better-supabase 0.4.0 → 0.5.0

package/dist/{mfa-byfjruR9.js → view-Bq64ki8-.js}

@@ -1,28 +1,9 @@
-import { n as dbError } from "./errors-L0xK41y_.js";
+import { n as dbError } from "./errors-DtwXa6b8.js";
 import { t as consoleLogger } from "./logger-glM28NVN.js";
 import { n as decodeJwtPayload } from "./base64-D2gsioCY.js";
+import { n as impersonatorOf, r as userContext } from "./impersonation-VfaGc4Q_.js";
 import { DEFAULT_COOKIE_OPTIONS, createChunks, isChunkLike, parseCookieHeader, serializeCookieHeader, stringFromBase64URL, stringToBase64URL } from "@supabase/ssr";
 import { extractCredentials, verifyCredentials } from "@supabase/server/core";
-//#region src/auth/impersonation.ts
-/** The `act` claim for an impersonated session. */
-function actClaim(options) {
-	return {
-		sub: options.actor,
-		reason: options.reason
-	};
-}
-/** The impersonator in `claims.act`, or `undefined` for a normal session. */
-function impersonatorOf(claims) {
-	const act = claims["act"];
-	if (typeof act !== "object" || act === null) return void 0;
-	const { sub, reason } = act;
-	if (typeof sub !== "string" || sub === "") return void 0;
-	return typeof reason === "string" ? {
-		id: sub,
-		reason
-	} : { id: sub };
-}
-//#endregion
 //#region src/auth/actor.ts
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -284,7 +265,7 @@ function serverEnv(options) {
 		url: env.url,
 		publishableKeys: { default: env.publishableKey },
 		secretKeys: env.secretKeys ?? (env.secretKey ? { default: env.secretKey } : {}),
-		jwks: options.jwks ?? env.jwksUrl
+		jwks: options.jwks ?? env.jwks ?? env.jwksUrl
 	};
 }
 const MEMO_SIZE = 256;
@@ -295,7 +276,7 @@ let memoByJwks = /* @__PURE__ */ new WeakMap();
 * and island resolves the same token again; this skips the signature check.
 */
 function memoFor(options) {
-	const jwks = options.jwks;
+	const jwks = options.jwks ?? options.env.jwks;
 	if (jwks && typeof jwks === "object" && !(jwks instanceof URL)) {
 		let memo = memoByJwks.get(jwks);
 		if (!memo) memoByJwks.set(jwks, memo = /* @__PURE__ */ new Map());
@@ -311,6 +292,42 @@ function memoFor(options) {
 	if (!memo) memoByUrl.set(key, memo = /* @__PURE__ */ new Map());
 	return memo;
 }
+function sameJson(a, b) {
+	if (a === b) return true;
+	if (typeof a !== "object" || typeof b !== "object" || !a || !b) return false;
+	if (Array.isArray(a) !== Array.isArray(b)) return false;
+	const left = Object.entries(a);
+	const right = new Map(Object.entries(b));
+	return left.length === right.size && left.every(([key, value]) => right.has(key) && sameJson(value, right.get(key)));
+}
+/**
+* Records a token that `@supabase/server` verified for this request, so the
+* next `resolveAuth` with these options doesn't verify it again. Only when
+* `claims` is the token's own payload, it hasn't expired, and its `iss` and
+* `aud` pass the checks these options would apply; otherwise returns false
+* and the token is verified as usual.
+*/
+function rememberVerified(options, verified) {
+	const { token, claims, user } = verified;
+	const now = Math.floor((options.now ?? Date.now)() / 1e3);
+	const expiresAt = typeof claims.exp === "number" ? claims.exp : null;
+	if (expiresAt === null || expiresAt <= now) return false;
+	if (!sameJson(decodeJwtPayload(token), claims)) return false;
+	const issuers = [options.issuer ?? `${options.env.url}/auth/v1`].flat();
+	if (typeof claims.iss !== "string" || !issuers.includes(claims.iss)) return false;
+	const audiences = [options.audience ?? "authenticated"].flat();
+	const aud = claims.aud;
+	const given = Array.isArray(aud) ? aud : [aud];
+	if (!audiences.some((audience) => given.includes(audience))) return false;
+	remember(memoFor(options), token, {
+		kind: "user",
+		token,
+		claims,
+		user,
+		expiresAt
+	}, expiresAt);
+	return true;
+}
 function remembered(memo, token, now) {
 	const hit = memo.get(token);
 	if (!hit) return void 0;
@@ -444,7 +461,7 @@ function base64url(text) {
 * fetch it as before.
