr";
 import { createClient } from "@supabase/supabase-js";
 //#region src/server/replicas.ts
 /** Cookie holding the epoch ms until which reads stay on the primary. */
@@ -29,19 +30,18 @@ function replicaState(pinnedUntil = 0, now = Date.now()) {
 /** `bs-primary-until` from a `cookie` header, or 0. */
 function pinnedUntil(cookieHeader) {
 	if (!cookieHeader) return 0;
-	for (const part of cookieHeader.split(";")) {
-		const [name, value] = part.trim().split("=", 2);
-		if (name === "bs-primary-until") {
-			const until = Number(value);
-			return Number.isFinite(until) ? until : 0;
-		}
-	}
-	return 0;
+	const value = parseCookieHeader(cookieHeader).find((cookie) => cookie.name === PRIMARY_COOKIE)?.value;
+	const until = Number(value);
+	return value !== void 0 && Number.isFinite(until) ? until : 0;
 }
 /** A `Set-Cookie` value keeping the next requests on the primary for `pinMs`. */
 function primaryCookie(pinMs, now = Date.now()) {
-	const seconds = Math.max(1, Math.ceil(pinMs / 1e3));
-	return `${PRIMARY_COOKIE}=${String(now + pinMs)}; Path=/; Max-Age=${String(seconds)}; HttpOnly; SameSite=Lax`;
+	return serializeCookieHeader(PRIMARY_COOKIE, String(now + pinMs), {
+		path: "/",
+		maxAge: Math.max(1, Math.ceil(pinMs / 1e3)),
+		httpOnly: true,
+		sameSite: "lax"
+	});
 }
 /**
 * Reads go to `replica` until the context is pinned; writes, and every read
@@ -248,7 +248,7 @@ function createServer(sb, options = {}) {
 				return replica;
 			},
 			get sql() {
-				if (!options.postgres || !sqlClaims) return void 0;
+				if (!options.postgres || !sqlClaims) return;
 				sql ??= sqlFor(sqlClaims, context, recorder);
 				return sql;
 			},
@@ -264,7 +264,7 @@ function createServer(sb, options = {}) {
 			...claims ? { claims } : {},
 			...userMetadata ? { userMetadata } : {},
 			env: env(),
-			...resolveOptions.refresh !== void 0 ? { refresh: resolveOptions.refresh } : {},
+			...resolveOptions.refresh === void 0 ? {} : { refresh: resolveOptions.refresh },
 			onRefresh: (event) => {
 				options.auth?.onRefresh?.(event);
 				sb.events.emit("refresh", event);
@@ -329,10 +329,26 @@ function createServer(sb, options = {}) {
 }
 //#endregion
 //#region src/server/respond.ts
+/** The scopes a delegated user token lacks; empty for the user's own session. */
+function missingScopes(auth, required) {
+	if (required.length === 0) return [];
+	const outcome = actorOf(auth.claims);
+	if (!outcome.ok || !outcome.actor) return [];
+	const granted = new Set(delegationOf(auth.claims)?.scopes);
+	return required.filter((scope) => !granted.has(scope));
+}
 /** `undefined` when `auth` may pass; otherwise the 401/403 error to send. */
-function guard(auth, allow = ["user"], aal = "aal1") {
+function guard(auth, allow = ["user"], aal = "aal1", scopes = []) {
 	if (auth.kind === "invalid") return auth.error;
-	if (allow.includes(auth.kind)) return checkAal(auth, aal);
+	if (allow.includes(auth.kind)) {
+		const denied = checkAal(auth, aal);
+		if (denied || auth.kind !== "user") return denied;
+		const missing = missingScopes(auth, scopes);
+		return missing.length > 0 ? dbError("forbidden", `The token lacks the scope ${missing.join(" ")}`, {
+			code: "INSUFFICIENT_SCOPE",
+			scopes
+		}) : void 0;
+	}
 	return auth.kind === "anon" ? dbError("unauthorized", "Sign in to continue", { code: "MISSING_CREDENTIALS" }) : dbError("forbidden", `A ${auth.kind} caller is not allowed here`);
 }
 function isResult(value) {

package/dist/{respond-Dne1ARSa.d.ts → respond-DAkPIdTH.d.ts}

@@ -1,12 +1,12 @@
-import { n as AnyModels, t as AnyFunctions } from "./types-C83v5SQz.js";
-import { p as DbError, t as AsyncResult } from "./result-CTkCZ6JA.js";
-import { I as StatsRecorder, P as DbStats, t as BetterSupabase, y as Db } from "./define-e3zI4_4g.js";
-import { h as RequestContext } from "./plugin-C4TR9J0Z.js";
+import { n as AnyModels, t as AnyFunctions } from "./types-DONv9SHN.js";
+import { p as DbError, t as AsyncResult } from "./result-c2OYgCV2.js";
+import { I as StatsRecorder, P as DbStats, t as BetterSupabase, y as Db } from "./define-DUbydmJa.js";
+import { h as RequestContext } from "./plugin-DVRB8qNE.js";
