better-supabase 0.2.0 → 0.3.0

package/dist/server/index.js

@@ -1,8 +1,10 @@
-import { a as problemResponse, i as isProblem, n as PROBLEM_TYPE_BASE, o as toProblem, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-BTkTtRV9.js";
-import { a as settle, i as respond, n as guard, o as createServer, r as isResult, u as PRIMARY_COOKIE } from "../respond-DMcbQwfN.js";
-import { a as clientIp, f as sessionCookieName, g as impersonatorOf, i as authContext, m as refreshSession, n as amrOf, o as resolveAuth, p as writeSession, r as checkAal, s as AUTH_CACHE_HEADERS, t as aalOf, u as readSession } from "../mfa-CpLfJSde.js";
-import { n as postgresExecutor } from "../executor-DeppvirK.js";
-import { t as defineResource } from "../resource-BHEWmQJK.js";
+import { n as dbError } from "../errors-Bl3rkOzo.js";
+import { a as problemResponse, i as isProblem, n as PROBLEM_TYPE_BASE, o as toProblem, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-CGt1ADix.js";
+import { a as settle, i as respond, n as guard, o as createServer, r as isResult, u as PRIMARY_COOKIE } from "../respond-C44EZAJo.js";
+import { a as clientIp, f as sessionCookieName, i as authContext, m as refreshSession, n as amrOf, o as resolveAuth, p as writeSession, r as checkAal, s as AUTH_CACHE_HEADERS, t as aalOf, u as readSession, v as impersonatorOf } from "../mfa-BxoR1RkN.js";
+import { n as postgresExecutor } from "../executor-C57jx2pn.js";
+import { t as toSession } from "../view-wZ-9qIUz.js";
+import { t as defineResource } from "../resource-D30rp0GN.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/server/middleware.ts
 /** Repository context from a `@supabase/server` context. */
@@ -14,8 +16,8 @@ function contextFromSupabase(ctx) {
 				actor: {
 					id: ctx.userClaims.id,
 					kind: "user",
-					...ctx.userClaims.role !== void 0 ? { role: ctx.userClaims.role } : {},
-					...ctx.userClaims.email !== void 0 ? { email: ctx.userClaims.email } : {}
+					...ctx.userClaims.role === void 0 ? {} : { role: ctx.userClaims.role },
+					...ctx.userClaims.email === void 0 ? {} : { email: ctx.userClaims.email }
 				},
 				claims: ctx.jwtClaims ?? {}
 			};
@@ -29,7 +31,10 @@ function contextFromSupabase(ctx) {
 		};
 		case "publishable":
 		case "none": break;
-		default: return ctx.authMode;
+		default: {
+			const unknown = ctx.authMode;
+			throw new TypeError(`contextFromSupabase: unknown auth mode "${String(unknown)}"`);
+		}
 	}
 	return {
 		actor: {
@@ -65,4 +70,28 @@ function withBetterPostgres(sb) {
 	});
 }
 //#endregion
-export { AUTH_CACHE_HEADERS, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, aalOf, amrOf, authContext, checkAal, clientIp, contextFromSupabase, createServer, defineResource, fromProblem, guard, impersonatorOf, isProblem, isResult, problemResponse, readSession, refreshSession, resolveAuth, respond, sessionCookieName, settle, toProblem, withBetterPostgres, withBetterSupabase, writeSession };
+//#region src/auth/revocation.ts
+const UUID = /^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/i;
+const ACTIVE = `select exists (
+  select 1 from auth.sessions s
+  where s.id = $1::uuid and s.user_id = $2::uuid
+    and (s.not_after is null or s.not_after > now())
+) as active`;
+/**
+* `undefined` when the user token's session still exists in `auth.sessions`;
+* otherwise an `unauthorized` error with code `SESSION_REVOKED`. A verified
+* access token stays valid until it expires, even after sign-out; call this
+* before sensitive actions (deleting the account, changing the email) to
+* reject tokens of ended sessions. It costs one query, so nothing calls it
+* by default. Non-user callers pass: `guard` decides about them.
+*/
+async function checkSession(sql, auth) {
+	if (auth.kind !== "user" || !("claims" in auth)) return void 0;
+	const { sub, session_id: sessionId } = auth.claims;
+	const revoked = dbError("unauthorized", "This session has ended", { code: "SESSION_REVOKED" });
+	if (typeof sessionId !== "string" || typeof sub !== "string" || !UUID.test(sessionId) || !UUID.test(sub)) return revoked;
+	const [row] = await sql.queryRaw(ACTIVE, [sessionId, sub]);
+	return row?.active === true ? void 0 : revoked;
+}
+//#endregion
+export { AUTH_CACHE_HEADERS, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, aalOf, amrOf, authContext, checkAal, checkSession, clientIp, contextFromSupabase, createServer, defineResource, fromProblem, guard, impersonatorOf, isProblem, isResult, problemResponse, readSession, refreshSession, resolveAuth, respond, sessionCookieName, settle, toProblem, toSession, withBetterPostgres, withBetterSupabase, writeSession };