 */
 function prefetchJwks(options) {
-	if (options.jwks !== void 0) return Promise.resolve();
+	if (options.jwks !== void 0 || options.env.jwks !== void 0) return Promise.resolve();
 	return verifyCredentials({
 		token: PREFETCH_TOKEN,
 		apikey: null
@@ -546,6 +563,10 @@ async function resolveAuth(request, options) {
 		token: null,
 		apikey: credentials.apikey
 	}, options.secret === true ? ["secret"] : options.secret.map((name) => `secret:${name}`), options, "bearer"), cookies);
+	if (options.cookies === false) return resolution({
+		kind: "anon",
+		reason: "none"
+	}, cookies);
 	const name = options.cookie?.name ?? sessionCookieName(options.env.url);
 	const session = readSession(cookies(), name);
 	if (!session) {
@@ -611,19 +632,7 @@ async function resolveAuth(request, options) {
 /** The repository context (`actor`, `claims`) for an auth state. */
 function authContext(auth) {
 	switch (auth.kind) {
-		case "user": {
-			const impersonator = impersonatorOf(auth.claims);
-			return {
-				actor: {
-					id: auth.user.id,
-					kind: "user",
-					...auth.user.role === void 0 ? {} : { role: auth.user.role },
-					...auth.user.email === void 0 ? {} : { email: auth.user.email },
-					...impersonator ? { impersonator: impersonator.id } : {}
-				},
-				claims: auth.claims
-			};
-		}
+		case "user": return userContext(auth.user, auth.claims);
 		case "service": return {
 			actor: {
 				id: `service:${auth.keyName}`,
@@ -682,4 +691,52 @@ function checkAal(auth, required) {
 	});
 }
 //#endregion
-export { delegationOf as _, clientIp as a, AUTH_CACHE_HEADERS as c, readSession as d, serializeCookie as f, actorOf as g, refreshSession as h, authContext as i, applyCookieWrites as l, writeSession as m, amrOf as n, prefetchJwks as o, sessionCookieName as p, checkAal as r, resolveAuth as s, aalOf as t, parseCookies as u, actClaim as v, impersonatorOf as y };
+//#region src/auth/view.ts
+/** Whether the token belongs to an anonymous user (`signInAnonymously()`). */
+function isAnonymousUser(claims) {
+	return "is_anonymous" in claims && claims.is_anonymous === true;
+}
+/** Drops the token from an `AuthState`, leaving only serializable fields. */
+function toSession(auth) {
+	switch (auth.kind) {
+		case "user": {
+			const impersonator = impersonatorOf(auth.claims);
+			const outcome = actorOf(auth.claims);
+			const actor = outcome.ok ? outcome.actor : void 0;
+			const scopes = actor ? delegationOf(auth.claims)?.scopes : void 0;
+			const delegation = actor && (scopes || actor.chain) ? {
+				scopes: scopes ?? [],
+				...actor.chain ? { chain: actor.chain } : {}
+			} : void 0;
+			return {
+				kind: "user",
+				user: auth.user,
+				claims: auth.claims,
+				expiresAt: auth.expiresAt,
+				...auth.profile === void 0 ? {} : { profile: auth.profile },
+				aal: aalOf(auth.claims),
+				anonymous: isAnonymousUser(auth.claims),
+				amr: amrOf(auth.claims),
+				...impersonator ? { impersonator } : {},
+				...actor ? { actor } : {},
+				...delegation ? { delegation } : {}
+			};
+		}
+		case "service": return {
+			kind: "service",
+			keyName: auth.keyName
+		};
+		case "anon": return {
+			kind: "anon",
+			reason: auth.reason
+		};
+		case "invalid": return {
+			kind: "invalid",
+			reason: auth.reason,
+			error: auth.error
+		};
+		default: return auth;
+	}
+}
+//#endregion
+export { writeSession as _, checkAal as a, delegationOf as b, prefetchJwks as c, AUTH_CACHE_HEADERS as d, applyCookieWrites as f, sessionCookieName as g, serializeCookie as h, amrOf as i, rememberVerified as l, readSession as m, toSession as n, authContext as o, parseCookies as p, aalOf as r, clientIp as s, isAnonymousUser as t, resolveAuth as u, refreshSession as v, actorOf as y };

package/dist/webhooks/index.d.ts

@@ -1,7 +1,12 @@
 /// <reference lib="esnext.temporal" />
-import { N as TableKey, O as Row, n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
-import { o as Result } from "../result-CqEsbgYs.js";