 import { t as BetterSupabaseEnv } from "./index-Dy6kuF0P.js";
-import { r as SqlClaims, t as Postgres } from "./pool-R2m_DkXi.js";
-import { o as ImpersonationOptions, t as Aal } from "./mfa-TVia554c.js";
-import { a as ResolveAuthOptions, r as AuthState, t as AuthResolution } from "./resolve-CjHILk2w.js";
-import { n as Bucket } from "./index-DuP14VHo.js";
+import { o as SqlClaims, r as Postgres } from "./pool-B9qsLyFR.js";
+import { o as ImpersonationOptions, t as Aal } from "./mfa-x3V3vGh-.js";
+import { a as ResolveAuthOptions, r as AuthState, t as AuthResolution } from "./resolve-BRciX2jK.js";
+import { n as Bucket } from "./index-CTTMS6_1.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 //#region src/server/delete-account.d.ts
 interface DeleteAccountOptions {
@@ -135,9 +135,15 @@ interface GuardOptions {
    * `required: 'aal2'` until the user verifies a second factor.
    */
   readonly aal?: Aal;
+  /**
+   * OAuth scopes a delegated token (an OAuth client or an `act` chain) needs.
+   * A missing one answers 403 with `error="insufficient_scope"`. The user's
+   * own session is not limited by scopes.
+   */
+  readonly scopes?: readonly string[];
 }
 /** `undefined` when `auth` may pass; otherwise the 401/403 error to send. */
-declare function guard(auth: AuthState, allow?: GuardOptions["allow"], aal?: Aal): DbError | undefined;
+declare function guard(auth: AuthState, allow?: GuardOptions["allow"], aal?: Aal, scopes?: readonly string[]): DbError | undefined;
 declare function isResult(value: unknown): value is {
   ok: boolean;
   data: unknown;

package/dist/{result-CTkCZ6JA.d.ts → result-c2OYgCV2.d.ts}

@@ -7,9 +7,14 @@
 interface DbErrorKinds {
   not_found: Record<never, never>;
   unauthorized: Record<never, never>;
-  /** `required`: the assurance level the route needs, when a second factor is missing. */
+  /**
+   * `required`: the assurance level the route needs, when a second factor is
+   * missing. `scopes`: the OAuth scopes the route needs, when a delegated
+   * token lacks one (`INSUFFICIENT_SCOPE`).
+   */
   forbidden: {
     required?: "aal1" | "aal2";
+    scopes?: readonly string[];
   };
   conflict: {
     constraint?: string;
@@ -158,7 +163,7 @@ declare class AsyncResult<T> implements PromiseLike<Result<T>> {
   andThen<U>(fn: (data: T) => PromiseLike<Result<U>>): AsyncResult<U>;
 }
 /** What `toBetterResult` returns: the `status`/`value`/`error` fields every better-result value has. */
-type BetterResultShape<T, E> = {
+type BetterResultValue<T, E> = {
   readonly status: "ok";
   readonly value: T;
 } | {
@@ -182,17 +187,17 @@ interface BetterResultApi<T, E> {
  * const customer = toBetterResult(await db.customers.findById(id), Result, toAppError);
  * ```
  */
-declare function toBetterResult<T, E>(result: Result<T>, api: BetterResultApi<T, E>, mapError: (error: DbError) => E): BetterResultShape<T, E>;
-declare function toBetterResult<T>(result: Result<T>, api: BetterResultApi<T, DbError>): BetterResultShape<T, DbError>;
-declare function toBetterResult<T, E>(result: AsyncResult<T>, api: BetterResultApi<T, E>, mapError: (error: DbError) => E): Promise<BetterResultShape<T, E>>;
-declare function toBetterResult<T>(result: AsyncResult<T>, api: BetterResultApi<T, unknown>): Promise<BetterResultShape<T, unknown>>;
+declare function toBetterResult<T, E>(result: Result<T>, api: BetterResultApi<T, E>, mapError: (error: DbError) => E): BetterResultValue<T, E>;
+declare function toBetterResult<T>(result: Result<T>, api: BetterResultApi<T, DbError>): BetterResultValue<T, DbError>;
+declare function toBetterResult<T, E>(result: AsyncResult<T>, api: BetterResultApi<T, E>, mapError: (error: DbError) => E): Promise<BetterResultValue<T, E>>;
+declare function toBetterResult<T>(result: AsyncResult<T>, api: BetterResultApi<T, unknown>): Promise<BetterResultValue<T, unknown>>;
 /**
  * Converts a better-result value back into a `Result`, by its `status`
  * field, so it works across better-result versions. A `DbError`, or an
  * error whose `cause` is one, is kept; others go through `mapError`
  * (default `toDbError`).