package/dist/{simplify-bwJpLnaS.js → simplify-LakqK1vH.js}

@@ -1,4 +1,6 @@
 import { n as dbError, t as DbException } from "./errors-Bl3rkOzo.js";
+import { i as temporalText } from "./temporal-BwshQk0W.js";
+import { t as temporal } from "./temporal-required-CMxeSVPo.js";
 import { i as or, r as not, t as and } from "./types-6cYK9pbJ.js";
 //#region src/schema/define.ts
 /**
@@ -27,17 +29,19 @@ function relationMeta(meta, table, relation) {
 }
 //#endregion
 //#region src/ir/codec.ts
-/** Wire form of an app value: `Date` to ISO text, `bigint` to decimal text. */
+/** Wire form of an app value: Temporal values to ISO text, `bigint` to decimal text. */
 function encodeValue(value) {
-	if (value instanceof Date) return value.toISOString();
 	if (typeof value === "bigint") return value.toString();
+	const text = temporalText(value);
+	if (text !== void 0) return text;
 	if (Array.isArray(value)) return value.map(encodeValue);
 	return value;
 }
 function decodeScalar(codec, value) {
 	if (value === null || value === void 0) return value;
 	switch (codec) {
-		case "date": return new Date(value);
+		case "instant": return temporal().Instant.from(String(value));
+		case "plainDateTime": return temporal().PlainDateTime.from(String(value));
 		case "bigint": return BigInt(value);
 		case "string": return String(value);
 		default: return codec;
@@ -170,7 +174,7 @@ function writable(meta, mode) {
 }
 /** Escapes LIKE wildcards so user input matches literally. */
 function escapeLike(value) {
-	return value.replace(/[\\%_]/g, (char) => `\\${char}`);
+	return value.replaceAll(/[\\%_]/g, (char) => `\\${char}`);
 }
 var IrBuilder = class {
 	meta;
@@ -411,13 +415,7 @@ var IrBuilder = class {
 			alias,
 			column
 		};
-		return codec === "date" ? {
-			fn,
-			key,
-			alias,
-			column,
-			codec
-		} : {
+		return {
 			fn,
 			key,
 			alias,
@@ -434,11 +432,7 @@ var IrBuilder = class {
 			alias,
 			column
 		};
-		return codec === "date" ? {
-			alias,
-			column,
-			codec
-		} : {
+		return {
 			alias,
 			column,
 			cast: "text",