-import { t as BetterSupabase } from "../define-CRS2MRV3.js";
+import { P as TableKey, k as Row, n as AnyFunctions, r as AnyModels } from "../types-Dnf_wRDz.js";
+import { S as ErrorMapper, a as AsyncResult, u as Result } from "../executor-BunPOO-k.js";
+import { a as EventHub } from "../events-aIO7vsIk.js";
+import { t as BetterSupabase } from "../define-Bp_BZa5h.js";
+import { g as RequestContext } from "../plugin-o144f322.js";
+import { r as EventSink } from "../index-DOESKG27.js";
+import { i as sqlTransport, n as RpcClient, r as rpcTransport, t as KitTransport } from "../kit-transport-B82k1djG.js";
+import { _ as PublicUrlOptions, a as hmacSigner, b as publicUrl, c as WebhookSecretStore, d as WebhookPolicyError, f as WebhookRequest, g as AllowUrl, h as fetchTransport, i as WebhookSigner, l as sqlSecretStore, m as WebhookTransport, n as StandardWebhooksOptions, o as standardWebhooks, p as WebhookResponse, r as WebhookSignInput, s as RotateSecretOptions, t as HmacSignerOptions, u as FetchTransportOptions, v as ResolveHost, y as isPublicAddress } from "../signers-Cc6r98SW.js";
 //#region src/webhooks/verify.d.ts
 interface VerifiedWebhook<T = unknown> {
   readonly id: string;
@@ -73,6 +78,8 @@ interface AuthHooks {
         readonly site_url: string;
         readonly token_new: string;
         readonly token_hash_new: string;
+        /** Auth adds fields over time (`old_email`, `factor_type`, ...). */
+        readonly [key: string]: unknown;
       };
     };
     output: Record<never, never>;
@@ -151,4 +158,128 @@ export declare function isDatabaseWebhook(value: unknown): value is DatabaseWebh
  */
 export declare function databaseChange<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>>(betterSupabase: BetterSupabase<M, D, F, E>, table: T, payload: unknown): DatabaseChange<Row<M, T>> | null;
 //#endregion
-export type { AuthHookError, AuthHookKind, AuthHooks, DatabaseChange, DatabaseWebhookPayload, VerifiedWebhook, VerifyOptions, WebhookInput };
+//#region src/webhooks/outgoing.d.ts
+/** One claimed delivery, as `shouldDeliver`, `transform` and `headers` see it. */
+interface WebhookDelivery {
+  readonly id: string;
+  readonly endpointId: string;
+  readonly url: string;
+  readonly type: string;
+  readonly payload: unknown;
+  /** 1 on the first try. Counted when the delivery is claimed. */
+  readonly attempt: number;
+  readonly tenant: string | null;
+  readonly eventId: string | null;
+  readonly runId: string | null;
+  readonly createdAt: Temporal.Instant;
+}
+interface RetryPolicy {
+  /** Attempts before a delivery is dead-lettered. Defaults to 8. */
+  readonly maxAttempts?: number;
+  /**
+   * Seconds before the next attempt. Defaults to 5 seconds, 5 minutes, 30
+   * minutes, 2 hours, 5 hours, then 10 hours, each with full jitter. A
+   * receiver's `Retry-After` wins when it asks for longer, up to a day.
+   */
+  readonly backoff?: (attempt: number) => number;
+  /** Statuses worth retrying. Defaults to 408, 429 and 5xx; network errors always retry. */
+  readonly retryable?: (status: number) => boolean;
+}
+interface WebhooksOptions {
+  /** `sqlTransport(postgres.admin)` for the worker, or the user's connection to manage. */
+  readonly transport: KitTransport;
+  /** `kits.webhooks-out.schema`. Defaults to `better_supabase`. */
+  readonly schema?: string;
+  /** Defaults to `fetchTransport({ allowUrl })`. */
+  readonly http?: WebhookTransport;
+  /** Used by the default `http`. Defaults to `publicUrl()`. */
+  readonly allowUrl?: AllowUrl;
+  /** Defaults to `standardWebhooks()`. */
+  readonly signer?: WebhookSigner;
+  /** Defaults to `sqlSecretStore(transport)`. */
+  readonly secrets?: WebhookSecretStore;
+  readonly retry?: RetryPolicy;
+  /** Return `false` (or throw) to cancel a delivery instead of sending it. */
+  readonly shouldDeliver?: (delivery: WebhookDelivery) => boolean | Promise<boolean>;
+  /**
+   * The JSON body. Defaults to the Standard Webhooks envelope,
+   * `{ type, timestamp, data }`.