  */
-declare function fromBetterResult<T>(result: BetterResultShape<T, unknown>, mapError?: (error: unknown) => DbError): Result<T>;
+declare function fromBetterResult<T>(result: BetterResultValue<T, unknown>, mapError?: (error: unknown) => DbError): Result<T>;
 declare function toDbError(cause: unknown): DbError;
 //#endregion
-export { isConflict as C, statusOf as D, mapDbError as E, isCheck as S, isForeignKey as T, DbException as _, Ok as a, ValidationIssue as b, err as c, toBetterResult as d, toDbError as f, DbErrorOf as g, DbErrorKinds as h, Err as i, fromBetterResult as l, DbErrorKind as m, BetterResultApi as n, Result as o, DbError as p, BetterResultShape as r, ThrowMapper as s, AsyncResult as t, ok as u, ErrorMapper as v, isDbError as w, dbError as x, RawDbError as y };
+export { isConflict as C, statusOf as D, mapDbError as E, isCheck as S, isForeignKey as T, DbException as _, Ok as a, ValidationIssue as b, err as c, toBetterResult as d, toDbError as f, DbErrorOf as g, DbErrorKinds as h, Err as i, fromBetterResult as l, DbErrorKind as m, BetterResultApi as n, Result as o, DbError as p, BetterResultValue as r, ThrowMapper as s, AsyncResult as t, ok as u, ErrorMapper as v, isDbError as w, dbError as x, RawDbError as y };

package/dist/server/index.d.ts

@@ -1,12 +1,14 @@
-import { n as AnyModels, t as AnyFunctions } from "../types-C83v5SQz.js";
-import { t as BetterSupabase, y as Db } from "../define-e3zI4_4g.js";
-import { h as RequestContext } from "../plugin-C4TR9J0Z.js";
-import { a as checkAal, c as impersonatorOf, i as amrOf, n as AmrEntry, o as ImpersonationOptions, r as aalOf, s as Impersonator, t as Aal } from "../mfa-TVia554c.js";
-import { _ as readSession, a as ResolveAuthOptions, b as writeSession, c as clientIp, d as CookieOptions, f as CookieRecord, i as InvalidReason, l as resolveAuth, m as StoredSession, n as AuthResolver, o as ResolvedState, p as CookieWrite, r as AuthState, s as authContext, t as AuthResolution, u as AUTH_CACHE_HEADERS, y as sessionCookieName } from "../resolve-CjHILk2w.js";
-import { _ as DeleteAccountResult, a as guard, c as settle, d as ServerContext, f as ServerOptions, g as DeleteAccountOptions, h as ReplicaState, i as Settled, l as BetterServer, m as PRIMARY_COOKIE, n as GuardOptions, o as isResult, p as createServer, r as RespondOptions, s as respond, t as AuthKind, u as ContextOptions } from "../respond-Dne1ARSa.js";
-import { a as defineResource, i as ResourceRouteOptions, n as ResourceInput, r as ResourceList, t as ResourceHandler } from "../resource-CgZa3YG_.js";
-import { a as ProblemResponseOptions, c as problemResponse, i as ProblemOptions, l as toProblem, n as PROBLEM_TYPE_BASE, o as fromProblem, r as ProblemDetails, s as isProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-DlgB0lYl.js";
-import { n as RefreshOutcome, r as refreshSession } from "../index-CG69s15v.js";
+import { n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
+import { p as DbError } from "../result-c2OYgCV2.js";
+import { t as BetterSupabase, y as Db } from "../define-DUbydmJa.js";
+import { h as RequestContext } from "../plugin-DVRB8qNE.js";
+import { a as checkAal, c as impersonatorOf, i as amrOf, n as AmrEntry, o as ImpersonationOptions, r as aalOf, s as Impersonator, t as Aal } from "../mfa-x3V3vGh-.js";
+import { _ as readSession, a as ResolveAuthOptions, b as writeSession, c as clientIp, d as CookieOptions, f as CookieRecord, i as InvalidReason, l as resolveAuth, m as StoredSession, n as AuthResolver, o as ResolvedState, p as CookieWrite, r as AuthState, s as authContext, t as AuthResolution, u as AUTH_CACHE_HEADERS, y as sessionCookieName } from "../resolve-BRciX2jK.js";