package/dist/sql/index.d.ts

@@ -0,0 +1,139 @@
+import { s as ClaimsMeta } from "../types-DONv9SHN.js";
+import { B as ReadSet } from "../define-DUbydmJa.js";
+import { b as ResolvedConfig } from "../config-C1CYcm6o.js";
+import { n as permdockKeys } from "../permdock-sql-DImJULY-.js";
+//#region src/sql/kit.d.ts
+/**
+ * SQL kit modules for `better-supabase sql add`. Every module is idempotent
+ * (`create or replace`, `if not exists`), so re-running it upgrades in place.
+ */
+interface SqlModule {
+  readonly name: string;
+  readonly title: string;
+  readonly description: string;
+  /** Modules this one needs, added along with it. */
+  readonly requires: readonly string[];
+  /** What it needs instead when the layout has `permdock`. */
+  readonly permdockRequires?: readonly string[];
+  /** `schema` files go with your schemas; `test` files go to `supabase/tests`. */
+  readonly target: "schema" | "test";
+  /** The module with the default claim names. */
+  readonly sql: string;
+  /** The module for configured claim names (`config.claims`), when it reads claims. */
+  readonly render?: (claims: ClaimsMeta, layout: KitLayout) => string;
+}
+/** New modules go at the end: the position is part of the file name. */
+export declare const SQL_MODULES: Readonly<Record<string, SqlModule>>;
+/** The modules to install for `names`, dependencies first. Throws on an unknown name. */
+export declare function resolveModules(names: readonly string[], layout?: KitLayout): SqlModule[];
+interface KitFile {
+  readonly module: string;
+  readonly path: string;
+  readonly contents: string;
+}
+interface KitLayout {
+  /** Directory for schema modules. Defaults to `supabase/schemas`. */
+  readonly dir?: string;
+  /** File prefix. Defaults to `900_better_supabase`. */
+  readonly prefix?: string;
+  /** Directory for pgTAP files. Defaults to `supabase/tests`. */
+  readonly testsDir?: string;
+  /** Version stamped into the header. */
+  readonly version?: string;
+  /** `config.realtime.tables`: registered at the end of the `realtime-tables` module. */
+  readonly realtimeTables?: readonly string[];
+  /** Tenant column passed to `track_realtime`; tables without it broadcast unscoped. */
+  readonly tenantColumn?: string;
+  /** Check constraints for the `jsonb-schemas` module. */
+  readonly jsonSchemas?: readonly JsonSchemaCheck[];
+  /** `config.expose`: the grants the `grants` module writes. */
+  readonly grants?: readonly TableGrant[];
+  /** `config.readSets`, compiled: the functions the `read-sets` module writes. */
+  readonly readSets?: readonly {
+    readonly name: string;
+    readonly sql: string;
+  }[];
+  /** `config.entitlements`: where the `entitlements` module finds each tenant's Stripe customer. */
+  readonly entitlements?: EntitlementsSource;
+  /** `config.vectorSearch`: the tables the `vector-search` module writes a search function for. */
+  readonly vectorSearch?: readonly VectorSearchTable[];
+  /** `config.claims`: claim names the modules read and write. */
+  readonly claims?: ClaimsMeta;
+  /** PermDock's helpers and membership sources, from its manifest: `entitlements` reads them instead of `tenant`. */
+  readonly permdock?: KitPermdock;
+}
+/** One PermDock membership source, from the manifest's `memberships`. */
+interface KitMembershipSource {
+  /** `schema.table`. */
+  readonly table: string;
+  readonly userColumn: string;
+  readonly scope: {
+    readonly column: string;
+  } | {
+    readonly value: string;
+  };
+  readonly idColumn: string;
+}
+/** Where PermDock's `member_<scope>_ids` helpers live, and the tables behind them. */
+interface KitPermdock {
+  /** PermDock's `rls.schema`. */
+  readonly schema: string;
+  /** The PermDock scope tenants map to, e.g. `organization`. */
+  readonly scope: string;
+  readonly memberships: readonly KitMembershipSource[];
+}
+/** An embedding column `db.$search` can query. */
+interface VectorSearchTable {
+  /** `table` or `schema.table`. */
+  readonly table: string;
+  readonly column: string;
+  readonly distance: "cosine" | "l2" | "inner_product";
+}
+/** The table holding each tenant's Stripe customer id. */
+interface EntitlementsSource {
+  /** `table` or `schema.table`. */
+  readonly table: string;
+  /** Column with the Stripe customer id (`cus_...`). */
+  readonly column: string;
+  /** Column with the tenant id. */
+  readonly key: string;
+}
+/** Privileges one Data API role gets on a table or view. */
+interface TableGrant {
+  /** `table` or `schema.table`. */
+  readonly table: string;
+  readonly role: "anon" | "authenticated";
+  readonly privileges: readonly ("select" | "insert" | "update" | "delete")[];
+}
+/** A jsonb column and the JSON Schema its values must match. */
+interface JsonSchemaCheck {
+  /** `table` or `schema.table`. */
+  readonly table: string;
+  readonly column: string;
+  readonly schema: Readonly<Record<string, unknown>>;
+}
+/** Whether an installed file matches, ignoring the version stamped in its header. */
+export declare function sameKitFile(current: string | undefined, expected: string): boolean;
+/** The files `sql add` writes for these modules. */
+export declare function renderKit(names: readonly string[], layout?: KitLayout): KitFile[];
+//#endregion
+//#region src/sql/layout.d.ts
+/** Where and how `sql add` writes kit files for this config. */
+export declare function kitLayout(config: ResolvedConfig, testsDir?: string, readSets?: KitLayout["readSets"], permdock?: KitPermdock): KitLayout;
+//#endregion
+//#region src/sql/read-sets.d.ts
+/** A read set compiled to the SQL of its function. */
+interface CompiledReadSet {
+  readonly name: string;
+  readonly sql: string;
+}
+/**
+ * The function for a read set: `stable`, `security invoker` (RLS applies to
+ * the caller) and with an empty `search_path`. Parameters are read from the
+ * `p jsonb` argument; nothing is built dynamically.
+ */
+export declare function compileReadSet(set: ReadSet): Promise<CompiledReadSet>;
+/** Compiles every set, sorted by name. Throws on a duplicate name. */
+export declare function compileReadSets(sets: readonly ReadSet[]): Promise<CompiledReadSet[]>;
+//#endregion
+export { type CompiledReadSet, type KitFile, type KitLayout, type KitPermdock, type SqlModule, permdockKeys };