+   */
+  readonly transform?: (delivery: WebhookDelivery) => unknown;
+  /** Extra headers, e.g. an `idempotency-key`. */
+  readonly headers?: (delivery: WebhookDelivery) => Readonly<Record<string, string>>;
+  /** Characters of the response body kept in the log. Defaults to 2000. */
+  readonly responseBodyLimit?: number;
+  /** `betterSupabase.events`, for `webhook.*` kit events. */
+  readonly events?: EventHub;
+  readonly context?: RequestContext;
+  readonly errorMappers?: readonly ErrorMapper[];
+}
+interface PublishInput {
+  readonly type: string;
+  readonly data: unknown;
+  readonly tenant?: string;
+  /** With an id, publishing it again never queues a second delivery. */
+  readonly id?: string;
+}
+interface DispatchInput {
+  readonly endpointId: string;
+  readonly type: string;
+  readonly data: unknown;
+  /** An external run id stored with the delivery, e.g. a workflow run. */
+  readonly runId?: string;
+  readonly eventId?: string;
+}
+interface DeliverWebhooksOptions {
+  /** Deliveries per claim. Defaults to 25. */
+  readonly batch?: number;
+  /**
+   * Requests in flight at once. Defaults to 10, so a batch of 25 at the
+   * 10-second timeout finishes well inside the lease.
+   */
+  readonly concurrency?: number;
+  /** How long a claim holds a delivery. Defaults to `'2 minutes'`. */
+  readonly lease?: string;
+  readonly budgetMs?: number;
+}
+interface DeliverWebhooksResult {
+  readonly succeeded: number;
+  /** Failed attempts that will retry. */
+  readonly retrying: number;
+  /** Deliveries that ran out of attempts or can't succeed. */
+  readonly dead: number;
+  readonly canceled: number;
+  /** Endpoints disabled after failing for `disableAfter`. */
+  readonly disabled: number;
+}
+interface WebhooksRouteOptions extends DeliverWebhooksOptions {
+  readonly secret: string | undefined;
+  readonly onError?: (error: unknown) => void;
+}
+interface Webhooks {
+  /** Queues the event for each subscribed endpoint; returns how many. */
+  publish(event: PublishInput): AsyncResult<number>;
+  /** Sends to one endpoint outside its subscriptions; returns the delivery id. */
+  dispatch(input: DispatchInput): AsyncResult<string>;
+  /** Queues a finished delivery again. */
+  redeliver(deliveryId: string): AsyncResult<string>;
+  /** A new signing secret, returned once. */
+  rotateSecret(endpointId: string, options?: RotateSecretOptions): AsyncResult<string>;
+  /** Sends due deliveries. Run it from a cron route or a job. */
+  deliver(options?: DeliverWebhooksOptions): Promise<DeliverWebhooksResult>;
+  /** A `GET`/`POST` handler for Vercel Cron that runs `deliver` behind a bearer secret. */
+  deliverRoute(options: WebhooksRouteOptions): (request: Request) => Promise<Response>;
+  /**
+   * An `EventSink` that publishes CloudEvents, e.g. from the outbox relay.
+   * Endpoints subscribe to unprefixed types, so it removes `typePrefix`
+   * (`dev.better-supabase` by default, the relay's default) and the dot.
+   */
+  sink(options?: WebhookSinkOptions): EventSink;
+}
+interface WebhookSinkOptions {
+  /** The relay's `typePrefix`. */
+  readonly typePrefix?: string;
+}
+export declare function createWebhooks(options: WebhooksOptions): Webhooks;
+//#endregion
+export { type AllowUrl, type AuthHookError, type AuthHookKind, type AuthHooks, type DatabaseChange, type DatabaseWebhookPayload, type DeliverWebhooksOptions, type DeliverWebhooksResult, type DispatchInput, type FetchTransportOptions, type HmacSignerOptions, type KitTransport, type PublicUrlOptions, type PublishInput, type ResolveHost, type RetryPolicy, type RotateSecretOptions, type RpcClient, type StandardWebhooksOptions, type VerifiedWebhook, type VerifyOptions, type WebhookDelivery, type WebhookInput, WebhookPolicyError, type WebhookRequest, type WebhookResponse, type WebhookSecretStore, type WebhookSignInput, type WebhookSigner, type WebhookSinkOptions, type WebhookTransport, type Webhooks, type WebhooksOptions, type WebhooksRouteOptions, fetchTransport, hmacSigner, isPublicAddress, publicUrl, rpcTransport, sqlSecretStore, sqlTransport, standardWebhooks };