+import { _ as DeleteAccountResult, a as guard, c as settle, d as ServerContext, f as ServerOptions, g as DeleteAccountOptions, h as ReplicaState, i as Settled, l as BetterServer, m as PRIMARY_COOKIE, n as GuardOptions, o as isResult, p as createServer, r as RespondOptions, s as respond, t as AuthKind, u as ContextOptions } from "../respond-DAkPIdTH.js";
+import { a as ResourceRouteOptions, i as ResourcePagination, n as ResourceInput, o as defineResource, r as ResourceList, t as ResourceHandler } from "../resource-CwVgiI5q.js";
+import { a as ProblemResponseOptions, c as problemResponse, i as ProblemOptions, l as toProblem, n as PROBLEM_TYPE_BASE, o as fromProblem, r as ProblemDetails, s as isProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-Z2RTQjZD.js";
+import { a as SessionDelegation, i as SessionActor, n as toSession, r as ActClaim, t as AuthSession } from "../view-3Po_PVlr.js";
+import { n as RefreshOutcome, r as refreshSession } from "../index-kpgopLNv.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Middleware } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
@@ -39,4 +41,27 @@ export declare function withBetterPostgres<M extends AnyModels, D, F extends Any
   readonly postgres: PostgresApi;
 }, Db<M, F, E, undefined>>;
 //#endregion
-export { AUTH_CACHE_HEADERS, type Aal, type AmrEntry, type AuthKind, type AuthResolution, type AuthResolver, type AuthState, type BetterServer, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type DeleteAccountOptions, type DeleteAccountResult, type GuardOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type ReplicaState, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourceRouteOptions, type RespondOptions, type ServerContext, type ServerOptions, type Settled, type StoredSession, type SupabaseAuthContext, aalOf, amrOf, authContext, checkAal, clientIp, createServer, defineResource, fromProblem, guard, impersonatorOf, isProblem, isResult, problemResponse, readSession, refreshSession, resolveAuth, respond, sessionCookieName, settle, toProblem, writeSession };
+//#region src/auth/revocation.d.ts
+/** A client that can read `auth.sessions`, such as `createPostgres().admin`. */
+interface SessionLookup {
+  queryRaw<T = Record<string, unknown>>(text: string, params?: unknown[]): Promise<T[]>;
+}
+/**
+ * `undefined` when the user token's session still exists in `auth.sessions`;
+ * otherwise an `unauthorized` error with code `SESSION_REVOKED`. A verified
+ * access token stays valid until it expires, even after sign-out; call this
+ * before sensitive actions (deleting the account, changing the email) to
+ * reject tokens of ended sessions. It costs one query, so nothing calls it
+ * by default. Non-user callers pass: `guard` decides about them.
+ */
+export declare function checkSession(sql: SessionLookup, auth: {
+  readonly kind: "user";
+  readonly claims: {
+    readonly sub?: unknown;
+    readonly session_id?: unknown;
+  };
+} | {
+  readonly kind: string;
+}): Promise<DbError | undefined>;
+//#endregion
+export { AUTH_CACHE_HEADERS, type Aal, type ActClaim, type AmrEntry, type AuthKind, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type BetterServer, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type DeleteAccountOptions, type DeleteAccountResult, type GuardOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type ReplicaState, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, type ServerContext, type ServerOptions, type SessionActor, type SessionDelegation, type SessionLookup, type Settled, type StoredSession, type SupabaseAuthContext, aalOf, amrOf, authContext, checkAal, clientIp, createServer, defineResource, fromProblem, guard, impersonatorOf, isProblem, isResult, problemResponse, readSession, refreshSession, resolveAuth, respond, sessionCookieName, settle, toProblem, toSession, writeSession };